The purpose of this text is to clarify the responsibility and the role of EDENRED BELGIUM with regard to the processing of personal data carried out in the context of the management of meal vouchers and eco-cheques that are issued under the Ticket Restaurant and Ticket EcoCheque brands (hereafter "Ticket Restaurant® and Ticket EcoCheque")
- The concept of processing manager
The concept of "processing manager" is a key concept in the context of the protection of the personal privacy with regard to the processing of personal data.
According to the European advisory body, "the primary role of the processing manager is to determine who is responsible for enforcing data protection rules and how the persons who are affected can exercise their rights in practice".
By "processing manager", the Privacy Act "means the natural or legal person, the actual association or the public administration which, alone or together with others, determines the purposes and means of processing personal data ".
The power to "determine the purposes and means ..." may, according to the advisory body, "proceed from an explicit legal authority, when it designates the processing manager or that it charges a person, or impose on him, to collect and process certain data
- EDENRED BELGIUM is responsible for the processing of personal data carried out as part of the management of Ticket Restaurant and Ticket EcoCheque
A Royal Decree of 12 October 2010 lays down the conditions for approval and the approval procedure for producers of meal vouchers and eco-cheques in electronic form (hereafter referred to as "the RD Approval").
Conditions of approval include "security and privacy conditions" (article 3). The obligations of EDENRED BELGIUM in this respect are precisely defined. Compliance with the Privacy Act being one of them.
EDENRED BELGIUM was approved as a producer by the ministerial decree of 2 September 2011, taken in application of article 6 of the RD Approval, with effect from 7 July 2011.
Article 6 of the RD Approval provides that the producer is approved after having taken account of the conditions of security and protection of the personal privacy.
As an authorized publisher, EDENRED BELGIUM is recognized, under Article 3 of the RD Approval, as responsible for the processing of personal data carried out as part of the management of their Ticket Restaurant and Ticket EcoCheque .
The conditions of use of the Edenred card inform the users of the purposes of the processing of their data as part of the management of their Ticket Restaurant and Ticket EcoCheque and the existence, in this context, of the right of access and rectification with EDENRED BELGIUM as the single point of contact in this respect.
Finally, we refer to any additional information that we submitted to the Commission on the Protection of Privacy.
- Separate processing managers
The exchange of salary data in the context of the management of Ticket Restaurant and Ticket EcoCheque between EDENRED BELGIUM and its employer client (called "the CLIENT") must be considered as a transfer of data between separate processing managers, each subject to the data protection obligations concerning his own processing of personal data.
In this context, EDENRED BELGIUM does not act either as a subcontractor or as a joint responsible.
Article 16 of the Privacy Act providing that the controller must conclude a contract with its subcontractor is inapplicable.
Moreover, the new obligation imposed by Article 26 of the GDPR on joint processors to conclude an agreement is also not applicable.
Assuming that EDENRED BELGIUM and the CLIENT are considered jointly responsible for the data processing carried out as part of the management of Ticket Restaurant and Ticket EcoCheque, they would be exempted from entering into such an agreement insofar as their respective obligations are defined by law (see above).
To the extent necessary and assuming such an agreement is required, this, if any, is attached to and forms part of the Service Agreement between EDENRED BELGIUM and the CLIENT.