How Belgium’s privacy watchdog fell apart

The Belgian parliament’s recent decision to sack two directors at the Data Protection Authority, David Stevens and Charlotte Dereppe, is a messy conclusion to a bizarre and very Belgian drama.

The episode points to a bureaucracy rife with political patronage and a governance system starkly divided between Belgium’s two main language communities: French and Flemish, a variant of Dutch. Under these conditions, a straightforward conflict-of-interest complaint spiraled into a national scandal that turned a small committee of data protection experts into bitter enemies and drew the ire of the European Commission.

Frank Robben, the former DPA official at the center of the affair, is an influential figure in the Belgian state. An IT systems architect, he is lauded by many for helping to modernize the country’s public services over his 30-year career. But critics say his myriad government appointments present obvious conflicts of interest, and that he uses political ties to defend his position.

By 2019, Robben was simultaneously an adviser at the DPA; the head and founder of the Crossroads Bank for Social Security, a state body that manages exchanges of decentralized social security data between different public services; the head and founder of the country’s e-health platform; and the CEO of Smals, a non-profit company set up to provide IT services to the government.

Two directors speak out

In spring 2019, five new directors took office at the DPA: two francophone women, Alexandra Jaspar and Charlotte Dereppe; two Flemish-speaking men, David Stevens and Peter Van den Eynde; and one Dutchman long settled in Belgium, Hielke Hijmans.

During the months that followed, Jaspar and Dereppe complained that Robben’s simultaneous roles threatened the privacy authority’s independence from the government, which the DPA is required to scrutinize.

In an interview with MLex, Dereppe — who was fired alongside DPA president David Stevens this July — called Robben’s reputation for cutting red tape a “really well-oiled legend … It’s true that at the beginning of the 1990s he had some great ideas.” But now, Robben uses his extensive political influence to protect the career he’s built for himself, Dereppe said.

“His technique is to use committees: he is behind a tremendous number of committees,” she said, alleging that his allies on the Information Security Committee — which authorizes public sector data transfers, including those operated by the Crossroads Bank for Social Security — give him leverage against officials inclined to challenge his positions, by allowing him to threaten anything they want the committee to approve.

Robben told MLex that’s not true. “I can understand this argument from people who don’t know how it works,” he said in an interview. The Information Security Committee is appointed by Parliament, Robben said. Furthermore, “someone who has a political mandate cannot be in the committee.”

He also said that while at the DPA — and its predecessor, the Belgian Privacy Commission — he always recused himself from discussions of social security and health data, which in his view eliminated any conflict of interest.

‘Continuous harassment and intimidation’

Dereppe and Jaspar initially raised their concerns with their three fellow directors: Hijmans, Van den Eynde and Stevens. Then in September 2020 they wrote to the Chamber of Representatives, the lower house of the Belgian parliament and the only authority with the power to remove him.

But as the controversy around Robben heated up, relations among the five directors broke down badly, creating a whole other problem for Belgian politicians to grapple with.

In February 2021, Jaspar and Dereppe complained to the European Commission. The commission ordered Belgium to resolve conflicts of interest at the DPA, or face action at the EU Court of Justice.

In their letters to the Chamber of Representatives and to the commission, Jaspar and Dereppe also denounced Stevens, the president of the DPA, for, “continuous harassment and intimidation” in retaliation for their efforts to oust Robben. Stevens firmly denies that allegation, and bullying was not among the reasons for his censure by the parliament.

Party politics

According to reports in Le Soir, a Belgian francophone newspaper, Robben is close to the Christian Democratic and Flemish Party, the CD&V, which has participated in most national governments formed in the last several decades, including the current seven-party “Vivaldi” coalition formed in October 2020.

Robben declined to comment on whether he is a member of any political party, but said he had worked with politicians of all political stripes. He was recruited into public service in the late 1980s by social affairs minister Jean-Luc Dehaene, a Flemish Christian Democrat who went on to become prime minister in 1992.

According to Robben’s personal website, in 2019 he gave a presentation to a CD&V youth conference in Ronse, East Flanders, entitled, “People and information technology: seizing opportunities, avoiding risks.” *

In an interview with MLex in December last year, Philippe Lamberts, a member of the European Parliament for Belgium’s francophone green party, Ecolo, said Robben was “the mastermind at the DPA,” and that Stevens “just takes the opinions of Robben as the Bible”.

In an interview, Stevens strongly rejected that suggestion. “I got this job, I think, based on my expertise and my competence, not because I was the best friend of any political party, and definitely not of Frank Robben,” he told MLex.

He said he had never been a member of any political party, which he thinks played a part in his downfall. “I’m sure the decision wouldn’t have been taken if I’d been a close friend of one political party,” he said. “If you don’t have a political party backing you up […] no-one says ‘this is one of ours, don’t touch him’.”

Philosophical differences

Stevens said the animosity among the directors had nothing to do with retaliation on behalf of Robben. He said the five directors agreed to write to Parliament about Robben soon after taking office. But the chamber’s reply was that in the absence of new information, all members must be assumed to have been lawfully appointed.

Since there was nothing new about Robben’s myriad positions, Stevens said he, Hijmans and Van den Eynde "understood that letter from the parliament as ‘back off,’ and we did.” But Jaspar and Dereppe wanted to keep pressing.

Stevens argued that the working relationship among the directors soured because “differences in views on how you protect privacy” and “differences in views on how proactive we needed to be in the fight against Mr Robben” descended into personal animosity — but not bullying.

Hijmans expressed a similar view. “We had a difference of opinion on how to deal with data protection,” he said in an interview. While Jaspar and Dereppe advocated what Hijmans called “a more formalistic approach,” he and Stevens preferred “a more pragmatic approach.”

For example, Jaspar and Dereppe accused Stevens of compromising his independence by participating in the government’s Covid-19 taskforce, which Stevens said was necessary to ensure that proposals reviewed by the taskforce complied with the GDPR. Dereppe retorted that for the DPA to scrutinize the taskforce’s decisions independently, its president can’t be part of those decisions.

Hijmans said that his and Stevens’ “pragmatic approach” meant that “we should be open for discussion with other stakeholders, provided that we remain independent.”

Whether or not philosophical differences were the root of problem among the DPA directors, the assertion might reflect a broader contrast in Belgium at large.

Robben argued that the “general discussion about the balance between fundamental rights has a different flavor” in Flemish-speaking Flanders and French-speaking Wallonia. While academics and journalists in Flanders emphasize the need to share data for the sake of other rights, such as healthcare, francophone commentators tend to put privacy before other rights, he said. “That’s not a criticism, that’s an observation.”

Robben, who is Flemish, argued that this difference in approaches helps explain why he is controversial, and why he believes he gets a fairer hearing in the Flemish press than in the francophone press.

Punished for taking a stand?

Dereppe contests the assertion that the hostility was the result of personal or philosophical differences. She believes she was punished for trying to oust Robben. She said that after she and Jaspar took their stand, there was a concerted effort “to exhaust me and to make my life difficult” by interfering in her day-to-day work.

“Any project I would start, anything I would make better in my team, every single thing was challenged by the board, and especially by David Stevens and Hielke Hijmans.”

In addition to her denunciation of Stevens, Dereppe also accused Hijmans of “moral harassment,” a Belgian legal term for bullying, which he denied categorically in parliamentary testimony and in conversations with MLex.

She said that Van den Eynde, though privately sympathetic to her concerns, feared for his job and urged her to keep quiet about Robben, while siding with Stevens and Hijmans in formal votes. “He knew that Frank Robben is extremely powerful, and he knew that I’m not the kind to be quiet. So he was afraid, because he risked his job too.”

Van den Eynde declined to comment.

Waffle-iron politics

Jaspar resigned in protest in December 2021, but Dereppe stayed.

With the European Commission threatening legal action, Robben eventually resigned in February of this year, writing in a blog post that he “did not want Belgium be summoned to appear in the European Court of Justice on account of my position,” though he maintained that he did not believe he posed a threat to the regulator’s independence.**

His departure, along with the decision a month earlier of another DPA adviser, Bart Preneel, to give up a parallel role on the Information Security Committee, resolved matters with the EU. Two other DPA officials, Séverine Waterbley and Nicolas Waeyaert, had already stepped down over conflict-of-interest concerns a year earlier.

But the remaining four directors were still at odds. To end the standoff, Parliament decided to sack both Stevens and Dereppe, but allowed Hijmans and Van den Eynde to remain.

Stevens said he believed the assembly wanted to ensure it sacked both a Flemish speaker and a French speaker, but without singling out either one. He compared the decision to “waffle-iron politics” — a federal policy, abolished in the 1980s, of ensuring every franc spent in Wallonia was also spent in Flanders, and vice-versa. The policy led to bizarre outcomes, such as a bridge in Varsenare, West Flanders that stopped in mid-air.

Officially, Stevens was fired for compromising his independence by meeting officials who were drafting policies on telecoms and Covid-19, and for his use of a car bought with DPA funds. He was also censured for exceeding his investigatory powers by writing to a school in Ghent to ask questions about its plan to use children’s biometric data for cafeteria payments, which he’d read about in the newspaper.

Stevens denies any wrongdoing and maintains that all these actions were legitimate. He is challenging his dismissal at the Council of State, Belgium’s highest administrative court.

Among other things, Dereppe was formally sacked for her poor working relationship with other directors. Another reason given was her absence from board meetings, which she said was a consequence of the bullying and the fact she bore two children during the controversy.

She was also censured for recusing herself from a recruitment procedure involving someone she knew without explaining the nature of the relationship, and too late in the process. She says she exerted no pressure on that candidate’s behalf.

Additionally, Parliament criticized her for requesting a car after having complained that Stevens’ use of a DPA-funded car was illegal. She contends that she did not want a car, but had been advised by her lawyers to demand equal benefits to those enjoyed by Stevens, in order to pressure the board of directors to take a position on whether the car was purchased lawfully.

Dereppe also denies wrongdoing, and is challenging her dismissal at the Court of First Instance.

* MLex translation from the original Dutch
** MLex translation from the French, which was also published in Dutch