Processing of personal data

Notice concerning the provision of information concerning one or more processing operations of personal data carried out by or on behalf of the BRPS

The present notice hereby informs you, in full transparency and in compliance with the General Data Protection Regulation (GDPR), of the processing of personal data carried out in the context of the following processing operation:

The conducting of two user satisfaction surveys on the mobility offer of the Brussels-Capital Region in the broadest sense with a three-year interval, using an identical methodology. These two surveys make it possible to establish the Mobility Barometer in the Brussels-Capital Region and compare the results of the two surveys/waves. The data will be collected online via a self-administered questionnaire. These two surveys will be used as decision-making tools and to better orient the mobility policy. Personal data is collected for the sole purpose of obtaining a realistic picture of users' perceptions by avoiding double responses. The personal data collected will not be shared, reused or resold. It will be destroyed once the survey is completed.

Last updated: 22/9/2021

  1. Controller and Data Protection Officer

The data controller is registered with the Crossroads Bank for Enterprises under number 0316.381.039. Their identity and contact details are:

Brussels Regional Public Service

Place Saint Lazare 2 - 1035 Brussels

servicepublic.brussels

info@sprb.brussels

+32 (0)2 204 21 11

They have appointed a Data Protection Officer (DPO), who can be contacted by data subjects regarding all matters relating to the processing of their data and the exercise of their rights under the GDPR:

Data Protection Officer at the BRPS

Place Saint Lazare 2 - 1035 Brussels

dpo@sprb.brussels

  1. Purposes and legal grounds of the processing

The processing of personal data serves the following purposes:

  • The aims are decision-making support and the orientation of the mobility policy in the framework of the Good Move Regional Mobility Plan.
  • The nature of the operations performed on the data is: the personal data (email address and, where applicable, last name, first name and phone number) is encrypted using a 1024-bit RSA key. Only the AQ Rate DPO is able to decrypt this information. If the respondent has already entered this email address (and, where applicable, last name, first name and phone number), access to the questionnaire will be denied to avoid double responses. Responses to survey questions will be pseudonymised. The answers to the questionnaire will not be linked to the email addresses in the database to be used for the analyses. The personal data will not be shared, reused or resold. It will be destroyed once the survey is completed.
  • The personal data processed is: email address (will be separated from the other data), last name (only for persons assisted by an interviewer; will be separated from other data), first name (only for persons assisted by an interviewer; will be separated from other data), telephone number (only for persons assisted by an interviewer; will be separated from other data), language (French, Dutch, English), gender, age, post code, nearest public transport stop to home, family situation, highest level of education, professional situation, difficulties in getting around.
  • The categories of data subjects are:

Users of Brussels-Capital Region mobility (inhabitants + commuters/visitors). These users (respondents) will come from three different channels:

    • "natural" visitors to the Brussels Mobility portal who will read the newsletter about the survey and can then enter their email address to receive the link to the online survey
    • social network users: targeted advertisements will link to the Brussels Mobility portal and then to the email address encoding interface to obtain the link to the survey
    • people who have obtained the link to the Brussels Mobility portal via paper posters displayed in certain Brussels municipal buildings

The processing is lawful to the extent that the following condition is met:

  • The data subject has consented to the processing of their personal data for one or more specific purposes.
  1. Provision of data

The provision of personal data collected for this processing is not of a regulatory or contractual nature, and does not condition the conclusion of a contract.

It is optional, as failure to provide the data has the following consequences:

  • Some respondents may complete the survey more than once and bias the results to an ideology or lobby group.
  • The representativeness of the respondents in relation to the socio-demographic characteristics of Brussels transport system users can no longer be verified.
  1. Categories and source of personal data

The personal data concerned by the processing operation fall into the following categories:

  • Common categories of personal data that require a basic level of protection. (email address, gender, age, post code, etc.).

They come from (a source that is not publicly available).

  1. Automated individual decision making

This processing of personal data does not produce, with respect to the data subject, any decision based exclusively on automatic processing, including profiling, producing legal effects concerning the data subject or which significantly affects them in a similar way. The right conferred on the data subject by Article 22 of the GDPR therefore does not apply to this processing operation.

The underlying logic of this automated individual decision making, as well as the significance and the expected consequences of this processing operation for the data subject, are set out below:

Access to the questionnaire is conditional on the provision of a valid email address to which an email containing the unique link to the questionnaire will be sent.

A candidate participating in the mobility barometer can decide whether or not to provide their email address, but access to the questionnaire will also be denied if they choose not to do so.

If a candidate participating in the mobility barometer agrees to provide their email address, they will be able to access the questionnaire via the unique link that will have been sent to them by email at the address provided.

This unique link will allow them to complete the questionnaire in one or more steps; if they interrupt their participation while completing the questionnaire, they can continue by clicking again on the unique link assigned to them and pick up the questionnaire where they left off.

Once the questionnaire has been completed and validated by clicking on the last screen, the answers associated with the unique link will be saved and access to the questionnaire via this unique link will be deactivated so that the saved answers can no longer be modified.

  1. Recipients of personal data and transfers

The following recipients receive communication of some or all of the personal data, depending on their role in the processing of the data:

Represented by Didier van Kesteren, Data Protection Officer

255 Chaussée de Waterloo

1060 Bruxelles

Belgique

Email:   dpo@internetpanel.be.

Tel.:     +32 (0)2/644.56.26.

Personal data are not transferred to a third country or to an international organisation.

  1. Retention period of the personal data

Personal data is kept for a period of 12 months, starting from the end of its collection.

The criteria used to determine the retention period of personal data are:

  • Ensure that no respondents answer the survey more than once by collecting email addresses.
  • Check the representativeness of the respondents in relation to the socio-demographic characteristics of Brussels transport system users.
  1. Rights of the data subject

Withdrawal of consent

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal (Article 7(3) of the GDPR).

The consent may be withdrawn via the mes-droits-rgpd.servicepublic.brussels form.

Rights referred to in Chapter III of the GDPR

The data subject of this processing of personal data may exercise the following rights:

  • The right to request access, rectification or erasure of their personal data (Articles 15, 16 and 17 of the GDPR).
  • The right to request a restriction of the processing (Article 18 of the GDPR).
  • The right to data portability (Article 20 of the GDPR).
  • The right to object to the processing (Article 21 of the GDPR).
  • The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her (Article 22 of the GDPR).

To do this, they can:

Submit a request via the mes-droits-rgpd.servicepublic.brussels form.

  • Send a written request, dated, signed and accompanied by a copy of a valid identity document (identity card or passport).

Brussels Regional Public Service

DPO

Place Saint Lazare 2  - 1035 Brussels

Right to lodge a complaint with a supervisory authority

Every data subject shall have the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data relating to him or her infringes the GDPR (Article 77 GDPR).

In Belgium, the competent supervisory authority is generally:

Data Protection Authority

Rue de la presse 35 - 1000 Brussels

www.autoriteprotectiondonnees.be

  1. Further processing of personal data

The controller does not intend to further process personal data for a purpose other than that for which the data are collected.