CBP BES revokes corrective administrative sanction on the Public Entity Bonaire after demonstrable improvements in privacy measures
On the 7th of October 2024, the Commission Supervision Personal Data Protection BES (CBP BES) imposed a corrective administrative sanction on the Executive Council of the Public Entity Bonaire (OLB). This involved a maximum amount of $105,000, divided between deficiencies in 'clean desk' and 'clear screen' practices. The corrective administrative sanction was issued due to structural and ongoing shortcomings in compliance with the Personal Data Protection Act BES (Wbp BES). For example, the physical protection of personal data was inadequate, clean desk behaviour was lacking, and there were risks related to unsupervised printing.
On the 5th of February 2025, in a decision regarding an objection, CBP BES concluded that the measure had been justified but granted OLB a tailored recovery period until the 5th of May 2025, conditionally reducing the corrective administrative sanction to USD 15,000.
Improvements and revocation of the corrective administrative sanction
Based on OLB’s progress report dated the 5th of May 2025, and follow-up inspections on the 14th and 15th of May 2025, CBP BES determined that OLB had implemented most of the required recovery measures. Workspaces were cleaned and secured, a ‘follow-me’ printing system was introduced, archive spaces were reorganized, and a structural improvement in privacy awareness was observed.
Under the General Administrative Law, a corrective administrative sanction may be revoked if the violation has ceased. Although the BES Administrative Jurisdiction Act does not contain a similar provision, CBP BES considers itself competent to apply this principle as well. Given the reasons mentioned above, CBP BES has decided to revoke the corrective administrative sanction. OLB is no longer required to pay the sanction. CBP BES acknowledges OLB’s efforts and observes clear progress in the physical protection of personal data.
Supervision, prevention, and ongoing efforts
CBP BES supervises compliance with privacy legislation in Bonaire, St. Eustatius, and Saba. To do so, it may employ various enforcement measures, including corrective administrative sanction and - enforcement. The aim is to encourage organizations to meet their legal obligations and to ensure the proper protection of personal data.
CBP BES will continue to carry out unannounced inspections to assess whether compliance with privacy regulations is sustainable. It also emphasizes the importance of an active and structural approach to data protection, in which not only technical and physical measures play a role, but also the awareness and exemplary behaviour of leadership is crucial.