The European Commission is pursuing legal action against Belgium over concerns its Data Protection Authority is not operating independently as required under the EU General Data Protection Regulation. The commission said some members of the DPA “cannot be regarded as free from external influence” as they either report to a management committee, have participated in COVID-19 contact tracing or are members of the Information Security Committee. Belgium has two months to take action, or the case may be referred to the Court of Justice of the European Union.