BELGIUM

CHART INSTRUCTIONS:

 Local law does not deviate from the GDPR.

 Local law deviates from the GDPR.

name

Wet tot Oprichting van de Gegevensbeschermingsautoriteit

Status: Adopted

LAWFULNESS OF PROCESSING (ART 6)

No Deviation

CHILD'S CONSENT (ART 8)

No Deviation

SENSITIVE DATA (GENETIC, BIOMETRIC AND HEALTH DATA) (ART 9 (4))

No Deviation

CRIMINAL CONVICTIONS/SECURITY MEASURES (ART 10)

No Deviation

AUTOMATED INDIVIDUAL DECISION-MAKING (ART 22)

No Deviation

RESTRICTIONS TO DATA SUBJECT'S RIGHTS (ART 23)

No Deviation

JOINT CONTROLLER RESPONSIBILITIES (ART 26 (1))

No Deviation

AD HOC NOTIFICATIONS - RECORDS OF PROCESSING ACTIVITIES (ART 30)

No Deviation

SECURITY OF PROCESSING (ART 32)

No Deviation

DATA BREACH (ART 33 & 34)

No Deviation

DATA PROTECTION OFFICER (ART 37(4))

No Deviation

DATA TRANSFER DEROGATIONS (ART 49(5))

No Deviation

POWERS SUPERVISORY AUTHORITIES (ART 58)

ADDITIONAL/VARYING REQUIREMENT:

The DPA is granted investigative, corrective, and advisory powers, as provided in the GDPR, but the Belgian Act provides for specifications compared to the GDPR leading to more far-reaching powers of the DPA. Therefore, the DPA’s investigative powers amount to the following additional powers: (1) written and oral interrogations; (2) consulting IT systems and copying all data on these systems; (3) consulting information electronically; (4) seizing or sealing IT systems or goods; and (5) claiming the identification of a subscriber or usual user of an electronic communications service or of the used means of electronic communications (Art 66 Belgian Act) (Art 58(1) GDPR).

Against certain preliminary measures taken by the DPA, the defendant may file a (non-suspensive) appeal (Art 70–71 Belgian Act and Art 58(2) GDPR). The defendant may also file an appeal against acts of seizure and sealing, as described above (Art 90 Belgian Act and Art 58(1) GDPR). In the same way, the DPA’s corrective powers are also broadened so that they also explicitly include: (1) proposing settlements to the parties involved; (2) dismissing a complaint; (3) transferring the case to the public prosecutor to decide on criminal prosecution; (4) ordering to refrain from further prosecution; (5) ordering a suspension of judgment; and (6) publishing its decision on its own website.

In terms of procedure, the DPA shall be instituted by means of six independent organs (supplemented further by independent experts and a reflection council): an executive committee, general secretariat, frontline service, knowledge center, inspection body, and dispute resolution chamber. Procedurally, parties are granted the option, before the DPA’s dispute resolution chamber, to submit any evidence or defense elements and to request to be heard. Involved parties can file an appeal against the decision of the disputes resolution chamber with the Commercial Court of Appeal (Marktenhof, a court competent to treat appeals also against decisions taken by the Belgian Competition Authority, Financial Services and Markets Authority, Belgian Institute for Postal Services and Telecommunications, and other comparable administrative authorities).

CLASS ACTIONS (ART 80 (2))

SPECIFYING REQUIREMENT:

Organizations or associations may, independently of an individual’s mandate, file a complaint with the Belgian DPA (Explanatory Memorandum, p. 40 and Art 58 of the Belgian Act) (Art 80(2) GDPR).

ADMINISTRATIVE SANCTIONS (ART 83)

SPECIFYING/VARYING REQUIREMENT:

The Belgian Act provides for the procedural side of imposing administrative sanctions, such as the payment term, and the content requirements of the decision to impose an administrative sanction. The Act foresees an appeal option against the decision with the Belgian Commercial Court of Appeal (Art 102 Belgian Act) (Art 83 GDPR). The Act deviates from the GDPR in the maximum fine in the case of “multiple counts” (meerdaadse samenloop), in which case the maximum fine exists in “the highest administrative fine times two” (Art 103 Belgian Act) (Art 83 GDPR).

PENALTIES (ART 84)

No Deviation

HR PROCESSING (ART 88)

No Deviation

PROCESSING FOR ARCHIVING, SCIENTIFIC, HISTORICAL RESEARCH OR STATISTICAL PURPOSES (ART 89)

No Deviation

OBLIGATIONS OF SECRECY (ART 90)

No Deviation

REMARKS