Data Protection in Belgium

Data protection laws in Belgium

The GDPR has been integrated in Belgium through a few laws. The 'Data Protection Act' of July 30, 2018 provides for the implementation of some of the GDPR provisions open to further definition, derogation or additional requirements. It also includes the transposition of the 2016/680 Directive regarding the processing of personal data in the criminal justice chain and the establishment of a Control body on police information (called 'COC'). Additionally, it regulates the authorities outside the scope of the EU law (including intelligence and security services).The Data Protection Act was amended several times in 2024 to update the rules for the authorities outside the scope of the EU law.2

The Belgian Data Protection Authority, the successor of the Belgian Privacy Commission, was established by the Belgian Federal Chamber of Representatives by the Act of December 3, 2017 ("DPA Act")3. Several other laws have also been adapted to align them with the GDPR (e.g. Video Surveillance Act).

The DPA Act was amended by the Act of 7 September 20234 and the Act of 25 December 20235, in order to strengthen the functioning, the independence, the pragmatic approach and sectoral expertise of the Belgian Data Protection Authority. The legislative reforms included changes with regard to the composition of the Data Protection Authority and the rules of procedure for cases before the Data Protection Authority. As a result, several provisions were transferred from the DPA Act to the Internal Rules of Procedure of the Data Protection Authority.6

The Belgian Constitutional Court ruled that the provisions regarding the language of the proceedings are unconstitutional.7 Article 57 of the DPA Act allows the Belgian Data Protection Authority to decide on the language of the proceedings. However, Aarticle 30 of the Belgian Constitution gives this right to the Belgian Parliament for acts of public authority and judicial matters. Therefore, a change in article 57 of the DPA Act is expected.

Footnotes

1. See Data Protection Act.
2. See Act of 29 March 2024, Act of 29 March 2024, Act of 15 May 2024, Act of 16 May 2024 and Act of 2 June 2024.
3. See DPA Act.
4. Act of 7 September 2023.
5. Act of 25 December 2023.
6.  Internal Rules of Procedure of the Data Protection Authority.
7. Belgian Constitutional Court 28 November 2024, nr. 144/2024.

Continue reading

  • no results

Back to top