Privacy & Information Security Law Blog

On January 10, 2018, the Law of 3 December 2017 creating the Data Protection Authority (the “Law”) was published in the Belgian Official Gazette. The Law was submitted in the Chamber of Representatives on August 23, 2017, and was approved by the Parliament in plenary meeting on November 16, 2017.

The EU General Data Protection Regulation (“GDPR”) provides national data protection authorities with a strengthened enforcement role. In this context, the Belgian legislator adopted the Law reforming the Belgian Privacy Commission, established by the Law of 8 December 1992 implementing Directive 95/46/EC. It replaces the Belgian Privacy Commission with the Belgian Data Protection Authority (“DPA”) (Autorité de protection des données in French and Gegevensbeschermingsautoriteit in Dutch).

The main purpose of the Law is to ensure that the DPA can fulfill its tasks under the GDPR, since the current Belgian Privacy Commission has limited prosecutorial powers and no direct sanctioning powers.

Different Composition

In particular, the Law changes the structure and composition of the current Belgian Privacy Commission and replaces the existing sector committees with six new ones:

• An Executive Committee that, amongst others, approves the DPA’s annual budget and strategy and management plan, and follows the technical developments that have an impact on data protection.
• A General Secretariat responsible for the daily operations of the DPA, including  (1) following the social, economic and technological developments that have an impact on data protection; (2) establishing the list of processing activities that require a data protection impact assessment; (3) providing an opinion on prior consultation by a data controller; (4) approving codes of conduct and certification criteria; and (5) approving standard contractual clauses and binding corporate rules.
• A First Line Service responsible for receiving complaints and requests made to the DPA; starting mediation procedures; raising awareness around data protection and, in particular amongst minors, providing individuals with information regarding their data protection rights; and raising awareness of data controllers and processors regarding their obligations under the GDPR.
• A Knowledge Centre responsible for providing advice, upon request or on its own initiative, on questions related to data processing and recommendations regarding social, economic or technological developments.
• An Investigation Service responsible for the investigations.
• A Litigation Chamber that deals with administrative proceedings.
• A Reflection Board responsible for providing non-binding advice, upon request of the Executive Committee or the Knowledge Centre or on its own initiative, on all data protection-related subjects.

National and International Cooperation

The Law also provides that the DPA will have to cooperate with national and international actors. More specifically, the DPA will have to cooperate with all other Belgian public and private actors involved in the protection of the rights and freedoms of individuals, particularly regarding the free flow of personal data and customer protection. The DPA will also have to cooperate with other national data protection authorities. Such cooperation will focus on, inter alia, the creation of centers of expertise, the exchange of information, mutual assistance for controlling measures, and the sharing of human and financial resources.

Enforcement and Investigation Powers

The DPA will have investigation and control powers, as well as various enforcement powers, including the power to (1) drop a case without action; (2) dismiss a case; (3) order that the sentence be suspended; (4) propose a transaction; (5) issue a warning; (6) order compliance with individuals’ requests; (7) inform individuals of a security incident; (8) order that the processing be frozen, limited or temporarily or permanently prohibited; (9) order the rectification or deletion of personal data and the notification thereof to individuals; (10) order the license of a certification organism be withdrawn; (11) suspend data transfers; (12) impose daily fines and administrative fines; (13) transmit a file to the Public Prosecutor; and (14) publish the decisions taken on its website.

The investigation powers of the DPA will also broaden and will include the power to (1) hear witnesses; (2) identify individuals; (3) conduct a written inquiry; (4) conduct on-site reviews; (5) access computer systems and copy all data such systems may contain; (6) access information electronically; (7) seize or seal goods or computer systems; and (8) request the identification of the subscriber or regular user of an electronic communication service or electronic communication means used. In addition, the Investigation Service will be able to take interim measures, including suspending, limiting or freezing data processing activities.

The Law also sets out the procedure to be followed in case of a claim or any other request from a natural or legal person with respect to personal data protection.