Belgium Publishes Data Protection Laws Implementing GDPR

In Short

The Situation: On September 5, 2018, Belgium published two laws that implement the Belgian requirements under Regulation 21016/679, the General Data Protection Regulation ("GDPR").

The Details: The two laws include the Law of July 30, 2018, on the protection of individuals regarding the processing of their personal data; and the Law of July 30, 2018, which contains provisions on collective redress actions for GDPR infringement ("Laws").

Looking Ahead: The Laws go into effect immediately, and the provision on collective redress action applies retroactively as of May 25, 2018.

The GDPR entered into force on May 25, 2018. It became applicable immediately but leaves certain leeway to EU Member States to adopt diverging rules in a variety of matters. The law of December 3, 2017, instituted institutional reforms through the replacement of the Belgian Privacy Commission by the Data Protection Authority ("DPA"), which now has fining powers. The newly implemented Laws address various substantive areas of data privacy.

Key Points of the Laws

The Laws anticipate the following developments:

• Overseeing the activities of: (i) a controller or processor established in Belgium; or (ii) outside the European Union but processing data relating to individuals located in Belgium, provided it also offers goods or services or does profiling in Belgium;
• Reducing the GDPR's age of consent to 13 years old for information society services;
• Not extending the obligation to appoint data protection officers beyond the cases foreseen by the GDPR, with the notable exceptions of companies that process personal data either: (i) obtained from or on behalf of federal public authorities; or (ii) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes. In both cases, the processing must bear high risks to the rights and freedom of individuals;
• Introducing additional requirements for processing genetic, biometric, and health-related data, including the requirement to list individuals that have access to such data;
• Listing the limited cases where the GDPR prohibition on the processing of personal data relating to criminal convictions and offenses does not apply;
• Limiting data subjects' rights and controllers' obligations for processing by certain public authorities, such as law enforcement and custom authorities. It also exempts public authorities from fines imposed by the DPA;
• Regulating the processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
• Applying a wide derogatory regime when the processing is done for the purposes of academic, artistic, and literary expression;
• Removing the obligation to notify standard contractual clauses to the DPA and to obtain authorization by Royal Decree for Binding Corporate Rules;
• Introducing the possibility to obtain an injunction under summary proceeding before national courts for infringement of the GDPR and the Laws; and
• Introducing collective redress action for GDPR infringements, which is also open to damages suffered by small and medium-size undertakings.

Two Key Takeaways

• Belgium has finalized its implementation of the GDPR and made use of the ability to set out specific rules that deviate from the GDPR on certain matters.
• Companies established in Belgium or outside the European Union but processing data of Belgian residents should make sure that they comply with the specific provisions foreseen in the Laws, when applicable.

Lawyer Contacts

For further information, please contact your principal Firm representative or the lawyers listed below. General email messages may be sent using our "Contact Us" form, which can be found at www.jonesday.com/contactus/. 

Laurent De Muyter
Brussels
+32.2.645.15.13
ldemuyter@jonesday.com

Jörg Hladjk
Brussels
+32.2.645.15.30
jhladjk@jonesday.com

Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our "Contact Us" form, which can be found on our website at www.jonesday.com. The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.