Source: https://www.dlapiperdataprotection.com/index.html?t=law&c=BE
Timestamp: 2019-04-24 16:31:07+00:00

Document:
The Belgian Data Protection Authority, the successor of the Belgian Privacy Commission, was established by the Belgian Federal Chamber of Representatives by the Law of December 3, 2017 ('DPA Act')2. Adaptions to sectoral laws relying on the previous Data Protection Act will likely follow.
The Data Protection Act builds on the definitions contained in the GDPR and further clarifies some notions, such as the notion of 'government'1. It further adds the definitions of a ‘trusted third party’, ‘disclosure of personal data’ and ‘distribution of personal data’ in the context of the research and statistical purposes exception. The Act also clarifies certain concepts such as 'processing in the substantial public interest'2, the 'processing for journalistic purposes'3 and introduces new concepts such as 'a joint database'4.
1. Art. 5 Data Protection Act.
2. Article 8 para. 1 Data Protection Act.
3. Art. 24 para. 1 Data Protection Act.
4. Article 48 Data Protection Act.
The Data Protection Act appoints three more regulatory authorities (COC1, Committee I2 and Committee P3) with varying data protection related competences next to the general Data Protection Authority.
1. Art. 231 Data Protection Act.
2. Art. 72 para. 2 °7 Data Protection Act.
3. Art. 26 °7, c) Data Protection Act.
1. Art. 20 Data Protection Act.
1. Art. 21 Data Protection Act.
2. Art. 190 Data Protection Act.
3. The Center for Missing and Sexually Exploited Children (Child Focus) Art. 8 para. 3 Data Protection Act; Governments for prevention, examination, detection and prosecution of criminal facts or the execution of penalties including the protection against and prevention of hazards for public safety implementing Directive 2016/680 Art. 63 e.v. Data Protection Act; Information and security services bodies Art. 91 Data Protection Act; Bodies for security authorisations Art. 124 Data Protection Act; The coordination department on threat analysis Art. 157 Data Protection Act.
The controller is responsible for and must be able to demonstrate compliance with the above principles (the "accountability principle"). Accountability is a core theme of the GDPR. Organizations must not only comply with the GDPR but also be able to demonstrate compliance perhaps years after a particular decision relating to processing personal data was taken. Record keeping, audit and appropriate governance will all form a key role in achieving accountability.
1. Art. 7 Data Protection Act.
2. Art. 9 Data Protection Act.
3. Art. 10 Data Protection Act.
4. Art. 11, Art. 13 and Art. 14 Data Protection Act.
5. Art. 12 Data Protection Act.
6. Art. 36 e.v., Art. 79, Art. 105 (9), Art. 113, Art. 145, Art. 173 Data Protection Act.
7. Art.16 Data Protection Act.
1. Art. 66-70, Art. 93-94, Art. 126-127, Art. 159-160 Data Protection Act.
1. Art. 198 e.v. Data Protection Act.
2. Information Security Services Art. 88-89 Data Protection Act, Bodies for security authorisations Art. 121-122 Data Protection Act, Coordination department on threat analysis Art. 154-155 Data Protection Act, Passenger Information Art.179-180 Data Protection Act.
No general additional requirements are inserted in the Data Protection Act relating to security measures. Data breach obligations are also detailed for each special regime, but they resemble those contained in the GDPR.
The Act does not include other derogations relating to employment.
1. Art. 211 par.3 Data Protection Act.
2. Art. 220 par. 2Data Protection Act.
3. Art. 209 Data Protection Act.
5. Art. 221 par. 2 Data Protection Act.
6. Art. 221 par. 1 Data Protection Act.
7. Art. 222 e.v. Data Protection Act.
8. Art. 66 DPA Act.
10. Art. 76 DPA Act.
12. Art. 24 Data Protection Act.
13. Art. 193 Data Protection Act.
14. Art. 194 Data Protection Act.
15. Art. 187 Data Protection Act.
The Act applies to most electronic marketing activities, as there is likely to be processing and use of personal data involved (e.g. an email address is likely to be ‘personal data’ for the purposes of the Act). The Act does not prohibit the use of personal data for the purposes of electronic marketing but provides individuals with the right to object to the processing of their personal data (i.e. a right to ‘opt out’) for direct marketing purposes.
These rules apply to all ‘electronic messages’, such as emails and text messages (Short Message Systems or SMS). Other types of electronic communication such as instant messaging and chat may also fall within the scope of these rules depending on the specific context. This covers not only clear promotional messages, but also newsletters and similar communications. Indeed, any form of communication intended to directly or indirectly promote goods, services, the image of a company, organisation or person which/who exercises a commercial, industrial or workmanship activity or regulated profession falls within the scope of these rules.
As a general principle, the prior, free, specific and informed consent of the recipient of the message must be obtained (‘opt-in principle’).
the electronic message is sent to legal persons (e.g. to a general email address such as info@company.com).
These exceptions are subject to compliance with strict conditions.
Furthermore, all electronic messages must contain a clear reference to the recipient's right to opt out, including means to exercise this right electronically.
Neither the Data protection Act or the Data Protection Authority Act include provisions on electronic marketing or online privacy.
Article 5 (3) of the E-Privacy Directive has been implemented into Belgian Law by means of an amendment to article 129 of the Belgian Electronic Communication Act.
Article 123 of the Belgian Electronic Communication Act stipulates that mobile network operators may process location data of a subscriber or an end user only to the extent that the location data has been anonymised, or if the processing is carried out in the framework of the provision of a service regarding traffic or location data.
The processing of location data in the framework of a service regarding traffic or location data is subject to strict conditions set forth in article 123.
The processing of location data must in addition also comply with the general rules stipulated by the Data Protection Act.
In accordance with article 122 of the Belgian Electronic Communication Act, mobile network operators are required to delete or anonymise traffic data of their users and subscribers as soon as such data is no longer necessary for the transmission of the communication (subject to compliance with cooperation obligations with certain authorities).

References: Art. 5
 Art. 24
 Art. 231
 Art. 72
 Art. 26
 Art. 20
 Art. 21
 Art. 190
 Art. 8
 Art. 63
 Art. 91
 Art. 124
 Art. 157
 Art. 7
 Art. 9
 Art. 10
 Art. 11
 Art. 13
 Art. 14
 Art. 12
 Art. 36
 Art. 79
 Art. 105
 Art. 113
 Art. 145
 Art. 173
 Art.16
 Art. 66
 Art. 93
 Art. 126
 Art. 159
 Art. 198
 Art. 88
 Art. 121
 Art. 154
 Art.179
 Art. 211
 Art. 220
 Art. 209
 Art. 221
 Art. 221
 Art. 222
 Art. 66
 Art. 76
 Art. 24
 Art. 193
 Art. 194
 Art. 187