Louveaux, Sophie

English

Repository of the University of Namur

RESEARCH OUTPUTS / RÉSULTATS DE RECHERCHEAuthor(s) - Auteur(s) :Publication date - Date de publication :Permanent link - Permalien :Rights / License - Licence de droit d’auteur :Bibliothèque Universitaire Moretus PlantinInstitutional Repository - Research PortalDépôt Institutionnel - Portail de la Rechercheresearchportal.unamur.beUniversity of NamurNew belgian data protection law follows the EU Directive closelyLouveaux, SophiePublished in:Privacy Law and BusinessPublication date:1999Document VersionPublisher's PDF, also known as Version of recordLink to publicationCitation for pulished version (HARVARD):Louveaux, S 1999, 'New belgian data protection law follows the EU Directive closely', Privacy Law andBusiness, no. 47, pp. 9-11.General rightsCopyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright ownersand it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.            • Users may download and print one copy of any publication from the public portal for the purpose of private study or research.            • You may not further distribute the material or use it for any profit-making activity or commercial gain            • You may freely distribute the URL identifying the publication in the public portal ?Take down policyIf you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediatelyand investigate your claim.Download date: 12. Dec. 2021.1'Dataollow th eISO fortUnate to find arc commitment to a,~, and an acceptanceommitment carriesr1S."me is still in its early'ogress according toiries and in the light ofal and internationalgis\ation.New BelgianProtection LawEU Directive close.1'1Ised on Geofrey L.ation at the PL&BLondon on 19thmore information,Laws & Business,)1814231300.purpose limitation, quality of the dataand legitimacy of the processing'. Asfar as the principle of fair processingis concerned, article 4 of the new lawstates that personal data must beprocessed fairly and lawfully. Thisprinciple, though underlying the1992 law, was not previouslydescribed as such'.The purpose limitation princip le,according to which personal datamust be processed only for specified,xplicit and legitimate purposes, washe leading principle in the 1992Iaw'.owever, whereas in the 1992 law theompatibility of the use of the data is0 be determined according to thepurpose of the processing, in the newlaw the compatibility must be judgedrccording to the purpose for whichhe data was initially collected. Thischange will have few consequencesas such. Under the old law theurpose of the processing was, ineality, determined at the time ofollection of the data since the dataubject was to be informed at thistime of the purpose for which theata was to be processed. Furtherrocessing must not be incompatibleith the purpose for which the dataas initially collected7.The interpretation of the conceptf "compatibility' cou Id create someifficulties. The directive itself doesot provide for any guidance ont is subject. According to thee planatory memorandum of thenew Belgian law, new processing oft e data doe~ not necessarily imply a~GEven though the European DataProtection Directive (95/46/EC) is,to a certain extent, precise, itcontains a number of undefined andvague terms and leaves the memberstates with a certain "margin formanoeuvre" in their achievement ofthe harmonisation of the national dataprotection laws'.Article 4.1.a provides that when acontroller is established on the terri-tory of several member states, hemust take the necessary measures toensure that each of the establishmentscomplies with the obligations laiddown by the national applicable law.Furthermore, the directive's recitàls (§22) provide that the member statesshall more precisely define in the lawsthe y enact, or when bringing intoforce the measures taken under thedirective, the general circumstances inwhich the processing is lawful. lnparticular articl~ 5, taken in conjunc-tion with articles 7 and 8, allowsmember states to provide for speciàlprocessing conditions for specificsectors and for various categories ofdata covered by article 8.Although Belgium can boast thatit has nearly respected the deadlinefor implementation of the directive, ithas made little use of this room formanoeuvre given by the directive, buthas reproduced nearly word for wordthe terms of the directive itself'. 1 willbriefly examine the main componentsof this new law, highlighting theprincipal changes to the previouslegislative system.notraAMENDMENT TO ruE PERSONALDATA DEFINmONThe new Belgian law reproduces thedefinitions of the EU Data ProtectionDirective. As a general observationone can point out that the definitionsconvey reJatively abstract andgeneraJ concepts'. The Jaw thusaims at being able to adapt itself tothe evolution of new technologies.An interesting innovation inthe new Belgian law is theintroduction of the concept"identifiable persan" in the definitionof personal data. According to thedirective's recitals and theexplanatory memorandum of thenew Belgian law, an individual isidentifiable when he can beidentified either directly orindirectly by any reasonable means.Therefore, is data that has beenencrypted, and for which thecontroller himself does not possessthe means of decoding the data,still considered as personal data if athird party retains these means?Anonymous data will only beexcluded from the scope of the law ifthe anonymous character of the datais absolute, and if there are noreasonable means in uSe to breakdown the anonymity.FEW CHANGES TO ruEPRINCIP LESThe new Belgian law does notintroduce any fundamental changeswith regard to the general dataprotection princip les of fairness,:>DmentPRIVACY LAWS & BUSINESS INTERNATIONAL NEWSLETTER FEBRUARY 1999 9rew surprIses as It reproduces nearly word for wordthe terms of the EU Data Protection Dir~ctive itself.Sophie Louveaux examines what has been changed.5 of the new law ml.lst, therefore, beapplied simultaneously.further collection of personal datafrom the data s\lbject.The idea, therefore, is not torequire that the controller systemati-cally collects data from the datasubject each cime the data is processedfor a new purpose. ln this case,however, the data subject will need tobe informed of the processingaccording to article 9 of the newBelgian law. The 1992 law alreadyprovided for this situation. However,the new law requires that theevaluation of the compatibility of thenew purpose withthe initial purposefor which the data was collected mustbe judged on a case by case basis,taking inca account any relevantelements, in particular the reasonableexpectations of the interested persan.The data quality requirementsprovided for in article 4 of thenew law, according to which thedata must be adequate, relevant andnot excessive in relation to thepurposes for which it is collected,were already present in the previousBelgian legislation.ONTROLLERS' OUTrES AND0 LlGAnONS CHANGET e new law imposes a number ofd ties and obligations on thec ntroller, notably a dut y to providein ormation, to notify, and the dut y0 confidentiality and security of thep ocessing. These duties were alreadypr'esent in the 1992 law.With regard to the obligation tonotify the national supervisory author-i ,the Commission de Protection dela Vie Privée, prior to any processing0 the data, there are no majorcanges to the present system apartfr m the terms used, and the simplifi-ca ion of, and exemptions to this0 ligation. Regrettably the Belgiangovernment has not made use of thepossibility of exemption from notifi-cation when the controller appointsan internaI data protection officiai'..As for the processing of data that maylead to specific risks to the rights andfrtedoms of data subjects, the Kingm~t determine the conditions in whichsuch data may be processed. Theapf Ointment of a data protection offi-ci 1 could be one of these conditions.The new law transposes articles 16an 17 of the directive on theobligation of confidentiality and ofsecurity. These articles bring a certainnumber of changes to the presentregime. Notably one notices thesuppression of the obligation to writeup an 'état' for each processing of theda~a", Furth'ermore, the new lawtie~ in the relationship between theda a controller and the processor,re uiring the obligation that theyw ite a contract laying down these urity measures to be respected andth liability of the processor towardsth controller, It is further stated thatth processor may act only on thein tructions of the controller,~!~li..:~"1,/ .~""DIRECTIVE'S CATEGORIES FORLEGlnMATE PROCESSINGWhilst the 1992 law opted for theprinciple of admissibility undercertain conditions of the processingof personal data save for sensitivedata, the new Belgian law prohibits,iD' accordance with the directive, theprocessing of personal data except ina limited number of situations. ln thissense, article 5 of the new law repro-duces nearly word for word anicle 7of the directive, stating the limitedsituations in which the processing ofpersonal data is a priori permitted'.This new provision implies thatthe controller will need to checkunder which criteria, as laid down bythe law, the processing falls. Theprocessing of personal data that do esnot fall within these criteriacannot take place. It is important tonote that, according to the Belgianlaw, the fact that the processing fallswithin one of the criteria mentionedin anicle 5 does Dot necessarily implythat the processing is legitimate in thesense of article 4§1,2°. Articles 4 andNEW RIGHTS FOR DATA SUBJECTSThe data subject, as in the previoussy tem, is granted a right of accessan of rectification. Two new rightsar also granted to the data subject inac ordance with articles 14 and 15 ofth directive: the right ta abject, andth right not ta be subject to anau amated individu al decision.MUCH EMPHASIS ON CONSENTFOR SENSrnVE DATAAs faT as special categories ofpersonal data are concerned, the lawmakes a distinction between sensitivedata in the strict sense (i.e. data whichreveals racial or ethnic origin, politicalopinions, religions or philosophicalbeliefs, trade-union membership anddata conceming sexlife), health dataand judicial data'.With regard to the first categoryof sensitive data, the new law, just asthe 19921aw, prohibits the processingof this data apart from in a number oflimited situations. ln the previousregime, this prohibition could belifted only by a specific law enactedfor that purpose. By contras t, the newlaw itself expressly states thesituations in which the prohibitioncan be lifted. One of these exceptionsis when the data subject gives hiswl:itten consent to the processingof the data. Belgium did not make useof the opportUnity to provide that thedata subject's consent could not liftthe prohibition to process su ch data.Yet one can think of a number of sitU-ations in which the data subject'sconsent does not carry the person'sfree acceptance, for example, in anemployer/employee relationship.As for medical data, the 1992 lawconditioned the processing of suchpersonal data to monitoring' by ahealth practitioner unless the datasubject's written consent had beenobtained. The new law maintains thisprohibition, but enlarges the scope ofthe data by referring to "data relatingto health» rather than medical data,and extends the persons who mayprocess such data to aIl healthcareprofessionals (i.e. health careproviders). According tG the newregime, the collection of such datamus t, in princip le, be obtained fromthe data subject himself.Also with judicial data, theprincip le is once more to impose theprohibition of the processing of suchdata except for in a limited number ofcases which the King can de termine.10 FEBRUARY-1999 PRlVACY lAWS & BUSINESS INTERNATIONAL NEWSLETTERil,DunES ANDNGEposes a number ofligations on they a duty to provideotify, and the dut yand security of theduties were already2law.the obligation tosupervisory author-n de Protection der to any processingre are no majoresent system apartr d, and the simplifi-emptions to thisttab_e Belgianot -use of theprion from notifi-ontroller appointsrotection officiai".ng of data that mayr s to the rights andsubjects, the Kingconditions in whiche processed. Theara proteètion offi-f thfàSe conditions.nsposes irticles 16directive on theiderttiality and ofcles bring a certaines to the presentone notices theobligation to writeprocessing of there, the new lawship between thed erocessor,igation that theylaying down the0 be respected andprocessor towardsi further stated thatact only on theontroller.TRANSFERS OF DATA TOmIRD COUNTRIESThe law prohibits the transfer of datato third countries, unless thesecountries provide for an adequatelevel of protection. ln this sense, thelaw has reproduced the regime laidclown by the directive. Similarly, ithas provided for the same derogarion:data subject's unambiguous consent.The law further stipulates chat theKing, after having consulted thenational data protection authority,can determine which categories ofprocessing, and under which condi-tions the transmission of personaldata to third countries is not permit-ted (this can be interpreted as apossibility for the King to establish ablack list of third countries). TheKing has also been given the power toauthorise, after having consuI.ted thenational data protection authority, atransfer or a category of transfers tocountries which do not ensure anadequate level of protection. This ispossible when the controller offersadequate safeguards with respectto the protection of the privacyand fundamental rights and freedomsof individuals.~Aregard ta Automatic Processingof Personal Data.'See article >" of the 1992law., Article 4§1, 20 of the new law..The EU Data Protection Directiveleft no choice for the member statesconcerning the possibility of includingfurther criteria for making the pro-cessing legitimate, nor for excludingcertain criteria listed in article 7 ofthe directive. The directive did,howevet; enable the member states tobe stricter in their formulation of theprovided criteria. Belgium has not,howevet; made use of this possibility., See articles 6, 7 and 8 of thenew law.ID See article 18 of the directiveon this possibility.Il According to article 16 of the previ-ous law, the controller was under theobligation to write an 'état' whichstated the nature of the personal datawhich was being processed by him,the puryose of the processing, the pos-sible links and interconnectionsbetween the data and any consulta-tions of the data and the persons orcategories of persons to whom thedata was transmitted. This 'état'was conceived as an internai elementof control for the controller himself,and as an element of externalcontrol because the national dataprotection authority (Commission deprotection de la Vie Privée) couldrequest it at any time.The right to object grants datasubjects the right to oppose theprocessing of their data on seriousand legitimate grounds relating totheir particular situation. It isregrettable that neither the directivenor the Belgian law determines whatis to be understood by serious andlegitimate grounds. The right ofopposition is not a priori granted tothe data subject in two cases.Firstly, when the processing is neces-sacy for the performance of a conr.ractto which the data subject is a party, orin order to take steps at the request ofthe data subject prior to the enteringinto a contract, and secondly, if theprocessing is necessary for compli-ance with a legal obligation to whichthe controller is subject. As in thedirective, the right to object is grantedunconditionally in the case of person-al data collected for the purposes ofdirect marketing.The introduction of the right notto be subject to an automated individ-ual decision is an innovation in theBelgian data protection regime. Onceagain, the law reproduces the terms ofthe directive. The law states that adecision which produces legal effects,or which significantly affects the datasubject, may not be taken on the solebasis of an automated processing ofthe data intended to evaluate certainaspects of bis personality. Examplesare bis performance at work, credit-worthiness, reliability and conduct.This article aims at avoidingsituations where decisions would beta ken based sol~ly on an automateddecision without any human inter-vention. According to the explanatocymemorandum of the new law, theremust be some sort of human inter-vention between the result of anautomated processing of the data andthe actual decision making. The pro-hibition of such decisions is liftedeither if the decision is taken in thecourse of a contract or is authorisedby law. ln both cases the contract orthe law must pro vide for suitablemeasures to safeguard the legitimateinterests of the data subject or which,at least, allow them to put forwardtheir point of view.'frc.\iDATA SUBJECTS5 in the previousa right of acc~ss.Two new rightsthe data subject intic les 14 and 15 ofght to abject, andbe subject to anal decision.This report was written by SophieLouveaux, Centre de Recherchesnformatique et Droit, Faculté NotreDame de la Paix, Rempart de laierge 5,5000 Namur; Belgium, Tel:3281 724769, Fax: + 3281 228858,-mail: sophie.louveaux@fundp.ac.beFootnotes:1 The recitals of the directivemention that the M ember Stateswill be left with a "margin formanoeuvre" (see §9)., The Belgian law on data protectionimplementing the European directive95/46/EC was adopted by theChambre des Representants on 12thNovember 1998 (see Doc. Pari.,1997-1998, n° 1566//3). Onceratified, it will corne into force atthe date established by the Kingmodifying the existing lawof8th December 1992.J See notably the definitioTls of "pro-cessing" and of "personal data»., Article 7 of the new law reproducesnearly word for word the terms ofarticle 6 of the directive.J It does, however figure in article 5of the Council of Europe Convention108 of the 28 January 1981 for theProtection of Indi'f}iduals withPRIVACY lAWS & BUSINESS INTERNATIONAL NEWSLETTER FEBRUARY 1999 Il

New belgian data protection law follows the EU Directive closely

https://pure.unamur.be/ws/files/60877291/4736.pdf

New belgian data protection law follows the EU Directive closely

Abstract

Similar works

Full text

Available Versions

Repository of the University of Namur

Repository of the University of Namur