Rights
GDPR applied through the 2018 framework act and a Litigation Chamber
The GDPR applies directly, with the Act of 30 July 2018 filling in the margins the Regulation leaves to member states. The Data Protection Authority replaced the former Privacy Commission in 2018 and, unlike its predecessor, has a Litigation Chamber able to issue binding orders and fines.
Key rules
- Children can consent to information-society services from the age of 13 in Belgium.
- Public-sector bodies are largely exempt from administrative fines, which are instead directed at private controllers.
- Federal public authorities must appoint a data protection officer.
- Personal data breaches must be notified to the authority within 72 hours where the risk threshold is met.
Governing law
- General Data Protection Regulation (Regulation (EU) 2016/679)
- Act on the protection of natural persons with regard to the processing of personal data (30 July 2018)
- Act establishing the Data Protection Authority (3 December 2017)
Penalties and consequences
- Administrative fines up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher
- Orders to bring processing into compliance, suspend transfers or erase data
In practice
Complaints must be in writing and in one of the national languages; the Litigation Chamber first tests admissibility and often closes cases through a settlement or a reprimand rather than a fine. A separate civil claim for damages goes to the ordinary courts, not the authority.