Operates a social platform, in Belgium

Dekret vom 1. März 2021 (Deutschsprachige Gemeinschaft), Art. 32 · Read the law's page

• Applies to the provider of a video-sharing platform service established in the German-speaking area of Belgium, or treated as established there because a parent or subsidiary company, or another company of its group, is established there (Article 3(4)).
• Take appropriate measures to protect minors from programmes, user-generated videos and audiovisual commercial communication that could impair their physical, mental or moral development (Article 32(1), point 1).
• Set up and operate, where appropriate, systems to verify the age of the platform's users for content that could impair the physical, mental or moral development of minors (Article 32(3), point 6).
• Provide, where appropriate, parental control systems managed by the end user for that content (Article 32(3), point 8).
• Subject the most harmful content to the strictest access-control measures (Article 32(3)).
• Do not use the personal data of minors collected or obtained for age verification and parental control for commercial purposes such as direct marketing, profiling or advertising based on usage behavior (Article 32(4)).

Décret du 4 février 2021 (Communauté française), art. 2.5-2 · Read the law's page

• Applies to the provider of a video-sharing platform under the jurisdiction of the French Community.
• Take appropriate measures to protect minors from programmes and user-generated videos that could harm their physical, mental or moral development, so that minors cannot normally hear or see them (Article 2.5-2(1)).
• Set up a system to verify the age of the user and a parental control that the user controls (Article 2.5-2(2), point 4).
• Subject the most harmful content, such as pornography and gratuitous violence, to the strictest access-control measures (Article 2.5-2(5)).
• Do not use the personal data of minors collected or generated under these measures for commercial purposes such as direct marketing, profiling or behavioral advertising (Article 2.5-2(3)).

Mediadecreet, art. 176/4 · Read the law's page

• Applies to the provider of a video-sharing platform under the jurisdiction of the Flemish Community.
• Take appropriate measures to protect minors from programmes, user-generated content and commercial communication that could impair their physical, mental or moral development.
• Set up and use systems to verify the age of the platform's users for programmes, user-generated content and commercial communication that could impair the physical, mental or moral development of minors.
• Offer programmes, user-generated content and commercial communication showing pornographic images or images of gratuitous violence encrypted or under effective parental control.
• Provide parental control systems managed by the end user for that content.
• Do not process for commercial purposes the personal data of minors collected for the age verification and parental control systems.

Code de droit économique, arts. XI.228/2-XI.228/3 and XI.228/5-XI.228/9 · Read the law's page

• Treat giving the public access to works or performances that your users upload as your own act of communication to the public, which needs the rightholders' authorization (Article XI.228/3, paragraph 1); an authorization you obtain also covers your users' acts where they do not act on a commercial basis or earn no significant revenues (paragraph 2).
• If you have no authorization, show that you made your best efforts to obtain one, made your best efforts, to high industry standards of professional diligence, to make specific works unavailable where rightholders gave you the relevant and necessary information, and acted promptly on a sufficiently substantiated notice to block access or remove the works while making your best efforts to prevent future uploads, to avoid liability for unauthorized acts of communication to the public (Article XI.228/5, paragraph 1).
• If your services have been available to the public in the European Union for less than three years and your annual turnover is below EUR 10,000,000, you only have to show best efforts to obtain an authorization and prompt action on a sufficiently substantiated notice; once your average monthly unique visitors exceed five million, you must also show best efforts to prevent further uploads of the notified works (Article XI.228/5, paragraph 2).
• Do not let your cooperation with rightholders prevent the availability of user uploads that do not infringe copyright or related rights, including works covered by an exception or limitation (Article XI.228/6, paragraph 1).
• On request, give rightholders adequate information on how your cooperation practices work and, where you have license agreements with them, on the use of the covered works; tell your users in your general terms and conditions that they may use works under copyright exceptions and limitations (Article XI.228/7, paragraphs 1 and 2).
• Run an effective and quick complaint and redress mechanism for users in disputes over blocked or removed uploads, handle complaints without undue delay and have decisions to block or remove content reviewed by a natural person (Article XI.228/8, paragraphs 1 and 3).
• For activities directed at users or rightholders with their seat or habitual residence in Belgium, name in your general terms and conditions or license agreements two or more mediators you are prepared to work with on out-of-court settlement of disputes over blocking or removal, act in good faith in mediation, and bear a reasonable share of the mediation costs (Article XI.228/9).

Code de droit économique, art. XII.20; Loi du 21 avril 2024, arts. 2-5 and 15-18 · Read the law's page

• If you provide a service named in Article 3, points (g), (i) and (j) of Regulation (EU) 2022/2065 (an intermediary service, an online platform or an online search engine), make inaccessible the content that is the subject of an infringement established by a competent judicial or administrative authority and committed through your service (Article XII.20, paragraph 1).
• Communicate to the competent judicial or administrative authorities, on their request, all the specific information you hold that is useful for investigating and establishing infringements committed by a specific recipient of your intermediary service (Article XII.20, paragraph 2).

Loi du 21 avril 2024, arts. 6-14 (loi du 17 janvier 2003, arts. 14, 15/1, 20, 21) · Read the law's page

• Comply with Regulation (EU) 2022/2065 as a provider of an intermediary service established in Belgium or with a legal representative there; the Belgian Institute for Postal Services and Telecommunications (BIPT) is a competent authority for it under Article 49 of the Regulation, for the federal competences.
• Allow the BIPT to inspect your premises under Article 51(1)(b) of the Regulation once its Council has decided on the inspection; the decision states the object and purpose of the inspection, the date it starts and the sanctions that apply in case of non-compliance, and an inspection in a private home needs an investigating judge's authorization.
• Give the explanations that BIPT staff mandated by the Council request under Article 51(1)(c) of the Regulation; they are recorded in a report that the person questioned signs.
• Comply with the interim measures that the BIPT Council adopts when it finds a breach of the Regulation prima facie, under Article 51(2)(e) of the Regulation.
• Perform any commitment you propose under the Regulation that the BIPT accepts and makes binding.

Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique, Artt. 30-33 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use in the course of your activities or to provide your services.
• Cover at minimum: policies on risk analysis and information-system security; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the direct suppliers and service providers you rely on; security in the acquisition, development and maintenance of your network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on the use of cryptography and, where applicable, encryption; personnel security, access-control policies and asset management; multi-factor or continuous authentication and secure voice, video, text and emergency communications where needed; and your own coordinated vulnerability-disclosure policy.
• Have your management body approve these risk-management measures, supervise their implementation, and answer for a violation of this duty; you remain responsible for your own risk analysis and for the choice and implementation of the measures.
• This binds an essential entity or an important entity drawn from Annex I or Annex II; Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex I's digital-infrastructure entry separately names a DNS service provider, a top-level-domain name registry, a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a managed service provider and a managed security service provider, so a service in any of those lines is reached at the medium-enterprise size threshold or above; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity.

Loi du 26 avril 2024 établissant un cadre pour la cybersécurité des réseaux et des systèmes d'information d'intérêt général pour la sécurité publique, Artt. 34-37 · Read the law's page

• Notify the national CSIRT of any significant incident without undue delay, following the arrangements set out in the protocol between the CSIRT and the National Crisis Centre.
• Submit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious action and whether it may have a cross-border impact.
• Follow with an incident notification within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available indicators of compromise.
• Submit an interim report if the national CSIRT or the competent sectoral authority asks for one, and a final report no later than one month after the incident notification, describing the incident in detail, its severity and impact, the likely threat or root cause, the mitigation measures applied and in progress, and any cross-border impact.
• If the incident is still ongoing when the final report falls due, submit a progress report at that point, followed by a final report within one month of the final handling of the incident (Article 35, paragraph 1, point 5).
• If you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant incident that affects your trust services (Article 35, paragraph 2).
• Where public awareness is necessary to prevent or manage the significant incident, or where disclosure is otherwise in the public interest, the national CSIRT may itself inform the public of the incident or require you to do so.
• This binds the same essential and important entities as this jurisdiction's companion risk-management row, on the same Annex I and Annex II scope.

Avant-projet de loi modifiant les dispositions du Code civil relatives à la responsabilité du fait des produits défectueux, et insérant l’article 877/1 dans le Code judiciaire · Read the law's page

• Answer for a defective product under the Civil Code provisions on liability for defective products, which the draft amends; the draft also inserts Article 877/1 into the Judicial Code.