BelgiumAct of 30 July 2018 Title 6 Chapter II, Criminal Sanctions
Loi du 30 juillet 2018, Arts. 222-230
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not process personal data of a person in Belgium without a legal basis under General Data Protection Regulation (GDPR) Article 6, under Act of Article 222.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the offense in Article 222, point 1 of the Act of , processing personal data without a legal basis under Article 6 of Regulation (EU) 2016/679, require gross negligence or malicious intent, as points 2 and 4 of the same article expressly do?
What it makes you log
Logging duty
Articles 222 to 230 set criminal fines for processing without a legal basis and for other breaches, including obstructing the supervisory authority's verification missions. They create no log or record duty.
- Kind
- None
- As of
What this law does
Title 6, Chapter II is Belgium's criminal chapter for data-protection violations, distinct from the Act of 's supervisory structure: Article 222 fines a controller, processor, employee, agent, or competent authority 250 to 15,000 EUR on fourteen enumerated grounds including processing without a legal basis and obstructing the supervisory authority; Article 224 fines a member or staffer of the supervisory authority 200 to 10,000 EUR for breaching confidentiality; Article 227 fines 100 to 20,000 EUR on five grounds including using assault, violence, or threats to compel a person's processing authorization; and Article 229 governs the overlap between administrative and criminal routes.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .