Belgium

Belgium has no dedicated biometric-identifier statute; a biometric identifier is General Data Protection Regulation (GDPR) Article 9(1) special-category data, plus Act Article 9's access-designation and confidentiality duties. GBA/APD Recommendation 01/2021, read in full, concludes there is at present a lacuna in Belgian law such that any biometric authentication processing lacking explicit consent, other than eID and passport processing, has no legal basis.

Litigation Chamber Decision 114/2024, read in full, fined an employer 45,000 EUR for fingerprint-based workplace time registration, holding that employee consent failed the power-imbalance analysis and that record-keeping and DPIA duties were also breached.

The GBA/APD's own publication search returns zero results for voice recognition and 16 results for facial recognition, none of them a decision, so Belgium has no facial-recognition Litigation Chamber decision and no voiceprint guidance at all, established from the regulator's own index rather than an inference.

A controller must notify the GBA/APD within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. No Belgium-specific derogation from this timeline or threshold was found in the Act of 30 July 2018.

A related but distinct power, Act of 3 December 2017 Article 100, 7, lets the Litigation Chamber order that a data subject be informed of a security problem, a corrective power over an Article 34 failure rather than a separate notification duty.

Belgium gives the General Data Protection Regulation (GDPR) domestic effect through the Act of 30 July 2018, published in the Moniteur belge 5 September 2018, read end to end in the official bilingual gazette text. Article 6 states Title 1 executes the Regulation; the Act sets the digital-consent age at 13 (Art. 7), designates public-interest processing categories under GDPR Article 9(2)(g) (Art. 8), and adds criminal-conviction-data grounds (Art. 10).

The supervisory structure sits in a separate statute, the Act of 3 December 2017. The Act has been amended four times on the Justel record, most recently in 2024.

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

Belgium adds a criminal offense for the same conduct: Article 222, 4, read verbatim, fines a controller, processor, employee, agent, or competent authority 250 to 15,000 EUR for a Chapter V breach carried out by gross negligence or malicious intent, and the Act of 3 December 2017 Article 100, 14 lets the Litigation Chamber order the suspension of cross-border data flows. No localization mandate was found.

General Data Protection Regulation (GDPR) Articles 12-23 govern access, rectification, erasure, restriction, portability, objection, and the Article 22 right against solely automated decision-making; Belgium adds no sector-specific automated-decision rule beyond that baseline.

What the Act adds, read verbatim, is a domestic enforcement route: Title 5's action en cessation lets the president of the court of first instance, sitting as in summary proceedings, order the cessation of processing that violates the data-protection rules, with standing confined to the data subject and the supervisory authority (Art. 211).

Article 220 implements GDPR Article 80, letting a data subject mandate a qualifying body active in data protection for at least three years to lodge a complaint on their behalf.

The Act of 3 December 2017, enacted 3 December 2017 and in force 25 May 2018, creates the Gegevensbeschermingsautoriteit / Autorite de Protection des Donnees (GBA/APD) and its Chambre Contentieuse / Geschillenkamer (Litigation Chamber, Art. 32). Article 100, read verbatim, lists sixteen measures the Chamber may take, from dismissing a complaint to imposing administrative fines, suspending cross-border data flows, and transferring a file to the public prosecutor. Appeal lies to the Marktenhof.

Title 6, Chapter II, read verbatim article by article, is Belgium's criminal chapter for data-protection violations, distinct from the Act of 3 December 2017's supervisory structure: Article 222 fines a controller, processor, employee, agent, or competent authority 250 to 15,000 EUR on fourteen enumerated grounds including processing without a legal basis and obstructing the supervisory authority; Article 224 fines a member or staffer of the supervisory authority 200 to 10,000 EUR for breaching confidentiality; Article 227 fines 100 to 20,000 EUR on five grounds including using assault, violence, or threats to compel a person's processing authorization; and Article 229 governs the overlap between administrative and criminal routes.

General Data Protection Regulation (GDPR) Article 82 arms an individual data subject to claim damages directly.

Belgium separately added the GDPR to the Code of Economic Law's collective redress action, Book XVII, Title 2: Article 43(a) of the Act of 30 July 2018 on various economic provisions, read verbatim, inserted point 10 degrees/1 naming Regulation (EU) 2016/679 into Article XVII.37's list of instruments whose breach can found a collective redress action, and Article 104 of the same act gives that insertion retroactive effect from 25 May 2018.

Article XVII.37's complete current list is not independently confirmed, because the Code's own consolidated text truncates before Book XVII, so confidence is high on the GDPR's inclusion and low on the article's present overall shape.

Article 10/1, read verbatim, permits recording an electronic communication and its traffic data in lawful commercial transactions as proof, on condition the parties are informed of the recording, its precise purposes, and the storage period before the recording, with data erased at the latest when the transaction can no longer be challenged in court.

Paragraph 2 separately permits listening to and recording calls solely to monitor service quality in call centres, on prior information to staff, with a maximum retention of one month. This is the Belgian provision most likely to bind a voice-recording product, distinct from the biometric rules above.

General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category. Article 9 of the Act, read verbatim, requires every controller processing genetic, biometric, or health data to designate the categories of staff with access, keep that list available to the supervisory authority, and bind those staff to confidentiality.

Article 8, paragraph 1's final subparagraph outright prohibits genetic and biometric processing for unique identification by the specific associations and foundations it authorizes under Article 9(2)(g), absent particular legal provisions. Article 10, paragraph 1, point 6 makes processing of criminal-conviction data manifestly made public by the data subject a lawful-basis ground, not a scope exclusion.

The Act of 19 June 2022, transposing Directive (EU) 2019/790, added a text-and-data-mining exception to Article XI.190 of the Code of Economic Law. Point 20° permits reproducing a work that has been made accessible in a lawful manner for the purposes of text and data mining, provided the rightsholder has not expressly reserved that use in an appropriate manner. For content made available online, a reservation counts as appropriate only if it is carried out by machine-readable means.

A reproduction made under the exception may be kept for as long as the text-and-data-mining purpose requires. The same article carries a neighbouring exception at point 19° for a non-profit purpose, which the same 2022 Act lightly amended alongside the new point 20°.

Article 30 requires an essential entity or an important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks threatening the security of the network and information systems it uses for its activities or to provide its services, on an all-hazards approach covering at minimum eleven points: risk-analysis and information-system-security policy, incident handling, business continuity (backup management, disaster recovery and crisis management), supply-chain security, security in the acquisition, development and maintenance of network and information systems including vulnerability handling and disclosure, policies to assess the effectiveness of the risk-management measures, basic cyber-hygiene practices and training, cryptography and encryption policy, human-resources security and access-control and asset management, multi-factor or continuous authentication and secure voice, video, text and emergency communications, and the entity's own coordinated vulnerability-disclosure policy.

Article 31 requires the management body of an essential or important entity to approve the cybersecurity risk-management measures it takes to comply with Article 30, supervise their implementation, and answer for that entity's violation of Article 30, without prejudice to the liability rules that otherwise apply to a public institution. Article 32 makes the entity itself responsible for the risk analysis it performs and for the choice and implementation of the Article 30 measures.

Article 33 lets the King, after consulting the national cybersecurity authority, any sectoral authority concerned and the federated entities concerned, impose additional appropriate and proportionate sector- or subsector-specific risk-management measures by decree deliberated in the Council of Ministers. This Act's own Article 97 repeals the predecessor Loi du 7 avril 2019, the original NIS Directive transposition, effective the same date.

Article 34 requires an essential entity or an important entity to notify any significant incident to the national CSIRT without undue delay, following the arrangements set out in a protocol between the CSIRT and the National Crisis Centre (NCCN).

Article 35 sets the clock: an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious action and whether it may have a cross-border impact; an incident notification within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available indicators of compromise; an interim report if the national CSIRT or the competent sectoral authority asks for one; and a final report no later than one month after the incident notification, describing the incident, its severity and impact, the likely threat or root cause, the mitigation measures applied, and any cross-border impact.

A qualified trust service provider instead reports any significant incident affecting its trust services within 24 hours in a single stage. Article 36 requires the national CSIRT to respond to an early warning within 24 hours where possible, with initial feedback and, on request, operational guidance.

Article 37 lets the national CSIRT, after consulting the entity, the NCCN, any sectoral authority concerned and the responsible minister, inform the public of a significant incident or require the entity to do so, where public awareness is necessary to prevent or manage the incident or where disclosure is otherwise in the public interest. Article 54, paragraph 2 bars a further administrative fine for conduct already fined by the data protection authorities under General Data Protection Regulation (GDPR) Article 58(2)(i).

A press publisher established in an EU member state has the sole right to reproduce its press publication and to make it available online for use by an information-society service provider, per Article XI.216/2, paragraph 1.

The publisher and the service provider must negotiate in good faith over that use and the remuneration due, and either may refer an unresolved dispute to the Belgian Institute for Postal Services and Telecommunications, which can decide the remuneration and take a binding administrative decision.

A service provider must give the publisher updated, relevant, and complete information on the number of consultations and the revenue it draws from the publications, on the publisher's written request, so the publisher can value the right, and authors of works integrated into a press publication are entitled to an appropriate, non-transferable share of what publishers collect for the use, set by a collective agreement.

The right does not reach hyperlinking, the use of isolated words or very short extracts of a press publication, or works whose protection has expired. It expires two years after the press publication was first published.