BELGIUM Law and Practice Contributed by: Benjamin Docquir and Margo Cornette, Osborne Clarke
these regulations is the Belgian Data Protection Authority (DPA). In December 2024, Belgium also enacted a major reform of private investigations that aims to translate the essential requirements of data protection law in the field of intelligence gath - ering activities of the private sector (see 4.3 Employment Privacy Law ). The Act on Private Investigations is public policy, and breaches thereof can lead to rejection or cancellation of evidence in court, as well as to administrative or criminal offences. At present, no specific legal regime has been enacted with respect to artificial intelligence (AI). 1.2 Regulators The Belgian DPA consists of: • an executive committee; • a general secretariat; • a first-line service; • an authorisation and opinion service; • an inspection service; and • a litigation chamber. The DPA has the right to conduct audits. Furthermore, investigations may be launched on the initiative of the DPA, where a complaint is lodged by a data subject or a body, organisation or association that has been properly constitut - ed in accordance with the law of an EU member state, has statutory objectives of public interest and is active in the protection of data subjects’ rights and freedoms. Alongside the DPA, different regulators and pub - lic authorities have a role to play in data sharing, open data and the national implementation of the EU data spaces strategy.
With respect to AI, it is still unclear whether the DPA will be vested with regulatory powers under the EU AI Act and, if so, to what extent. That being said, there is little doubt that the DPA will exercise its powers in relation to automated decision-making, and the impact of AI projects on fundamental rights, as often as it can. 1.3 Enforcement Proceedings and Fines The DPA must comply with the GDPR and the Belgian Law of 30 July 2018. When a complaint is filed or an investigation is launched, there will usually be an initial fact-finding phase during which the authority will ask a business to provide factual information. Afterwards, proceedings on the merits can be started in front of the Litiga - tion Chamber of the DPA, in the scope of which parties can submit their respective arguments in writing and possibly be heard. After the proceedings, the Litigation Chamber is entitled to: • dismiss the complaint; • order the dismissal of the prosecution; • order the stay of proceedings; • propose a settlement; • issue warnings and reprimands; • order compliance with the requests brought by the data subject relating to the exercise of their rights; • impose periodic penalty payments; or • impose administrative fines. In the event that the DPA imposes an adminis - trative fine, such fine must be effective, propor - tionate and dissuasive, pursuant to Article 83 of the GDPR. Furthermore, specific circumstances must be taken into account when imposing an administrative fine and deciding on its amount.
13
CHAMBERS.COM
Powered by FlippingBook