A Proposal For Belgian 'Privacy Rulings': Towards More Approachable DPAs?

• Published date: 09 April 2021
• Subject Matter: Privacy, Data Protection
• Law Firm: Astrea
• Author: Mr Steven De Schrijver and Jan van Loon

A system for obtaining advance rulings for specific tax matters has already been in place in Belgium since the nineties. It allows natural and legal persons, under certain conditions, to obtain binding decisions for a period of maximum five years from the tax authorities, which set out how they will apply tax laws to a particular situation or transaction which is yet to produce tax effects. A recent proposal made in Belgian parliament seeks to create a similar system of 'privacy rulings'.

The Belgian DPA does not provide explicit advance decisions on privacy questions brought to it, neither is there any legal basis in the GDPR or the Belgian Privacy Act to do so. Possible informal arrangements with the DPA are never published, so that other parties cannot learn from them. It is also difficult to estimate whether or not the DPA will consider itself to be bound by such informal arrangements at a later stage.

Article 36 of the GDPR only sets out a procedure to notify the DPA in case a data protection impact assessment (DPIA) indicates that an envisaged processing would result in a high risk to the rights and freedoms of natural persons in the absence of measures taken by the controller to mitigate the risk. Within eight weeks, the DPA must respond to such request if it is of the opinion that the intended processing would infringe the GDPR. Hence, this cannot be seen as a general possibility to obtain a decision from the DPA on identified privacy issues.

The proposal to amend the Belgian act of 3 December 2017 governing the DPA would create the possibility for the DPA to issue a ruling, i.e. an advance decision on how the DPA will apply the law to a specific situation or an envisaged processing of personal data. Such ruling would bind all departments of the DPA, save for a number of exceptions, which means that they would need to respect it in the future. To be clear: such ruling would only concern specific situations, and not hypothetical questions.

A request for a Belgian 'privacy ruling' would need to include: (i) the identity of the requesting party and other involved parties, if any; (ii) a description of the activities of the requesting party; (iii) a complete description of the specific situation or the envisaged processing; and (iv) a reference to the legal or regulatory provisions based on which the decisions would need to be made. A copy of similar requests and decisions which were filed with or obtained from the DPAs of other EU member states with...