0A4F4F9BD490A749D5437F821CF06DF1
Decree of February 13, 2001 Implementing the Law of December 8, 1999
https://www.privacycommission.be/sites/privacycommission/files/documents/Royal_Decree_2001.pdf
http://leaux.net/URLS/ConvertAPI Text Files/056E3EC22F5B5E9A8005F8F189166008.en.txt
Examining the file media/Synopses/056E3EC22F5B5E9A8005F8F189166008.html:
This file was generated: 2020-07-14 06:42:38
| Indicators in focus are typically shown highlighted in yellow; |
Peer Indicators (that share the same Vulnerability association) are shown highlighted in pink; |
"Outside" Indicators (those that do NOT share the same Vulnerability association) are shown highlighted in green; |
Trigger Words/Phrases are shown highlighted in gray. |
Link to Orphaned Trigger Words (Appendix (Indicator List, Indicator Peers, Trigger Words, Type/Vulnerability/Indicator Overlay)
Applicable Type / Vulnerability / Indicator Overlay for this Input
Political / political affiliation
Searching for indicator party:
(return to top)
p.000001: process non-encoded data pursuant to the provisions of section 2 of this chapter.
p.000001:
p.000001: In that case he shall mention in the notification of the processing, which he shall make pursuant to article 17 of the
p.000001: Act, the reasons why it is impossible to achieve the historical, statistical or scientific purposes using encoded data
p.000001: for the further processing.
p.000001:
p.000001: Art 6. The controller of the further processing of personal data for historical, statistical or scientific purposes
p.000001: must not perform any operations that aim to convert anonymous data into personal data or encoded personal data into
p.000001: non-encoded personal data.
p.000001:
p.000001:
p.000001:
p.000001:
p.000002: 2
p.000002:
p.000002: Unofficial Translation September 2009
p.000002:
p.000002: Section II. – Processing encoded personal data
p.000002:
p.000002: Art 7. Personal data shall be encoded prior to any further processing for historical, statistical or
p.000002: scientific purposes.
p.000002:
p.000002: Art 8. If the controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000002: purposes, further processes the personal data for historical, statistical or scientific purposes or entrusts a
p.000002: processor with the processing, the personal data shall be encoded prior to the further processing, either by the
p.000002: controller, by the processor or by an intermediary organization.
p.000002:
p.000002: In the latter case the intermediary organization shall be considered as processor in the meaning of article 1, § 5 of
p.000002: the Act.
p.000002:
p.000002: Art. 9 If the controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000002: purposes discloses the personal data to a third party with a view to further processing for historical, statistical or
p.000002: scientific purposes, the personal data shall be encoded by the controller or by an intermediary organization prior to
p.000002: the disclosure.
p.000002:
p.000002: In the latter case the intermediary organization shall be considered as processor in the meaning of article 1, § 5 of
p.000002: the Act.
p.000002:
p.000002: Art 10. If several controllers of a processing operation of personal data collected for specified, explicit and
p.000002: legitimate purposes disclose personal data to the same third party (-ies) with a view to further processing for
p.000002: historical, statistical or scientific purposes, the personal data shall be encoded by an intermediary organization
p.000002: prior to the disclosure.
p.000002:
p.000002: In the last case the intermediary organization shall be considered as processor in the meaning of
p.000002: article 1, § 4 of the Act.
p.000002:
p.000002: Art 11. The intermediary organization shall be independent from the controller of the further processing
p.000002: of the personal data for historical, statistical or scientific purposes.
p.000002:
p.000002: Art 12. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000002: purposes and the intermediary organization encoding the personal data with a view to further processing for
p.000002: historical, statistical or scientific purposes, shall take appropriate technical and organizational measures in order
p.000002: to prevent the conversion of encoded data into non-encoded data.
p.000002:
p.000002: Art 13. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000002: purposes, and the intermediary organization may only disclose encoded data with a view to
p.000002:
p.000003: 3
p.000003:
p.000003: Unofficial Translation September 2009
p.000003:
p.000003:
p.000003: further processing for historical, statistical or scientific purposes when the controller of the further
p.000003: processing produces a receipt of complete notification, issued by the Commission pursuant to article 17, § 2 of the
p.000003: Act.
p.000003:
p.000003: Art 14. Prior to the encoding of the data referred to in articles 6 to 8 of the Act, the controller of a processing
...
p.000007:
p.000007: This prohibition shall be lifted when the processing is intended for the benefit of the data subject.
p.000007:
p.000007: CHAPTER IV. – Conditions for exemption from the duty of information referred to in article 9, § 2 of the Act
p.000007:
p.000007: Art 28. The controller of a further processing operation of personal data for historical, statistical or scientific
p.000007: purposes who processes encoded data only shall be exempt from the duty to inform the data subject referred to in
p.000007: article 9, § 2 of the Act provided that the conditions set forth in Chapter II, Section II of this decree have been
p.000007: met.
p.000007:
p.000007:
p.000008: 8
p.000008:
p.000008: Unofficial Translation September 2009
p.000008:
p.000008:
p.000008: Art 29. Any administrative authority that has the explicit task of gathering and encoding personal data by or
p.000008: under the law, and that is subject to specific measures laid down by or under the law for the purpose of protecting
p.000008: privacy in this process, shall be exempt from the duty of information referred to in article 9, § 2 of the
p.000008: Act if it acts as an intermediary organization.
p.000008:
p.000008: Art 30. Except for the cases described in articles 28 and 29 of this decree, any controller invoking an exemption from
p.000008: the duty of information referred to in article 9, § 2 of the Act, because informing the data subject proves
p.000008: impossible or would involve a disproportionate effort, shall provide the aforementioned information at the
p.000008: time of his first contact with the data subject.
p.000008:
p.000008: If the controller referred to in the first paragraph discloses the personal data to a third party, the latter
p.000008: shall provide the information referred to in article 9, § 2 of the Act to the data subject at the time of their first
p.000008: contact.
p.000008:
p.000008: Art 31. Any controller unable to inform the data subject because this proves impossible or would involve a
p.000008: disproportionate effort, shall mention this in the notification he makes to the Commission under article 17 of the Act.
p.000008:
p.000008: The Commission shall publish the list of controllers in the public register described in article 18 of the Act and
p.000008: shall mention the reasons justifying the exemption.
p.000008:
p.000008: CHAPTER V. – Exercise of the rights referred to in articles 10 and 12 of the Act
p.000008:
p.000008: Art 32 Under the conditions laid down by law any individual proving his identity has the right to
p.000008: access the information mentioned in article 10 by means of a signed and dated request submitted with door-to-door
p.000008: delivery , sent by post or sent using a means of telecommunication. The request shall be submitted:
p.000008:
p.000008: • either to the controller or his representative in Belgium, or an individual authorized or appointed
p.000008: by him;
p.000008: • or to the processor who shall transmit it to one of the aforementioned individuals if necessary.
p.000008:
p.000008: If the request is submitted with door-to-door delivery, the individual receiving it shall immediately
p.000008: provide the requester with a dated and signed receipt.
p.000008:
p.000008: Art 33. Any request to prohibit the use of, to rectify or to delete personal data and any objection based on article 12
p.000008: of the Act shall be submitted following the procedure mentioned in article 32 of this decree and to the individuals
p.000008: referred to in that article.
...
Social / Access to Social Goods
Searching for indicator access:
(return to top)
p.000002:
p.000002: Art 12. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000002: purposes and the intermediary organization encoding the personal data with a view to further processing for
p.000002: historical, statistical or scientific purposes, shall take appropriate technical and organizational measures in order
p.000002: to prevent the conversion of encoded data into non-encoded data.
p.000002:
p.000002: Art 13. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000002: purposes, and the intermediary organization may only disclose encoded data with a view to
p.000002:
p.000003: 3
p.000003:
p.000003: Unofficial Translation September 2009
p.000003:
p.000003:
p.000003: further processing for historical, statistical or scientific purposes when the controller of the further
p.000003: processing produces a receipt of complete notification, issued by the Commission pursuant to article 17, § 2 of the
p.000003: Act.
p.000003:
p.000003: Art 14. Prior to the encoding of the data referred to in articles 6 to 8 of the Act, the controller of a processing
p.000003: operation of personal data collected for specified, explicit and legitimate purposes or the intermediary organization
p.000003: must provide the data subject with the following information:
p.000003:
p.000003: • the identity of the controller;
p.000003: • the categories of data being processed;
p.000003: • the origin of the data;
p.000003: • a precise description of the historical, statistical or scientific purposes of the processing;
p.000003: • the recipients or categories of recipients of the data;
p.000003: • the existence of the data subject's right to access and rectify his personal data;
p.000003: • the existence of the data subject's right to object.
p.000003:
p.000003: Art 15. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000003: purposes and the intermediary organization do not have to comply with the duty imposed by article 14 of this decree if
p.000003: this duty proves impossible or would involve a disproportionate effort, and if they have followed the procedure
p.000003: established by article 16 of this decree.
p.000003:
p.000003: Art 16. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000003: purposes or the intermediary organization do not have to comply with the duty imposed by article 14 if the intermediary
p.000003: organization is an administrative authority having the explicit task, by or under the law, of gathering and encoding
p.000003: personal data, and if it is subject to specific measures laid down by or under the law in order to protect privacy in
p.000003: this process.
p.000003:
p.000003: Art 16. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000003: purposes or the intermediary organization wishing to encode the data referred to in articles
p.000003: 6 to 8 of the Act without informing the data subject in advance, shall complete the compulsory
p.000003: notification under article 17 of the Act with the following information:
p.000003:
p.000003: 1° a precise description of the historical, statistical or scientific purposes of the processing;
p.000003:
p.000003: 2° the reasons justifying the processing of the personal data referred to in articles 6 to 8 of the Act;
p.000003:
p.000003: 3° the reasons why the data mentioned in article 14 cannot be communicated to the data subject or the disproportion of
p.000003: the effort to do so;
p.000003:
p.000003:
p.000004: 4
p.000004:
p.000004: Unofficial Translation September 2009
p.000004:
p.000004:
p.000004:
p.000004: 4° the categories of persons whose personal data mentioned in articles 6 to 8 of the Act are being processed;
p.000004:
p.000004: 5° the individuals or categories of individuals having access to the personal data; 6° the origin of the data.
p.000004: Within forty-five working days of receipt of the notification, the Commission shall transmit a
p.000004: recommendation to the controller or the intermediary organization, accompanied, if necessary, by additional
p.000004: conditions to be met when further processing the encoded personal data referred to in articles 6 to 8 of
p.000004: the Act.
p.000004:
p.000004: The term established in the second paragraph may be extended once by forty-five days. The Commission
p.000004: shall inform the controller of the extension of the first term prior to the expiry of that term.
p.000004:
p.000004: If the Commission has not made a recommendation upon expiry of the terms referred to in this article,
p.000004: the request shall be considered as granted.
p.000004:
p.000004: The Commission shall publish its recommendation in the register referred to in article 18 of the Act.
p.000004:
p.000004: Art 17. The controller must report to the Commission any modification to the data he transmitted to it pursuant to
p.000004: article 16 of this decree.
p.000004:
p.000004: Section III. – Processing non-encoded personal data
p.000004:
p.000004: Art 18. Prior to the further processing of non-encoded personal data for historical, statistical or
p.000004: scientific purposes, the controller of the further processing shall provide the data subject with the
p.000004: following information:
p.000004:
p.000004: 1° the identity of the controller;
p.000004:
p.000004: 2° the categories of data being processed; 3° the origin of the data;
p.000004: 4° a precise description of the historical, statistical or scientific purposes of the processing;
p.000004:
p.000004:
p.000004:
p.000005: 5
p.000005:
p.000005: Unofficial Translation September 2009
p.000005:
p.000005:
p.000005: 5° the recipients or categories of recipients of the data;
p.000005:
p.000005: 6° the existence the data subject's right to access and rectify his personal data;
p.000005:
p.000005: 7° the existence of the duty to ask the data subject's consent prior to the processing of non-encoded personal data for
p.000005: historical, statistical or scientific purposes.
p.000005:
p.000005: Art 19. Prior to the processing operation the data subject must give his explicit consent to the
p.000005: processing of non-encoded personal data relating to him for historical, statistical or scientific purposes.
p.000005:
p.000005: Art 20. The controller of the further processing of non-encoded personal data for historical, statistical or scientific
p.000005: purposes does not have to comply with the duties imposed by articles 18 and 19 of this decree:
p.000005:
p.000005: 1° if the further processing for historical, statistical or scientific purposes is restricted to non-encoded personal
p.000005: data that have been made public as a result of steps deliberately taken by the data subject or that are closely related
p.000005: to the public character of the data subject or of the facts in which the data subject is or was involved;
p.000005:
p.000005: or
p.000005:
p.000005: 2° if complying with these duties proves impossible or would require a disproportionate effort, and the controller has
p.000005: followed the procedure established in article 21 of this decree.
p.000005:
p.000005: Art 21. Any controller of a further processing operation of non-encoded personal data for historical, statistical or
p.000005: scientific purposes wishing to process the data without informing the data subject in advance or without
p.000005: asking the latter for his consent, shall complete the notification required for this purpose under article 17 of the
p.000005: Act with the following information:
p.000005:
p.000005: 1° a precise description of the historical, statistical or scientific purposes of the processing; 2° the reasons why it
p.000005: is necessary to process non-encoded data;
p.000005: 3° the reasons why the data subject cannot be asked for an informed consent, or the disproportion of the effort
p.000005: required to obtain such consent;
p.000005:
p.000005: 4° the categories of individuals whose non-encoded personal data are being processed;
p.000005:
p.000005: 5° the individuals or categories of individuals having access to the non-encoded data;
p.000005:
p.000006: 6
p.000006:
p.000006: Unofficial Translation September 2009
p.000006:
p.000006:
p.000006:
p.000006: 6° the origin of the data.
p.000006:
p.000006: Within forty-five working days of receipt of the notification, the Commission shall transmit a
p.000006: recommendation to the controller of the further processing, accompanied, if necessary, by any additional
p.000006: conditions to be met for the further processing of the non-encoded data for historical, statistical or
p.000006: scientific purposes.
p.000006:
p.000006: The term established in the second paragraph may be prolonged once by forty-five days. The Commission
p.000006: shall inform the controller of the further processing of the prolongation of the first term prior to its expiry.
p.000006:
p.000006: If the Commission has not given a recommendation upon expiry of the terms referred to in this article, the request
p.000006: shall be considered as granted.
p.000006:
p.000006: The Commission shall publish its recommendation in the register referred to in article 18 of the Act.
p.000006:
p.000006: Art 22. The controller must inform the Commission of any modification to the data he transmitted to it pursuant to
p.000006: article 21 of this decree.
p.000006:
p.000006: Section IV. – Publication of the results of the processing
p.000006:
p.000006: Art 23. The results of the processing for historical, statistical or scientific purposes must not be
p.000006: published in a form identifying the data subject unless:
p.000006:
p.000006: 1° he has given his explicit consent and the privacy of third parties is not violated, or
p.000006:
p.000006: 2° the publication of non-encoded data is restricted to data that has apparently been made public by the data subject
p.000006: or that is closely related to the public character of the data subject or of the facts in which the data subject is or
p.000006: was involved.
p.000006:
p.000006: Section V. – Exception
p.000006:
p.000006: Art 24. Chapter II of this decree does not apply to the services and authorities referred to in article 3,
p.000006: § 4 of the Act that further process personal data for historical, statistical or scientific purposes.
p.000006:
p.000006:
p.000006:
p.000006:
p.000006:
p.000006:
p.000006:
p.000007: 7
p.000007:
p.000007: Unofficial Translation September 2009
p.000007:
p.000007: CHAPTER III. – Conditions for processing the personal data referred to in articles 6 to 8 of the Act
p.000007:
p.000007: Art 25. When processing the personal data referred to in articles 6 to 8 of the Act, the controller must also take the
p.000007: following measures:
p.000007: 1° the categories of individuals having access to the personal data must be designated by the controller
p.000007: or the processor, if any, with a precise description of their function with respect to the data processing operation in
p.000007: question;
p.000007:
p.000007: 2° the controller or the processor, if any, must keep the list of designated individuals available to the Commission;
p.000007:
p.000007: 3° the controller must ensure that the individuals designated respect the confidential nature of the data in question
p.000007: under a legal duty, an obligation laid down in articles of association or an equivalent contractual stipulation;
p.000007:
p.000007: 4° when informing the data subject under article 9 of the Act or in the notification referred to in article 17, § 1 of
p.000007: the Act, the controller must mention the act or regulation authorizing the processing of the personal data referred to
p.000007: in articles 6 to 8 of the Act.
p.000007:
p.000007: Art 26. If the processing of the personal data referred to in articles 6 and 7 of the Act is only
p.000007: authorized with the data subject's written consent, the controller must inform the latter of the reasons for the
p.000007: processing and provide him with the list of the categories of individuals having access to the personal data in
p.000007: addition to the data that must be supplied by virtue of article 9.
p.000007:
p.000007: Art 27. If the processing of the personal data referred to in articles 6 and 7 of the Act is only
p.000007: authorized with the data subject's written consent, such processing shall be prohibited if the controller is the data
p.000007: subject's current or potential employer or if the data subject is in a dependent position with respect to the
p.000007: controller, preventing the former from giving his free consent.
p.000007:
p.000007: This prohibition shall be lifted when the processing is intended for the benefit of the data subject.
p.000007:
p.000007: CHAPTER IV. – Conditions for exemption from the duty of information referred to in article 9, § 2 of the Act
p.000007:
p.000007: Art 28. The controller of a further processing operation of personal data for historical, statistical or scientific
p.000007: purposes who processes encoded data only shall be exempt from the duty to inform the data subject referred to in
p.000007: article 9, § 2 of the Act provided that the conditions set forth in Chapter II, Section II of this decree have been
p.000007: met.
p.000007:
p.000007:
p.000008: 8
p.000008:
p.000008: Unofficial Translation September 2009
p.000008:
p.000008:
p.000008: Art 29. Any administrative authority that has the explicit task of gathering and encoding personal data by or
p.000008: under the law, and that is subject to specific measures laid down by or under the law for the purpose of protecting
p.000008: privacy in this process, shall be exempt from the duty of information referred to in article 9, § 2 of the
p.000008: Act if it acts as an intermediary organization.
p.000008:
p.000008: Art 30. Except for the cases described in articles 28 and 29 of this decree, any controller invoking an exemption from
p.000008: the duty of information referred to in article 9, § 2 of the Act, because informing the data subject proves
p.000008: impossible or would involve a disproportionate effort, shall provide the aforementioned information at the
p.000008: time of his first contact with the data subject.
p.000008:
p.000008: If the controller referred to in the first paragraph discloses the personal data to a third party, the latter
p.000008: shall provide the information referred to in article 9, § 2 of the Act to the data subject at the time of their first
p.000008: contact.
p.000008:
p.000008: Art 31. Any controller unable to inform the data subject because this proves impossible or would involve a
p.000008: disproportionate effort, shall mention this in the notification he makes to the Commission under article 17 of the Act.
p.000008:
p.000008: The Commission shall publish the list of controllers in the public register described in article 18 of the Act and
p.000008: shall mention the reasons justifying the exemption.
p.000008:
p.000008: CHAPTER V. – Exercise of the rights referred to in articles 10 and 12 of the Act
p.000008:
p.000008: Art 32 Under the conditions laid down by law any individual proving his identity has the right to
p.000008: access the information mentioned in article 10 by means of a signed and dated request submitted with door-to-door
p.000008: delivery , sent by post or sent using a means of telecommunication. The request shall be submitted:
p.000008:
p.000008: • either to the controller or his representative in Belgium, or an individual authorized or appointed
p.000008: by him;
p.000008: • or to the processor who shall transmit it to one of the aforementioned individuals if necessary.
p.000008:
p.000008: If the request is submitted with door-to-door delivery, the individual receiving it shall immediately
p.000008: provide the requester with a dated and signed receipt.
p.000008:
p.000008: Art 33. Any request to prohibit the use of, to rectify or to delete personal data and any objection based on article 12
p.000008: of the Act shall be submitted following the procedure mentioned in article 32 of this decree and to the individuals
p.000008: referred to in that article.
p.000008:
p.000008:
p.000009: 9
p.000009:
p.000009: Unofficial Translation September 2009
p.000009:
p.000009:
p.000009: Art 34. If personal data is collected from the data subject in writing, the controller shall use the
p.000009: document he collects the data with to ask the data subject whether he wishes to exercise the right to object provided
p.000009: for by article 12, § 1, third paragraph of the Act.
p.000009:
p.000009: If the personal data is collected from the data subject otherwise than in writing, the controller shall ask the data
p.000009: subject whether he wishes to exercise the right to object provided by article 12, § 1, third paragraph of the Act. The
p.000009: data subject can object on a document the controller provides him with, at the latest two months after the personal
...
p.000012:
p.000012: Art 56. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000012: data carried out by a foundation, an association or any other non-profit organization in the course of its normal
p.000012: activities.
p.000012:
p.000012: The processing may only relate to member administration, to individuals the controller regularly enters into contact
p.000012: with or to supporters of the foundation, association or organization.
p.000012:
p.000013: 13
p.000013:
p.000013: Unofficial Translation September 2009
p.000013:
p.000013:
p.000013:
p.000013: No personal data may be recorded in their processing operations on the basis of data provided by third parties. The
p.000013: personal data being processed must not be kept any longer than necessary for member, contact or
p.000013: supporter administration and may only be disclosed to third parties in the framework of the application of a
p.000013: provision from an act or ordinance.
p.000013:
p.000013: Art 57. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of
p.000013: identification data necessary for communication and carried out for the sole purpose of contacting the data subject,
p.000013: provided that the data is not disclosed to third parties and that it is not kept any longer than necessary for the
p.000013: purpose of the processing.
p.000013:
p.000013: The first paragraph of this article only relates to the processing of personal data that is not referred to in another
p.000013: provision of this decree.
p.000013:
p.000013: Art 58. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data that only relates to visitor registration in the context of access control, provided that the data is restricted
p.000013: to the visitor's name and professional address, the identification of his employer, the identification of his vehicle,
p.000013: the name, department and function of the individual being visited and the time of the visit.
p.000013:
p.000013: The personal data may only be used for access control and must not be kept any longer than necessary
p.000013: for that purpose.
p.000013:
p.000013: Art. 59 Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by educational institutions with a view to the management of the relation with their pupils or
p.000013: students.
p.000013:
p.000013: The processing may only relate to personal data of potential, current and former pupils or students of the education
p.000013: institution concerned.
p.000013:
p.000013: No personal data may be recorded in their processing operations on the basis of data provided by third parties. The
p.000013: personal data being processed may only be disclosed to third parties in the context of the application of a
p.000013: provision from an act or ordinance and must not be kept any longer than necessary for the management of
p.000013: the relation with the pupil or student.
p.000013:
p.000013: Art 60. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by municipalities pursuant to the Act of 19 July 1991 on population registers and
p.000013: identity cards and modifying the Act of 8 August 1983 establishing a National Register of
p.000013:
p.000013:
p.000014: 14
p.000014:
p.000014: Unofficial Translation September 2009
p.000014:
p.000014: natural persons, pursuant to electoral legislation and to the legal provisions concerning the records of the registrar.
p.000014:
p.000014: Art 61. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000014: data carried out by administrative authorities if the processing is subject to specific regulations, issued
p.000014: by or under the law, that delineate rules regarding the access, use and collection of the data being processed.
p.000014:
p.000014: Art 62. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000014: data carried out by the social security institutions referred to in articles 1 and 2, first paragraph,
p.000014: 2° of the Act of 15 January 1990 establishing and organizing the Crossroads Bank of Social Security, which aim at the
p.000014: application of social security, provided that these institutions respect the provisions of the aforementioned Act and
p.000014: its implementing decrees when processing data.
p.000014:
p.000014: The Crossroads Bank shall keep the list referred to in article 46, first paragraph, 6°bis of the Act of 15 January
p.000014: 1990 establishing and organizing the Crossroads Bank of Social Security available to the Commission for the
p.000014: Protection of Privacy, pursuant to the conditions agreed to by both parties.
p.000014:
p.000014: On the basis of this list, the Commission for the Protection of Privacy shall update the public register of automatic
p.000014: processing operations referred to in article 18 of the Act.
p.000014:
p.000014: CHAPTER VIII. – Public register of the automatic processing of personal data
p.000014:
p.000014: Art 63. The public register of the automatic processing of personal data referred to in article 18 of the Act,
p.000014: hereafter public register, may be accessed as follows:
p.000014:
p.000014: a) remote direct access using a means of telecommunication;
p.000014: b) on-site direct access, in the offices designated by the Commission for that purpose;
p.000014: c) indirect access by means of a request for an extract, submitted to the Commission.
p.000014:
p.000014: Art 64. For remote direct access the Commission shall make a copy of the public register available on a server that is
p.000014: accessible through the Internet.
p.000014:
p.000014: Besides the modes of access described in the first paragraph, the Commission may suggest other
p.000014: possibilities.
p.000014:
p.000014: Art 65. For on-site direct access, the Commission shall make the necessary offices available during normal office
p.000014: hours, as well as computer appliances equipped with appropriate software, to any individual presenting
p.000014: himself to the Commission in order to access the public register.
p.000014:
p.000015: 15
p.000015:
p.000015: Unofficial Translation September 2009
p.000015:
p.000015:
p.000015:
p.000015: Art 66. Any individual may present himself to the Commission or submit a written request in order to obtain an extract
p.000015: from the public register.
p.000015:
p.000015: This oral or written request for an extract must include at least one of the following elements:
p.000015:
p.000015: 1° the identification number or the name of the processing operation(s) the extract relates to;
p.000015: 2° the complete or abbreviated name of the controller or controllers that must be mentioned in the requested extract;
p.000015: 3° in case of a written request sent by letter, the address to send the extract to.
p.000015:
p.000015: Art 67. If the requested extract from the public register relates to more than ten processing operations
p.000015: and several controllers, or to over one hundred processing operations of the same controller, the
p.000015: Commission may deliver a simplified extract mentioning the identification number, the name and the purpose of every
p.000015: processing operation, as well as the identification number and the name and municipality with its postal code for
p.000015: every controller.
p.000015:
p.000015: In the case described in the first paragraph, the Commission shall inform the requester of the extract of his right to
p.000015: direct access of the public register as well as of the ways in which this right may be exercised.
p.000015:
p.000015: Art 68. Access to the public register shall be free of charge.
p.000015:
p.000015: Art 69. No person can be forced to disclose his reasons for accessing the public register to the
p.000015: Commission, regardless of whether the access is direct or indirect.
p.000015:
p.000015: CHAPTER IX. – Final provisions
p.000015:
p.000015: Art 70. All provisions of the Act of 11 December 1998 shall enter into force on the first day of the sixth month
p.000015: following the Act's month of publication in the Belgian Official Journal.
p.000015:
p.000015: As of that day, all controllers of existing and future processing operations must comply with the
p.000015: provisions of the Act of 11 December 1998.
p.000015:
p.000015: Art 71. The notifications referred to in article 17, § 7 of the Act that made before the date this decree entered into
p.000015: effect shall be considered in accordance with the provisions of the Act and of this decree.
p.000015:
p.000015:
p.000015:
p.000015:
p.000015:
p.000016: 16
p.000016:
p.000016: Unofficial Translation September 2009
p.000016:
p.000016:
p.000016: If the data in the notification referred to in the first paragraph is modified, any controller making a notification in
p.000016: the meaning of article 17, § 7 of the Act shall act in accordance with the stipulations of the Act and of this decree.
p.000016:
p.000016: Art 72. The following Royal Decrees shall be cancelled:
p.000016:
p.000016: 1) Royal Decree nr 1 establishing the date of entry into force of the provisions of the Act of 8 December 1992 on the
p.000016: protection of privacy in relation to the processing of personal data;
p.000016: 2) Royal Decree nr 2 of 28 February 1993 establishing the terms within which the holder of a file must comply with
p.000016: the provisions of the Act of 8 December 1992 on the protection of privacy in relation to the processing of personal
p.000016: data, with regard to existing processing operations at the time those provisions enter into force;
p.000016: 3) Royal Decree of 12 August 1999 implementing article 11, 4° of the Act of 8 December 1992 on the protection of
p.000016: privacy in relation to the processing of personal data;
p.000016: 4) Royal Decree nr 3 of 7 September 1993 designating the individuals to whom the request for disclosure of personal
p.000016: data based on article 10 of the Act of 8 December 1992 on the protection of privacy in relation to the
p.000016: processing of personal data is to be submitted;
p.000016: 5) Royal Decree nr 4 of 7 September 1993 establishing the amount and the conditions for the payment of a preliminary
p.000016: charge for the holder of the file when exercising the right to access personal data pursuant to article 10 of
p.000016: the Act of 8 December 1992 on the protection of privacy in relation to the processing of personal data;
p.000016: 6) Royal Decree nr 5 of 7 September 1993 designating the individuals to whom the requests for access to, deletion or
p.000016: prohibition of the use of personal data based on article 12 of the Act of 8 December 1992 on the protection of privacy
p.000016: in relation to the processing of personal data are to be submitted;
p.000016: 7) Royal Decree nr 8 of 7 February 1995 establishing the purposes, criteria and conditions of authorized
p.000016: processing operations of the data referred to in article 8 of the Act of 8 December 1992 on the protection of privacy
p.000016: in relation to the processing of personal data, modified by Royal Decree nr 17 of 21 November 1996;
p.000016: 8) Royal decree nr 9 of 7 February 1995 on granting exemptions of the application of article 9 of the Act of 8
p.000016: December 1992 on the protection of privacy in relation to the processing of personal data and establishing
p.000016: a procedure of collective information to the individuals certain processing operations relate to, modified by Royal
p.000016: Decree nr 15 of 12 March 1996;
p.000016: 9) Royal Decree nr 12 of 7 March 1995 establishing the fees to be paid to the Commission for the Protection of
p.000016: Privacy upon notification of the processing operations performed on personal data, modified by Royal Decree nr 12bis of
p.000016: 12 March 1996;
p.000016: 10) Royal Decree nr 13 of 12 March 1996 on the conditional exemption from the duty of notification for
p.000016: certain types of automatic processing operations of personal data implying no apparent risk of privacy violation,
p.000016: modified by the Royal Decree of 18 April 1996;
p.000016:
p.000017: 17
p.000017:
...
Social / Incarcerated
Searching for indicator restricted:
(return to top)
p.000004: Section III. – Processing non-encoded personal data
p.000004:
p.000004: Art 18. Prior to the further processing of non-encoded personal data for historical, statistical or
p.000004: scientific purposes, the controller of the further processing shall provide the data subject with the
p.000004: following information:
p.000004:
p.000004: 1° the identity of the controller;
p.000004:
p.000004: 2° the categories of data being processed; 3° the origin of the data;
p.000004: 4° a precise description of the historical, statistical or scientific purposes of the processing;
p.000004:
p.000004:
p.000004:
p.000005: 5
p.000005:
p.000005: Unofficial Translation September 2009
p.000005:
p.000005:
p.000005: 5° the recipients or categories of recipients of the data;
p.000005:
p.000005: 6° the existence the data subject's right to access and rectify his personal data;
p.000005:
p.000005: 7° the existence of the duty to ask the data subject's consent prior to the processing of non-encoded personal data for
p.000005: historical, statistical or scientific purposes.
p.000005:
p.000005: Art 19. Prior to the processing operation the data subject must give his explicit consent to the
p.000005: processing of non-encoded personal data relating to him for historical, statistical or scientific purposes.
p.000005:
p.000005: Art 20. The controller of the further processing of non-encoded personal data for historical, statistical or scientific
p.000005: purposes does not have to comply with the duties imposed by articles 18 and 19 of this decree:
p.000005:
p.000005: 1° if the further processing for historical, statistical or scientific purposes is restricted to non-encoded personal
p.000005: data that have been made public as a result of steps deliberately taken by the data subject or that are closely related
p.000005: to the public character of the data subject or of the facts in which the data subject is or was involved;
p.000005:
p.000005: or
p.000005:
p.000005: 2° if complying with these duties proves impossible or would require a disproportionate effort, and the controller has
p.000005: followed the procedure established in article 21 of this decree.
p.000005:
p.000005: Art 21. Any controller of a further processing operation of non-encoded personal data for historical, statistical or
p.000005: scientific purposes wishing to process the data without informing the data subject in advance or without
p.000005: asking the latter for his consent, shall complete the notification required for this purpose under article 17 of the
p.000005: Act with the following information:
p.000005:
p.000005: 1° a precise description of the historical, statistical or scientific purposes of the processing; 2° the reasons why it
p.000005: is necessary to process non-encoded data;
p.000005: 3° the reasons why the data subject cannot be asked for an informed consent, or the disproportion of the effort
p.000005: required to obtain such consent;
p.000005:
p.000005: 4° the categories of individuals whose non-encoded personal data are being processed;
p.000005:
p.000005: 5° the individuals or categories of individuals having access to the non-encoded data;
p.000005:
p.000006: 6
p.000006:
p.000006: Unofficial Translation September 2009
p.000006:
p.000006:
p.000006:
p.000006: 6° the origin of the data.
p.000006:
p.000006: Within forty-five working days of receipt of the notification, the Commission shall transmit a
p.000006: recommendation to the controller of the further processing, accompanied, if necessary, by any additional
p.000006: conditions to be met for the further processing of the non-encoded data for historical, statistical or
p.000006: scientific purposes.
p.000006:
p.000006: The term established in the second paragraph may be prolonged once by forty-five days. The Commission
p.000006: shall inform the controller of the further processing of the prolongation of the first term prior to its expiry.
p.000006:
p.000006: If the Commission has not given a recommendation upon expiry of the terms referred to in this article, the request
p.000006: shall be considered as granted.
p.000006:
p.000006: The Commission shall publish its recommendation in the register referred to in article 18 of the Act.
p.000006:
p.000006: Art 22. The controller must inform the Commission of any modification to the data he transmitted to it pursuant to
p.000006: article 21 of this decree.
p.000006:
p.000006: Section IV. – Publication of the results of the processing
p.000006:
p.000006: Art 23. The results of the processing for historical, statistical or scientific purposes must not be
p.000006: published in a form identifying the data subject unless:
p.000006:
p.000006: 1° he has given his explicit consent and the privacy of third parties is not violated, or
p.000006:
p.000006: 2° the publication of non-encoded data is restricted to data that has apparently been made public by the data subject
p.000006: or that is closely related to the public character of the data subject or of the facts in which the data subject is or
p.000006: was involved.
p.000006:
p.000006: Section V. – Exception
p.000006:
p.000006: Art 24. Chapter II of this decree does not apply to the services and authorities referred to in article 3,
p.000006: § 4 of the Act that further process personal data for historical, statistical or scientific purposes.
p.000006:
p.000006:
p.000006:
p.000006:
p.000006:
p.000006:
p.000006:
p.000007: 7
p.000007:
p.000007: Unofficial Translation September 2009
p.000007:
p.000007: CHAPTER III. – Conditions for processing the personal data referred to in articles 6 to 8 of the Act
p.000007:
p.000007: Art 25. When processing the personal data referred to in articles 6 to 8 of the Act, the controller must also take the
p.000007: following measures:
p.000007: 1° the categories of individuals having access to the personal data must be designated by the controller
p.000007: or the processor, if any, with a precise description of their function with respect to the data processing operation in
p.000007: question;
p.000007:
p.000007: 2° the controller or the processor, if any, must keep the list of designated individuals available to the Commission;
p.000007:
p.000007: 3° the controller must ensure that the individuals designated respect the confidential nature of the data in question
p.000007: under a legal duty, an obligation laid down in articles of association or an equivalent contractual stipulation;
p.000007:
p.000007: 4° when informing the data subject under article 9 of the Act or in the notification referred to in article 17, § 1 of
...
p.000012: data carried out by a foundation, an association or any other non-profit organization in the course of its normal
p.000012: activities.
p.000012:
p.000012: The processing may only relate to member administration, to individuals the controller regularly enters into contact
p.000012: with or to supporters of the foundation, association or organization.
p.000012:
p.000013: 13
p.000013:
p.000013: Unofficial Translation September 2009
p.000013:
p.000013:
p.000013:
p.000013: No personal data may be recorded in their processing operations on the basis of data provided by third parties. The
p.000013: personal data being processed must not be kept any longer than necessary for member, contact or
p.000013: supporter administration and may only be disclosed to third parties in the framework of the application of a
p.000013: provision from an act or ordinance.
p.000013:
p.000013: Art 57. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of
p.000013: identification data necessary for communication and carried out for the sole purpose of contacting the data subject,
p.000013: provided that the data is not disclosed to third parties and that it is not kept any longer than necessary for the
p.000013: purpose of the processing.
p.000013:
p.000013: The first paragraph of this article only relates to the processing of personal data that is not referred to in another
p.000013: provision of this decree.
p.000013:
p.000013: Art 58. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data that only relates to visitor registration in the context of access control, provided that the data is restricted
p.000013: to the visitor's name and professional address, the identification of his employer, the identification of his vehicle,
p.000013: the name, department and function of the individual being visited and the time of the visit.
p.000013:
p.000013: The personal data may only be used for access control and must not be kept any longer than necessary
p.000013: for that purpose.
p.000013:
p.000013: Art. 59 Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by educational institutions with a view to the management of the relation with their pupils or
p.000013: students.
p.000013:
p.000013: The processing may only relate to personal data of potential, current and former pupils or students of the education
p.000013: institution concerned.
p.000013:
p.000013: No personal data may be recorded in their processing operations on the basis of data provided by third parties. The
p.000013: personal data being processed may only be disclosed to third parties in the context of the application of a
p.000013: provision from an act or ordinance and must not be kept any longer than necessary for the management of
p.000013: the relation with the pupil or student.
p.000013:
p.000013: Art 60. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by municipalities pursuant to the Act of 19 July 1991 on population registers and
p.000013: identity cards and modifying the Act of 8 August 1983 establishing a National Register of
p.000013:
p.000013:
p.000014: 14
p.000014:
...
Social / Police Officer
Searching for indicator police:
(return to top)
p.000010: necessary.
p.000010:
p.000010: Art 42. On-site inspections shall be carried out by the Commission's President or by one or more commissioners
p.000010: designated by him.
p.000010:
p.000010: The inspections of the processing operations of personal data referred to in article 3, § 5, 1° of the Act shall be
p.000010: carried out by magistrates chosen from the Commission members.
p.000010:
p.000010: The President and the commissioners carrying out the inspections can request the assistance of or be represented by one
p.000010: or more members of the Commission's secretariat.
p.000010:
p.000010: Art 43. During the inspection at the service concerned, the Commission shall carry out or order any verification it
p.000010: sees fit.
p.000010:
p.000010: During the on-site inspections referred to in article 3, § 5 of the Act, the Commission may have data rectified or
p.000010: removed, or have data introduced that differ from that processed by the service concerned. It may prohibit
p.000010: the disclosure of the data.
p.000010:
p.000010: During the on-site inspections referred to in article 3, § 5 of the Act, the Commission shall recommend the measures it
p.000010: considers necessary. It shall substantiate its recommendations.
p.000010:
p.000010: Art 44. After the inspections, the service were they were carried out shall inform the Commission of the actions it has
p.000010: undertaken accordingly.
p.000010:
p.000010: Art 45. The Commission shall reply to the data subject's request by letter, within a three-month term starting from the
p.000010: moment the information referred to in article 44 of the decree was supplied.
p.000010:
p.000010: Art 46. If the data subject's request relates to a processing operation carried out by a police service with a view
p.000010: to an identity check, the Commission shall communicate to the data subject that the necessary
p.000010: verifications have been carried out.
p.000010:
p.000010: If necessary, the Commission shall provide the data subject with all other information it sees fit after it has
p.000010: received the opinion of the service concerned.
p.000010:
p.000010:
p.000010:
p.000010:
p.000011: 11
p.000011:
p.000011: Unofficial Translation September 2009
p.000011:
p.000011: CHAPTER VII. – Notification of the automatic processing of personal data Section I. – Fees to be paid to the Commission
p.000011: upon notification
p.000011: Art 47. If the notification referred to in article 17 of the Act is made using the paper form made available
p.000011: by the Commission for that purpose, the amount of the fee payable to the Commission by the controller shall be
p.000011: established at 125 euros or 5042 francs for the notification of all data provided to the Commission by the same
p.000011: controller at the same time.
p.000011:
p.000011: Art 48. If notification is made using the magnetic information carrier made available by the Commission
p.000011: for that purpose, the amount of the fee payable to the Commission shall be established at
p.000011: 25 euros or 1008 francs for the notification of all data provided to the Commission by the same
p.000011: controller at the same time.
p.000011:
p.000011: Art 49. The amount of the fee payable by the controller to the Commission upon simultaneous notification
p.000011: of one or more modifications of the information in his original declaration, shall be established at 20
p.000011: euros or 807 francs.
p.000011:
...
Social / Student
Searching for indicator student:
(return to top)
p.000013: provision of this decree.
p.000013:
p.000013: Art 58. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data that only relates to visitor registration in the context of access control, provided that the data is restricted
p.000013: to the visitor's name and professional address, the identification of his employer, the identification of his vehicle,
p.000013: the name, department and function of the individual being visited and the time of the visit.
p.000013:
p.000013: The personal data may only be used for access control and must not be kept any longer than necessary
p.000013: for that purpose.
p.000013:
p.000013: Art. 59 Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by educational institutions with a view to the management of the relation with their pupils or
p.000013: students.
p.000013:
p.000013: The processing may only relate to personal data of potential, current and former pupils or students of the education
p.000013: institution concerned.
p.000013:
p.000013: No personal data may be recorded in their processing operations on the basis of data provided by third parties. The
p.000013: personal data being processed may only be disclosed to third parties in the context of the application of a
p.000013: provision from an act or ordinance and must not be kept any longer than necessary for the management of
p.000013: the relation with the pupil or student.
p.000013:
p.000013: Art 60. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by municipalities pursuant to the Act of 19 July 1991 on population registers and
p.000013: identity cards and modifying the Act of 8 August 1983 establishing a National Register of
p.000013:
p.000013:
p.000014: 14
p.000014:
p.000014: Unofficial Translation September 2009
p.000014:
p.000014: natural persons, pursuant to electoral legislation and to the legal provisions concerning the records of the registrar.
p.000014:
p.000014: Art 61. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000014: data carried out by administrative authorities if the processing is subject to specific regulations, issued
p.000014: by or under the law, that delineate rules regarding the access, use and collection of the data being processed.
p.000014:
p.000014: Art 62. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000014: data carried out by the social security institutions referred to in articles 1 and 2, first paragraph,
p.000014: 2° of the Act of 15 January 1990 establishing and organizing the Crossroads Bank of Social Security, which aim at the
p.000014: application of social security, provided that these institutions respect the provisions of the aforementioned Act and
p.000014: its implementing decrees when processing data.
p.000014:
p.000014: The Crossroads Bank shall keep the list referred to in article 46, first paragraph, 6°bis of the Act of 15 January
p.000014: 1990 establishing and organizing the Crossroads Bank of Social Security available to the Commission for the
...
Social / education
Searching for indicator education:
(return to top)
p.000013: identification data necessary for communication and carried out for the sole purpose of contacting the data subject,
p.000013: provided that the data is not disclosed to third parties and that it is not kept any longer than necessary for the
p.000013: purpose of the processing.
p.000013:
p.000013: The first paragraph of this article only relates to the processing of personal data that is not referred to in another
p.000013: provision of this decree.
p.000013:
p.000013: Art 58. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data that only relates to visitor registration in the context of access control, provided that the data is restricted
p.000013: to the visitor's name and professional address, the identification of his employer, the identification of his vehicle,
p.000013: the name, department and function of the individual being visited and the time of the visit.
p.000013:
p.000013: The personal data may only be used for access control and must not be kept any longer than necessary
p.000013: for that purpose.
p.000013:
p.000013: Art. 59 Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by educational institutions with a view to the management of the relation with their pupils or
p.000013: students.
p.000013:
p.000013: The processing may only relate to personal data of potential, current and former pupils or students of the education
p.000013: institution concerned.
p.000013:
p.000013: No personal data may be recorded in their processing operations on the basis of data provided by third parties. The
p.000013: personal data being processed may only be disclosed to third parties in the context of the application of a
p.000013: provision from an act or ordinance and must not be kept any longer than necessary for the management of
p.000013: the relation with the pupil or student.
p.000013:
p.000013: Art 60. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by municipalities pursuant to the Act of 19 July 1991 on population registers and
p.000013: identity cards and modifying the Act of 8 August 1983 establishing a National Register of
p.000013:
p.000013:
p.000014: 14
p.000014:
p.000014: Unofficial Translation September 2009
p.000014:
p.000014: natural persons, pursuant to electoral legislation and to the legal provisions concerning the records of the registrar.
p.000014:
p.000014: Art 61. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000014: data carried out by administrative authorities if the processing is subject to specific regulations, issued
p.000014: by or under the law, that delineate rules regarding the access, use and collection of the data being processed.
p.000014:
p.000014: Art 62. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000014: data carried out by the social security institutions referred to in articles 1 and 2, first paragraph,
...
Searching for indicator educational:
(return to top)
p.000013: supporter administration and may only be disclosed to third parties in the framework of the application of a
p.000013: provision from an act or ordinance.
p.000013:
p.000013: Art 57. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of
p.000013: identification data necessary for communication and carried out for the sole purpose of contacting the data subject,
p.000013: provided that the data is not disclosed to third parties and that it is not kept any longer than necessary for the
p.000013: purpose of the processing.
p.000013:
p.000013: The first paragraph of this article only relates to the processing of personal data that is not referred to in another
p.000013: provision of this decree.
p.000013:
p.000013: Art 58. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data that only relates to visitor registration in the context of access control, provided that the data is restricted
p.000013: to the visitor's name and professional address, the identification of his employer, the identification of his vehicle,
p.000013: the name, department and function of the individual being visited and the time of the visit.
p.000013:
p.000013: The personal data may only be used for access control and must not be kept any longer than necessary
p.000013: for that purpose.
p.000013:
p.000013: Art. 59 Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by educational institutions with a view to the management of the relation with their pupils or
p.000013: students.
p.000013:
p.000013: The processing may only relate to personal data of potential, current and former pupils or students of the education
p.000013: institution concerned.
p.000013:
p.000013: No personal data may be recorded in their processing operations on the basis of data provided by third parties. The
p.000013: personal data being processed may only be disclosed to third parties in the context of the application of a
p.000013: provision from an act or ordinance and must not be kept any longer than necessary for the management of
p.000013: the relation with the pupil or student.
p.000013:
p.000013: Art 60. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000013: data carried out by municipalities pursuant to the Act of 19 July 1991 on population registers and
p.000013: identity cards and modifying the Act of 8 August 1983 establishing a National Register of
p.000013:
p.000013:
p.000014: 14
p.000014:
p.000014: Unofficial Translation September 2009
p.000014:
p.000014: natural persons, pursuant to electoral legislation and to the legal provisions concerning the records of the registrar.
p.000014:
p.000014: Art 61. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000014: data carried out by administrative authorities if the processing is subject to specific regulations, issued
p.000014: by or under the law, that delineate rules regarding the access, use and collection of the data being processed.
p.000014:
...
Social / philosophical differences/differences of opinion
Searching for indicator opinion:
(return to top)
p.000001: Unofficial Translation September 2009
p.000001:
p.000001: 13 FEBRUARY 2001 – Royal Decree implementing the Act of 8 December 1992 on the protection of privacy in
p.000001: relation to the processing of personal data
p.000001:
p.000001: Unofficial translation – September 2009
p.000001:
p.000001: ALBERT II, King of Belgians,
p.000001: Greetings to all who have and shall come before us.
p.000001:
p.000001: Whereas the Act of 8 December 1992 on the protection of privacy in relation to the processing of personal data,
p.000001: modified by the Act of 11 December 1998 transposing Directive 95/46/EC of 24 October 1995 of the European
p.000001: Parliament and the Council on the protection of individuals with regard to the processing of personal data and on the
p.000001: free movement of such data, and particularly articles 4,
p.000001: § 1, 2° and 5°; 6, § 2, first paragraph, a), and g); 6, § 4; 7, § 2, a) and k); 7, § 3; 8, § 4, e); 8, § 4;
p.000001: 9, § 1, e); 9, § 2, first paragraph, e); 9, § 2, third paragraph; 10, § 1, second and fourth paragraph;
p.000001: 12, § 2; 13, second and fourth paragraph; 17, §§ 8 and 9, and 18, third paragraph; Whereas article 52 of the Act of 11
p.000001: December 1998;
p.000001: Whereas opinions nr 08/99 of 8 March 1999 and 25/99 of 23 June 1999 of the Commission for the Protection of the
p.000001: Privacy;
p.000001: Whereas the opinion of the Inspector of Finance, issued on 9 April 1999; Whereas the agreement of the Minister of
p.000001: Budget, signed on 28 May 1999; Whereas the decision of the Council of Ministers;
p.000001: Whereas the Council of State's opinions of 21 June 1999 and 8 November 2000;
p.000001: As proposed by Our Minister of Justice and having received our Ministers' opinion after they met as a Council,
p.000001: We have decided:
p.000001:
p.000001:
p.000001: CHAPTER I. – Definitions
p.000001:
p.000001: Article 1. For the purposes of the application of this decree:
p.000001:
p.000001: 1° "the Act" means the Act of 8 December 1992 on the protection of privacy in relation to the
p.000001: processing of personal data;
p.000001: 2° "the Commission" means the Commission for the Protection of Privacy;
p.000001: 3° "encoded personal data" means personal data that can only be related to an identified or identifiable
p.000001: person by means of a code;
p.000001: 4° "non-encoded personal data" means data other than encoded personal data;
p.000001: 5° "anonymous data" means data that cannot be related to an identified or identifiable person and that is consequently
p.000001: not personal data;
p.000001:
p.000001:
p.000001: 1
p.000001:
p.000001: Unofficial Translation September 2009
p.000001:
p.000001:
p.000001: 6° "intermediary organization" means any natural person, legal person, un-associated organization or public authority,
p.000001: other than the controller of the processing of non-encoded data, encoding the aforementioned data.
p.000001:
p.000001: CHAPTER II. – The further processing of personal data for historical, statistical or scientific purposes Section I. –
p.000001: General Principles
p.000001: Art 2. The further processing of personal data for historical, statistical or scientific purposes shall be considered
p.000001: compliant with article 4, § 2, 1°, second sentence of the Act if it is carried out under the conditions set forth in
p.000001: this chapter.
p.000001:
...
p.000010: carried out by magistrates chosen from the Commission members.
p.000010:
p.000010: The President and the commissioners carrying out the inspections can request the assistance of or be represented by one
p.000010: or more members of the Commission's secretariat.
p.000010:
p.000010: Art 43. During the inspection at the service concerned, the Commission shall carry out or order any verification it
p.000010: sees fit.
p.000010:
p.000010: During the on-site inspections referred to in article 3, § 5 of the Act, the Commission may have data rectified or
p.000010: removed, or have data introduced that differ from that processed by the service concerned. It may prohibit
p.000010: the disclosure of the data.
p.000010:
p.000010: During the on-site inspections referred to in article 3, § 5 of the Act, the Commission shall recommend the measures it
p.000010: considers necessary. It shall substantiate its recommendations.
p.000010:
p.000010: Art 44. After the inspections, the service were they were carried out shall inform the Commission of the actions it has
p.000010: undertaken accordingly.
p.000010:
p.000010: Art 45. The Commission shall reply to the data subject's request by letter, within a three-month term starting from the
p.000010: moment the information referred to in article 44 of the decree was supplied.
p.000010:
p.000010: Art 46. If the data subject's request relates to a processing operation carried out by a police service with a view
p.000010: to an identity check, the Commission shall communicate to the data subject that the necessary
p.000010: verifications have been carried out.
p.000010:
p.000010: If necessary, the Commission shall provide the data subject with all other information it sees fit after it has
p.000010: received the opinion of the service concerned.
p.000010:
p.000010:
p.000010:
p.000010:
p.000011: 11
p.000011:
p.000011: Unofficial Translation September 2009
p.000011:
p.000011: CHAPTER VII. – Notification of the automatic processing of personal data Section I. – Fees to be paid to the Commission
p.000011: upon notification
p.000011: Art 47. If the notification referred to in article 17 of the Act is made using the paper form made available
p.000011: by the Commission for that purpose, the amount of the fee payable to the Commission by the controller shall be
p.000011: established at 125 euros or 5042 francs for the notification of all data provided to the Commission by the same
p.000011: controller at the same time.
p.000011:
p.000011: Art 48. If notification is made using the magnetic information carrier made available by the Commission
p.000011: for that purpose, the amount of the fee payable to the Commission shall be established at
p.000011: 25 euros or 1008 francs for the notification of all data provided to the Commission by the same
p.000011: controller at the same time.
p.000011:
p.000011: Art 49. The amount of the fee payable by the controller to the Commission upon simultaneous notification
p.000011: of one or more modifications of the information in his original declaration, shall be established at 20
p.000011: euros or 807 francs.
p.000011:
p.000011: Art 50. The controller shall pay the fees referred to in this section using the documents made
p.000011: available by the Commission for that purpose.
p.000011:
p.000011: Section II. – Categories of processing operations exempt from the duty of notification
p.000011:
p.000011: Art 51. Except for §§ 4 and 8, the provisions of article 17 of the Act do not apply to the processing of personal data
...
General/Other / Dependent
Searching for indicator dependent:
(return to top)
p.000007: or the processor, if any, with a precise description of their function with respect to the data processing operation in
p.000007: question;
p.000007:
p.000007: 2° the controller or the processor, if any, must keep the list of designated individuals available to the Commission;
p.000007:
p.000007: 3° the controller must ensure that the individuals designated respect the confidential nature of the data in question
p.000007: under a legal duty, an obligation laid down in articles of association or an equivalent contractual stipulation;
p.000007:
p.000007: 4° when informing the data subject under article 9 of the Act or in the notification referred to in article 17, § 1 of
p.000007: the Act, the controller must mention the act or regulation authorizing the processing of the personal data referred to
p.000007: in articles 6 to 8 of the Act.
p.000007:
p.000007: Art 26. If the processing of the personal data referred to in articles 6 and 7 of the Act is only
p.000007: authorized with the data subject's written consent, the controller must inform the latter of the reasons for the
p.000007: processing and provide him with the list of the categories of individuals having access to the personal data in
p.000007: addition to the data that must be supplied by virtue of article 9.
p.000007:
p.000007: Art 27. If the processing of the personal data referred to in articles 6 and 7 of the Act is only
p.000007: authorized with the data subject's written consent, such processing shall be prohibited if the controller is the data
p.000007: subject's current or potential employer or if the data subject is in a dependent position with respect to the
p.000007: controller, preventing the former from giving his free consent.
p.000007:
p.000007: This prohibition shall be lifted when the processing is intended for the benefit of the data subject.
p.000007:
p.000007: CHAPTER IV. – Conditions for exemption from the duty of information referred to in article 9, § 2 of the Act
p.000007:
p.000007: Art 28. The controller of a further processing operation of personal data for historical, statistical or scientific
p.000007: purposes who processes encoded data only shall be exempt from the duty to inform the data subject referred to in
p.000007: article 9, § 2 of the Act provided that the conditions set forth in Chapter II, Section II of this decree have been
p.000007: met.
p.000007:
p.000007:
p.000008: 8
p.000008:
p.000008: Unofficial Translation September 2009
p.000008:
p.000008:
p.000008: Art 29. Any administrative authority that has the explicit task of gathering and encoding personal data by or
p.000008: under the law, and that is subject to specific measures laid down by or under the law for the purpose of protecting
p.000008: privacy in this process, shall be exempt from the duty of information referred to in article 9, § 2 of the
p.000008: Act if it acts as an intermediary organization.
p.000008:
p.000008: Art 30. Except for the cases described in articles 28 and 29 of this decree, any controller invoking an exemption from
p.000008: the duty of information referred to in article 9, § 2 of the Act, because informing the data subject proves
p.000008: impossible or would involve a disproportionate effort, shall provide the aforementioned information at the
p.000008: time of his first contact with the data subject.
p.000008:
...
General/Other / Relationship to Authority
Searching for indicator authority:
(return to top)
p.000001: Privacy;
p.000001: Whereas the opinion of the Inspector of Finance, issued on 9 April 1999; Whereas the agreement of the Minister of
p.000001: Budget, signed on 28 May 1999; Whereas the decision of the Council of Ministers;
p.000001: Whereas the Council of State's opinions of 21 June 1999 and 8 November 2000;
p.000001: As proposed by Our Minister of Justice and having received our Ministers' opinion after they met as a Council,
p.000001: We have decided:
p.000001:
p.000001:
p.000001: CHAPTER I. – Definitions
p.000001:
p.000001: Article 1. For the purposes of the application of this decree:
p.000001:
p.000001: 1° "the Act" means the Act of 8 December 1992 on the protection of privacy in relation to the
p.000001: processing of personal data;
p.000001: 2° "the Commission" means the Commission for the Protection of Privacy;
p.000001: 3° "encoded personal data" means personal data that can only be related to an identified or identifiable
p.000001: person by means of a code;
p.000001: 4° "non-encoded personal data" means data other than encoded personal data;
p.000001: 5° "anonymous data" means data that cannot be related to an identified or identifiable person and that is consequently
p.000001: not personal data;
p.000001:
p.000001:
p.000001: 1
p.000001:
p.000001: Unofficial Translation September 2009
p.000001:
p.000001:
p.000001: 6° "intermediary organization" means any natural person, legal person, un-associated organization or public authority,
p.000001: other than the controller of the processing of non-encoded data, encoding the aforementioned data.
p.000001:
p.000001: CHAPTER II. – The further processing of personal data for historical, statistical or scientific purposes Section I. –
p.000001: General Principles
p.000001: Art 2. The further processing of personal data for historical, statistical or scientific purposes shall be considered
p.000001: compliant with article 4, § 2, 1°, second sentence of the Act if it is carried out under the conditions set forth in
p.000001: this chapter.
p.000001:
p.000001: The storage of personal data for historical, statistical or scientific purposes, as referred to in article 4,
p.000001: § 1, 5° second sentence of the Act, is authorized under the conditions set forth in this chapter.
p.000001:
p.000001: Art 3. The further processing of personal data for historical, statistical or scientific purposes shall take place
p.000001: using anonymous data.
p.000001:
p.000001: Art 4. If it is impossible to achieve the historical, statistical or scientific purposes using anonymous data for the
p.000001: further processing, the controller of the further processing for historical, statistical or scientific
p.000001: purposes may process encoded data pursuant to the provisions of section 2 of this chapter.
p.000001:
p.000001: In that case he shall mention in the notification of the processing, which he shall make pursuant to article 17 of the
p.000001: Act, the reasons why it is impossible to achieve the historical, statistical or scientific purposes using anonymous
p.000001: data for the further processing.
p.000001:
p.000001: Art 5. If it is impossible to achieve the historical, statistical or scientific purposes using encoded data for the
p.000001: further processing, the controller of the further processing for historical, statistical or scientific purposes may
...
p.000003: processing produces a receipt of complete notification, issued by the Commission pursuant to article 17, § 2 of the
p.000003: Act.
p.000003:
p.000003: Art 14. Prior to the encoding of the data referred to in articles 6 to 8 of the Act, the controller of a processing
p.000003: operation of personal data collected for specified, explicit and legitimate purposes or the intermediary organization
p.000003: must provide the data subject with the following information:
p.000003:
p.000003: • the identity of the controller;
p.000003: • the categories of data being processed;
p.000003: • the origin of the data;
p.000003: • a precise description of the historical, statistical or scientific purposes of the processing;
p.000003: • the recipients or categories of recipients of the data;
p.000003: • the existence of the data subject's right to access and rectify his personal data;
p.000003: • the existence of the data subject's right to object.
p.000003:
p.000003: Art 15. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000003: purposes and the intermediary organization do not have to comply with the duty imposed by article 14 of this decree if
p.000003: this duty proves impossible or would involve a disproportionate effort, and if they have followed the procedure
p.000003: established by article 16 of this decree.
p.000003:
p.000003: Art 16. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000003: purposes or the intermediary organization do not have to comply with the duty imposed by article 14 if the intermediary
p.000003: organization is an administrative authority having the explicit task, by or under the law, of gathering and encoding
p.000003: personal data, and if it is subject to specific measures laid down by or under the law in order to protect privacy in
p.000003: this process.
p.000003:
p.000003: Art 16. The controller of a processing operation of personal data collected for specified, explicit and legitimate
p.000003: purposes or the intermediary organization wishing to encode the data referred to in articles
p.000003: 6 to 8 of the Act without informing the data subject in advance, shall complete the compulsory
p.000003: notification under article 17 of the Act with the following information:
p.000003:
p.000003: 1° a precise description of the historical, statistical or scientific purposes of the processing;
p.000003:
p.000003: 2° the reasons justifying the processing of the personal data referred to in articles 6 to 8 of the Act;
p.000003:
p.000003: 3° the reasons why the data mentioned in article 14 cannot be communicated to the data subject or the disproportion of
p.000003: the effort to do so;
p.000003:
p.000003:
p.000004: 4
p.000004:
p.000004: Unofficial Translation September 2009
p.000004:
p.000004:
p.000004:
p.000004: 4° the categories of persons whose personal data mentioned in articles 6 to 8 of the Act are being processed;
p.000004:
p.000004: 5° the individuals or categories of individuals having access to the personal data; 6° the origin of the data.
p.000004: Within forty-five working days of receipt of the notification, the Commission shall transmit a
p.000004: recommendation to the controller or the intermediary organization, accompanied, if necessary, by additional
...
p.000007: authorized with the data subject's written consent, the controller must inform the latter of the reasons for the
p.000007: processing and provide him with the list of the categories of individuals having access to the personal data in
p.000007: addition to the data that must be supplied by virtue of article 9.
p.000007:
p.000007: Art 27. If the processing of the personal data referred to in articles 6 and 7 of the Act is only
p.000007: authorized with the data subject's written consent, such processing shall be prohibited if the controller is the data
p.000007: subject's current or potential employer or if the data subject is in a dependent position with respect to the
p.000007: controller, preventing the former from giving his free consent.
p.000007:
p.000007: This prohibition shall be lifted when the processing is intended for the benefit of the data subject.
p.000007:
p.000007: CHAPTER IV. – Conditions for exemption from the duty of information referred to in article 9, § 2 of the Act
p.000007:
p.000007: Art 28. The controller of a further processing operation of personal data for historical, statistical or scientific
p.000007: purposes who processes encoded data only shall be exempt from the duty to inform the data subject referred to in
p.000007: article 9, § 2 of the Act provided that the conditions set forth in Chapter II, Section II of this decree have been
p.000007: met.
p.000007:
p.000007:
p.000008: 8
p.000008:
p.000008: Unofficial Translation September 2009
p.000008:
p.000008:
p.000008: Art 29. Any administrative authority that has the explicit task of gathering and encoding personal data by or
p.000008: under the law, and that is subject to specific measures laid down by or under the law for the purpose of protecting
p.000008: privacy in this process, shall be exempt from the duty of information referred to in article 9, § 2 of the
p.000008: Act if it acts as an intermediary organization.
p.000008:
p.000008: Art 30. Except for the cases described in articles 28 and 29 of this decree, any controller invoking an exemption from
p.000008: the duty of information referred to in article 9, § 2 of the Act, because informing the data subject proves
p.000008: impossible or would involve a disproportionate effort, shall provide the aforementioned information at the
p.000008: time of his first contact with the data subject.
p.000008:
p.000008: If the controller referred to in the first paragraph discloses the personal data to a third party, the latter
p.000008: shall provide the information referred to in article 9, § 2 of the Act to the data subject at the time of their first
p.000008: contact.
p.000008:
p.000008: Art 31. Any controller unable to inform the data subject because this proves impossible or would involve a
p.000008: disproportionate effort, shall mention this in the notification he makes to the Commission under article 17 of the Act.
p.000008:
p.000008: The Commission shall publish the list of controllers in the public register described in article 18 of the Act and
p.000008: shall mention the reasons justifying the exemption.
p.000008:
p.000008: CHAPTER V. – Exercise of the rights referred to in articles 10 and 12 of the Act
p.000008:
p.000008: Art 32 Under the conditions laid down by law any individual proving his identity has the right to
...
p.000009:
p.000009:
p.000009: Art 34. If personal data is collected from the data subject in writing, the controller shall use the
p.000009: document he collects the data with to ask the data subject whether he wishes to exercise the right to object provided
p.000009: for by article 12, § 1, third paragraph of the Act.
p.000009:
p.000009: If the personal data is collected from the data subject otherwise than in writing, the controller shall ask the data
p.000009: subject whether he wishes to exercise the right to object provided by article 12, § 1, third paragraph of the Act. The
p.000009: data subject can object on a document the controller provides him with, at the latest two months after the personal
p.000009: data was collected, or using any technical means making it possible to prove that he was offered the possibility to
p.000009: object.
p.000009:
p.000009: Art 35. If the personal data is not collected from the data subject, any controller who is subject to article 9, § 2,
p.000009: c) of the Act, shall ask the data subject in writing whether he wishes to exercise the right to object provided by
p.000009: article 12, § 1, third paragraph of the Act.
p.000009:
p.000009: CHAPTER VI. – Exercise of the right referred to in article 13 of the Act
p.000009:
p.000009: Art 36. This chapter establishes the procedure for the submission of requests under article 13 of the Act.
p.000009:
p.000009: Art 37. The data subject must submit the request to the Commission by means of a dated and signed letter mentioning
p.000009: his surname, first name, date of birth and nationality, and include a copy of his identity card, passport or
p.000009: any equivalent document.
p.000009:
p.000009: The request shall also mention the following information, provided that it is known to the requester:
p.000009:
p.000009: - the name of the authority or service involved;
p.000009: - all relevant elements regarding the data under discussion, such as its nature, the
p.000009: circumstances or the reasons for accessing the data, as well as possible rectifications.
p.000009:
p.000009: Art 38. If the Commission considers it useful, it may ask the data subject for additional information.
p.000009:
p.000009: Art 39. If the data referred to in articles 37 and 38 of this decree is not provided, the request may be declared
p.000009: inadmissible.
p.000009:
p.000009: Art 40. The request shall be inadmissible if it is submitted within a one-year term starting from the date the
p.000009: Commission's previous answer regarding the same data and the same services was sent.
p.000009:
p.000009: This term may be deviated from, if the data subject submits reasons justifying such deviation in his request.
p.000009:
p.000010: 10
p.000010:
p.000010: Unofficial Translation September 2009
p.000010:
p.000010:
p.000010:
p.000010: Art 41. If the request is considered inadmissible, the data subject shall be informed of that fact by letter.
p.000010: This letter shall mention that the data subject may be heard upon request, in the presence of his counsellor if
p.000010: necessary.
p.000010:
p.000010: Art 42. On-site inspections shall be carried out by the Commission's President or by one or more commissioners
p.000010: designated by him.
p.000010:
p.000010: The inspections of the processing operations of personal data referred to in article 3, § 5, 1° of the Act shall be
p.000010: carried out by magistrates chosen from the Commission members.
p.000010:
p.000010: The President and the commissioners carrying out the inspections can request the assistance of or be represented by one
p.000010: or more members of the Commission's secretariat.
p.000010:
...
p.000016: a procedure of collective information to the individuals certain processing operations relate to, modified by Royal
p.000016: Decree nr 15 of 12 March 1996;
p.000016: 9) Royal Decree nr 12 of 7 March 1995 establishing the fees to be paid to the Commission for the Protection of
p.000016: Privacy upon notification of the processing operations performed on personal data, modified by Royal Decree nr 12bis of
p.000016: 12 March 1996;
p.000016: 10) Royal Decree nr 13 of 12 March 1996 on the conditional exemption from the duty of notification for
p.000016: certain types of automatic processing operations of personal data implying no apparent risk of privacy violation,
p.000016: modified by the Royal Decree of 18 April 1996;
p.000016:
p.000017: 17
p.000017:
p.000017: Unofficial Translation September 2009
p.000017:
p.000017: 11) Royal Decree nr 14 of 22 May 1996 establishing the purposes, criteria and conditions for the authorized processing
p.000017: of the data referred to in article 6 of the Act of 8 December 1992 on the protection of privacy in relation to the
p.000017: processing of personal data.
p.000017:
p.000017: Art 73. This decree shall enter into force on the first day of the sixth month following the decree's
p.000017: month of publication in the Belgian Official Journal.
p.000017:
p.000017: Art 74. Our Minister of Justice is in charge of implementing this decree.
p.000017:
p.000017: Issued in Brussels, 13 February 2001.
p.000017:
p.000017: ALBERT
p.000017: Under Royal Authority: The Minister of Justice,
p.000017: M. VERWILGHEN
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
p.000017:
...
Orphaned Trigger Words
p.000011: for that purpose, the amount of the fee payable to the Commission shall be established at
p.000011: 25 euros or 1008 francs for the notification of all data provided to the Commission by the same
p.000011: controller at the same time.
p.000011:
p.000011: Art 49. The amount of the fee payable by the controller to the Commission upon simultaneous notification
p.000011: of one or more modifications of the information in his original declaration, shall be established at 20
p.000011: euros or 807 francs.
p.000011:
p.000011: Art 50. The controller shall pay the fees referred to in this section using the documents made
p.000011: available by the Commission for that purpose.
p.000011:
p.000011: Section II. – Categories of processing operations exempt from the duty of notification
p.000011:
p.000011: Art 51. Except for §§ 4 and 8, the provisions of article 17 of the Act do not apply to the processing of personal data
p.000011: relating exclusively to data that is necessary for the payroll administration of individuals employed by or working
p.000011: for the controller, provided that the data is only used for that payroll administration, that it is only
p.000011: disclosed to the recipients who are entitled to it and that it is not stored any longer than necessary for the purposes
p.000011: of the processing.
p.000011:
p.000011: Art 52. Except for §§4 and 8, the provisions of article 17 of the Act do not apply to the processing of personal data
p.000011: relating exclusively to data that is necessary for the personnel administration of individuals employed by
p.000011: or working for the controller.
p.000011:
p.000011: The processing must not involve personal data regarding the data subject's health, nor sensitive or judicial data in
p.000011: the meaning of articles 6 and 8 of the Act, nor data aiming at an assessment of the individual.
p.000011:
p.000011: The personal data being processed must not be kept any longer than necessary for personnel administration
p.000011: and may only be disclosed to third parties in the context of the application of a
p.000011:
p.000012: 12
p.000012:
p.000012: Unofficial Translation September 2009
p.000012:
p.000012:
p.000012: provision from an act or ordinance, or whenever necessary to achieve the objectives of the processing.
p.000012:
p.000012: Art 53. Except for §§ 4 and 8, the provisions of article 17 of the Act do not apply to the processing of personal data
p.000012: relating only to the controller's accounting, provided that the data is only used for accounting
p.000012: purposes, that the processing only relates to individuals whose data is necessary for those purposes and that the
p.000012: personal data is not kept any longer than necessary for accounting purposes.
p.000012: The data being processed may only be disclosed to third parties in the framework of the application of a provision from
p.000012: an act or ordinance, or whenever necessary for accounting purposes.
p.000012:
p.000012: Art 54. Except for §§ 4 and 8, the provisions of article 17 of the Act do not apply to the processing of personal data
p.000012: relating only to partner and shareholder administration, provided that the processing only relates to data needed for
p.000012: such administration, that the data only relates to individuals whose data is needed for such administration, that the
p.000012: data is not disclosed to third parties, except in the framework of the application of a provision from an act or
p.000012: ordinance, and that the personal data is not kept any longer than necessary for the purposes of the processing.
p.000012:
p.000012: Art 55. Except for §§ 4 and 8, the provisions of article 17 of the Act do not apply to the processing of personal data
p.000012: relating only to the controller's customer or supplier management.
p.000012:
p.000012: The processing may only relate to the controller's potential, current and former customers or suppliers.
p.000012:
p.000012: The processing must not relate to personal data regarding the data subject's health, nor to sensitive or judicial data
p.000012: in the meaning of articles 6 and 8 of the Act.
p.000012:
p.000012: In the context of customer administration personal data must not be recorded in a data processing operation on the
p.000012: basis of data provided by third parties.
p.000012:
p.000012: The data must not be kept any longer than necessary for the controller's normal company management and
p.000012: may only be disclosed to third parties in the context of the application of a provision from an act or ordinance, or
p.000012: for the purposes of normal company management.
p.000012:
p.000012: Art 56. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of personal
p.000012: data carried out by a foundation, an association or any other non-profit organization in the course of its normal
p.000012: activities.
p.000012:
p.000012: The processing may only relate to member administration, to individuals the controller regularly enters into contact
p.000012: with or to supporters of the foundation, association or organization.
p.000012:
p.000013: 13
p.000013:
p.000013: Unofficial Translation September 2009
p.000013:
p.000013:
p.000013:
p.000013: No personal data may be recorded in their processing operations on the basis of data provided by third parties. The
p.000013: personal data being processed must not be kept any longer than necessary for member, contact or
p.000013: supporter administration and may only be disclosed to third parties in the framework of the application of a
p.000013: provision from an act or ordinance.
p.000013:
p.000013: Art 57. Except for §§ 4 and 8, the provisions of article 17 of the Act shall not apply to the processing of
p.000013: identification data necessary for communication and carried out for the sole purpose of contacting the data subject,
...
Appendix
Indicator List
| Indicator | Vulnerability |
|---|
| access | Access to Social Goods |
| authority | Relationship to Authority |
| dependent | Dependent |
| education | education |
| educational | education |
| opinion | philosophical differences/differences of opinion |
| party | political affiliation |
| police | Police Officer |
| restricted | Incarcerated |
| student | Student |
Indicator Peers (Indicators in Same Vulnerability)
| Indicator | Peers |
|---|
| education | ['educational'] |
| educational | ['education'] |
Trigger Words
consent
justice
protect
protection
risk
sensitive
Applicable Type / Vulnerability / Indicator Overlay for this Input