The Belgian Constitution
recognizes the right of privacy and private communications.Article 22 states, "Everyone has the right to the respect of
his private and family life, except in the cases and conditions determined by
law. . .The laws, decrees, and rulings alluded to in Article 134 guarantee the
protection of this right." Article 29 states, "The confidentiality of
letters is inviolable. . .The law determines which nominated representatives
can violate the confidentiality of letters entrusted to the postal
service." Article 22 was added to the Belgian Constitution in 1994. Prior
to the constitutional amendment, the Cour
de cassation ruled that Article 8 of the European Convention applied
directly to the law and prohibited government infringement on the private life
of individuals.
The Data Protection Act of 1992
governs the processing and use of personal information in Belgium. Amending
legislation to update the 1992 Act and make it consistent with the European
Union (EU) Data Protection Directive was approved by the Parliament in December
1998.A Royal Decree (Arrêté royal)
to implement the Act was approved in July 2000. The Decree, as a whole, broadens the scope of application of
the law by extending the definition of "processing," determines how
special categories of data may be processed, and reinforces data subjects'
rights. The Decree was finally adopted in February
2001, and the law came into effect in September 2001. Two months after the
entry into force of the new data protection regime, the government announced
that it had put in place an Observatoire
des droits de l'Internet (the Internet Rights Observatory) in order to better assess and analyze the impact of the Internet on
the economy and consumer protection. The Observatory aims, through its
composition, at being an open forum for all Internet stakeholders, and will issue
advisory opinions and annual reports, organize a dialogue between economic
actors, and inform the public. In 2004, The Observatory released reports on e-commerce and e-government. A recent survey found out that, while 90 percent of Belgian web
sites collect personal data, 55 percent of them display a privacy policy,
although some of those policies are unclear, incomplete and hard to find on the
site.
The Commission de la protection de la vie privée
(the data protection authority, or Commission) oversees the law. The statute of the Commission has changed
since 2004 to make it directly depend on the Parliament instead of the Ministry
of Justice. The Commission
investigates complaints, issues opinions and maintains the registry of personal
files. In 2003, the Commission answered 655 complaints and requests for
information. That number has reached 355 as of the end of June 2004. The number of public requests also increased from about 6,200 in
1999 to about 7,400 in 2001. The Commission has issued in the last four years a
number of recommendations relating to workplace privacy, video surveillance, the compatibility of the ten-yearly census survey with the Belgian
privacy regulations, the protection of privacy in the context of electronic commerce, the regulation of direct marketing under the data protection legal
framework, the recording by banks of their customers' telephone
communications, the use of electronic communications for electoral advertising
purposes, etc. As of June 2004, there are 32 permanent staff members, compared to 19 in 2001 and 28 in 2000.
In 2002, the Commission was
asked to assess whether the upload on the Internet of a "black list"
of renters by the Syndicat National des
Propriétaires (National Association of Property Owners) was legal. In its
opinion, the data protection authority found the database illegal under the
1998 Data Protection Act, and that it required prior legislative action to
authorize it – if it were to be authorized – and determine the conditions of access.
After opening a "boîte à spam" (spam mailbox) for
three months at the end of 2002 to store the unsolicited commercial e-mails
spontaneously forwarded by Belgian Internet users, the Commission released a
study on "spam" in July 2003 which assesses the phenomenon of spam in
Belgium. The Commission found out that most of the e-mails come from abroad –
mainly from the United States – and details the measures it has taken to combat
illegal spam. The report also outlines spammers' obligations under the Data
Protection Act of 1998 and provides legal and practical advice for data
subjects receiving unsolicited commercial e-mails. Since 2003, the use of e-mails for marketing purposes is prohibited
without the prior, free, specific and informed consent of the recipients, in
compliance with the EU Directive on Electronic Commerce, transposed by the Law of March 11, 2003, and with the EU Electronic Communications and Privacy Directive.
In 2004, the Commission ruled
that disclosures of passenger name records (PNR) by airline companies to the US
government without passengers' consent are illegal (on the complaint of data
subjects, including a Member of the European Parliament)
Surveillance of communications
is regulated under a 1994 law. Prior to its enactment, there was no specific law. The law requires
permission of a juge d'instruction
before wiretapping can take place. Orders are limited to a period of one month.
There were 114 orders issued in 1996, and, reportedly, around 1,000 in 2002.The law was amended in 1997 to remove restrictions on encryption. The Parliament also amended the law in 1998 to require greater assistance from telecommunications carriers and
to give the juge d'instruction and
the Attorney General ("Procureur du Roi") more powers. The juge d'instruction now has the authority to request the cooperation
of experts or network managers to help decrypt telecommunications messages
which have been intercepted. The experts, network managers, etc. cannot refuse
providing cooperation; criminal sanctions are possible in cases of refusal. The
law also provides that telecommunications network operators and
telecommunications service providers have to record and store calling data
("données d'appel") and
telecommunications services subscribers' identification data for future law
enforcement authorities' needs during a minimum period of 12 months. The law is
very vague as to the duration of data retention ("a certain time")
and would not prevent an implementing decree from increasing this period for
much longer. The Belgian police are officially in favor of a three-year general
retention policy. In 2003, a new royal decree was enacted to implement the June 10,
1998 Law to provide more details about the practical and technical measures
that telecommunications network and service providers have to comply with to
cooperate with law enforcement authorities.
The Council of Ministers is
currently working on the second version of a bill (avant-projet de loi relatif aux communications électroniques) that aims at transposing into Belgian law the EU "telecom
package," a set of six directives that establish a new legal framework for
electronic communications in the EU. This package includes the EU Directive on
Privacy and Electronic Communications. The Commission issued a positive opinion
on the part of the bill covering the protection of personal data in which it
discussed the security of networks and telecommunications services, the
confidentiality of communications, the retention of traffic data, the surveillance
of communications, and cookies and spyware. The Conseil d'Etat (State
Council) and the Institut belge des
services postaux et télécommunications (Belgian Institute for Postal
Services and Telecommunications, or IBPT) were also consulted.
In November 2000, the Belgian
Parliament enacted a Computer Crime Law. The law creates four new crimes: computer forgery ("faux en informatique"), computer
fraud ("fraude informatique"),
hacking, and sabotage of computer data ("sabotage de données informatiques"). Recent case law tends to
temper the harshness of some provisions of the new law.
In December 1999 the Commission
had issued an opinion on the Computer Crime Bill, in which it raised serious
concerns about its potential negative impact on the protection of privacy. It
recommended certain amendments to the Bill including the establishment of a
"police monitoring system," which would report back to the
Commission, and a three-year review provision. These suggestions were not included in the law, and the data
retention provision even goes against the Commission's official opinion.
However, the law provides that the Privacy Commission's opinion is mandatory
before any royal decree is enacted on the issue of data retention.
Almost unnoticed, a law, enacted
in December 2001, bans anonymity for subscribers and users of
telecommunications network operators and services providers, while the
application of the law is, however, subject to a proportionality requirement. A
royal decree may prohibit the exploitation of telecommunications services if
they render the identification of the caller impossible, or otherwise make it
difficult to track, monitor, wiretap, or record communications. With this new
rule, the government can now prohibit any telecommunications service that
hinders the application of the wiretapping laws.
After almost a year of
negotiations, a national collective labor organization of employers and
employees' representatives (the Conseil
national du travail) could eventually agree on common rules regulating the
electronic surveillance of workers' computers in the workplace. The common
agreement (called convention collective
de travail or CCT) has entered into force on June 29, 2002 through a royal
decree and applies to all employers and employees in the country. It
provides for rules implementing to the specific setting of the workplace the
already existing and enforceable European and Belgian general data
protection regulations, by ensuring the workers of fairness, information, and
compliance with the basic data processing principles of proportionality,
purpose specification, and transparency. The data protection authority had released earlier an opinion on the same topic in which it refers to the general principles
applicable: a general prohibition of the interception of telecommunications,
proportionality and transparency, balance of the interests and limited storage
of personal data. Also in the field of workplace privacy, another CCT was
released in 1998 to regulate the surveillance of workers by video surveillance
cameras.
In August 2002, a new law was
enacted that better protects patients' privacy rights by giving them, e.g., the right to be clearly informed
about their health state, to consent to any medical interventions, and to have
access to their medical files.
There are also laws relating to
consumer credit, social security, electoral rolls,the national ID number, professional secrets, and employee rights.
From the end of 2000, IFPI
Belgium, the recording industry trade association, started tracking people
downloading and uploading music files from MP3 audio file-sharing web sites
such as Napster, Gnutella or KaZaa. In a move that left many Belgian music fans
outraged, IFPI collaborated by simple "gentlemen's agreements", and outside any legal framework, with Internet service providers
(ISPs) to get the names and addresses of high-speed Internet connection
subscribers in order to send them personalized letters threatening them with
legal action if they did not stop their file-sharing practices. In November
2001, the Privacy Commission released an initiative opinion severely condemning the way IFPI had behaved with respect to the
protection of people's privacy, noticing that they were violating several
Belgian and European telecommunications privacy and data protection laws.
In July 2001, the Conseil des ministres (Council of
Ministers) approved the idea of introducing an electronic identity card for all
Belgians. BELPIC, which stands for Belgian Personal Identity Card, embeds a
digital certificate that will, according to the government, allow Belgians to
communicate online and conduct secure transactions with government agencies,
access e-government applications, and perform e-banking, or other future
private applications. Under the plan, every Belgian citizen would get an identification
card with his or her name, photograph and two digital certificates. One would
be used for authentication, the other as a digital signature to sign documents
such as declarations or application forms, whci will have the same legal value
as documents signed by hand. In February 2003, the Parliament approved the introduction of
BELPIC and the new chipcards were tested in 11 municipalities (communes) until September 2003. After this test, the government decided to roll out the cards to
about nine million citizens throughout the Belgian territory by the end of
2006. The new ID card has been criticized by the Commission and civil liberties organizations as presenting a serious threat to
individuals' privacy.Belgium is the first country in Europe to embed a digital signature
in an ID card and to massively roll out ID smart cards at a national level.
Belgium began a test program in
May 2004 that will make it one of the first countries in the world to issue
passports with an imbedded computer chip for personal information. Initially, the chip will be used only for basic information, such
as name, date-of-birth, and signature. However, it has the ability to store
fingerprints, an iris scan and other biometrics. The new passports are expected
to be distributed to the public early 2005.
A Law of December 19, 2003 implemented a framework decision of the Council of the European
Union on the European arrest warrant.[67] Some of its
provisions specifically cover cyber-crimes and pedopornography offenses.[68]
Voting is mandatory for those 18
years and older. Voter registration lists are posted in polling locations on
Election Day and may also be obtained for political campaign purposes. Election administrators take an oath to maintain the secrecy of
votes cast. Voters are guaranteed the right of secrecy of their vote. In 1989, Belgium became the first nation in Europe to pursue
electronic voting. In 1994, a law was enacted that allows electronic voting. The direct
recording electronic (DRE) system identified was used by 44 percent of voters
in 2000. By 2003, an estimated three million votes were cast using electronic
voting technology.
The Constitution recognizes that
"everyone has the right to consult any administrative document and to have
a copy made, except in the cases and conditions stipulated by the laws,
decrees, or regional council decrees. There are freedom of information laws, implementing this
constitutional right, on the right of access to administrative documents on the
national, regional, and community levels. The basic exemptions to the general rule of access are public
security, the protection of fundamental rights, international interests, public
order, security or defense, confidentiality, privacy, etc. Each jurisdiction
has a Commission d'Accès aux Documents
Administratifs that oversees the act.
Belgium is a member of the Council of Europe (CoE) and has
signed and ratified the Convention for the Protection of Individuals with
Regard to Automatic Processing of Personal Data (Convention No. 108). It has signed and
ratified the European Convention for the Protection of Human Rights and
Fundamental Freedoms. It is a member of the
Organization for Economic Cooperation and Development (OECD) and has adopted
the OECD Guidelines on the Protection of Privacy and Transborder Flows of
Personal Data. The government signed, but has not ratified, the CoE Convention
on cybercrime in November 2001.
