What Needs to be Done Prior to Collection

Contact the data subject

Contact the Commission

Article 9

1. If personal data is obtained directly from the data subject, the controller or his representative shall provide the data subject no later than the moment at which the data is obtained, with at least the following information, unless he already has it:

a. the name and address of the controller and, if such is the case, of his representative;

b. the purposes of the processing;

c. the existence of a right to object on request and free of charge against the intended processing, if personal data is obtained for direct marketing purposes;

d. other additional information, in particular:

· the recipients or categories of recipients of the data,

· whether or not replies to the questions are obligatory as well as possible consequences of a failure to reply,

· the existence of the right of access to and the right to rectify the personal data concerning him,

unless such additional information is not necessary to guarantee fair processing towards the data subject, taking into account the specific circumstances in which the data is obtained.

a. further information, dependent on the specific nature of the processing, that will be specified by the King after advice of the Commission for the Protection of Privacy.

2. If personal data is not obtained from the data subject, the controller or his representative shall at the time of undertaking the recording of personal data or, if a communication to a third party is envisaged, no later than the moment at which the data is first disclosed, provide the data subject with at least the following information, unless he already has it:

a. the name and address of the controller and, if such is the case, of his representative;

b. the purposes of the processing;

c. the existence of a right to object on request and free of charge against the intended processing, if personal is are obtained for direct marketing purposes; in that case, the data subject has to be informed before the personal data is disclosed for the first time to a third party or used for direct marketing purposes on behalf of third parties;

d. other additional information, in particular:

· the recipients or categories of recipients of the data,

· whether or not replies to the questions are obligatory as well as possible consequences of a failure to reply,

· the existence of the right of access to and the right to rectify this data,

unless such further information is not necessary to guarantee fair processing towards the data subject, taking into account the specific circumstances in which the data is collected,.

a. further information, dependent on the specific nature of the processing, that will be specified by the King after advice of the Commission for the Protection of Privacy.

The controller shall be exempt from the obligation to inform referred to in this paragraph:

a. if, in particular for statistical purposes or for the purposes of historical or scientific research or for the purpose of public health screening with the intention of public health protection and promotion, the provision of such notification appears to be impossible or involves a disproportionate effort;

b. if the recording or communication of personal data is carried out in view of the application of a provision laid down by or by virtue of a law, decree or ordinance.

Contact the Commission

Chapter V - Prior notification and public nature of the processing.

Article 17

1. Before carrying out any wholly or partly automatic processing operation or set of such operations intended to serve a single purpose or several related purposes the controller or, if such is the case, his representative, shall notify the Commission for the Protection of Privacy thereof.

The previous section does not apply to the processing of which the sole purpose is the keeping of a register that is intended by law or by virtue of a law, decree or ordinance to provide information to the public and that is open to consultation either by the public in general or by any person demonstrating a legitimate interest.

2. The Commission shall return within three working days a written receipt of the notification.

If the notification is incomplete the Commission shall inform the person submitting the notification thereof.

3. The notification shall mention:

1° the date of the notification and, if such is the case, the law, decree, ordinance or regulatory instrument establishing the automatic processing;

2° surname, first names and full address or name and registered office of the controller and, if such is the case, his representative in Belgium;

3° [cancelled]

4° the name of the automatic processing;

5° the purpose or the entirety of related purposes of the automatic processing;

6° the categories of the personal data that are processed with a specific description of the data referred to in the Articles 6 to 8;

7° the categories of recipients who may be provided with the data;

8° the guarantees to be linked to the communication of data to third parties;

9° the manner in which the persons to whom the data relates are informed thereof, the service where the right of access may be exercised and the measures taken to facilitate the exercise of that right;

10° the period of time, after the expiration of which the data may no longer be stored, used or disclosed, if such is the case;

11° a general description permitting a preliminary assessment of the appropriateness of the security measures taken pursuant to Article 16 of this law;

12° the grounds that the controller is relying upon for the application of Article 3 § 3 of this law, if such is the case.

4. Within the scope of its power of supervision and investigation referred to in the Articles 31 and 32, the Commission for the Protection of Privacy is entitled to demand other items of information, in particular the origin of the personal data, the automation technology selected and the security measures provided for.

5. Notification is required for any purpose or entirety of related purposes, for which recurrence is taken to a wholly or partly automatic processing operation or set of such operations.

The Commission shall determine the nature and structure of the notification.

6. If the data that is processed is intended, even on an occasional basis, to be transferred to a foreign country, the notification shall mention the following elements, regardless of the carrier that has been used:

1° the categories of data that are transferred;

2° the country of destination for each category of data.

7. If an automatic processing operation is terminated or if any item of information referred to in § 3 is modified, notification has to be made thereof.

8. The King may exempt after advice of the Commission for the Protection of Privacy certain categories from the notification referred to in this Article, if there is, taking into account the data that are processed, apparently no risk of violating the rights and freedoms of the persons concerned, and the purposes of the processing, the categories of data that are processed, the categories of the persons concerned, the categories of the recipients and the period of time during which the data is stored, are specified.

If in accordance with the previous section an exemption from the obligation of notification has been granted for automatic processing operations, the items of information enumerated in 3 and 6 shall be communicated to any person so requesting.

9. Upon submission of the notification the controller shall pay a sum to a person who has been appointed as accountable by the Commission for the Protection of Privacy in accordance with the laws on Government accounts. The King shall determine the amount of this sum that may not exceed three hundred euros. He shall also lay down the modalities of payment.