The right to be forgotten in Belgium is part of the framework for personal data protection. This right allows individuals to request the deletion of personal data concerning them when it is no longer necessary or relevant for the purposes for which it was collected or processed.
n Belgium, this right is primarily governed by the General Data Protection Regulation (GDPR) and national laws that complement this framework. With this in mind, this article explores the legal basis, application conditions, and limitations of the right to be forgotten in Belgium.
Legal foundations of the right to be forgotten
The GDPR as the primary framework
The right to be forgotten is grounded in article 17 of the GDPR, titled “Right to Erasure.” This provision grants individuals the ability to request the deletion of their personal data in several circumstances:
- When the data is no longer necessary for the purposes for which it was collected.
- If the consent previously given has been withdrawn, and there is no other legal basis for processing.
- When the data has been processed unlawfully, in violation of the GDPR.
- If deletion is necessary to comply with a legal obligation.
Belgian law of July 30, 2018
To complement the GDPR, Belgium adopted the Law of July 30, 2018, on the protection of individuals concerning the processing of personal data. This law specifies how the GDPR is applied in the Belgian context.
Moreover, it strengthens the powers of the Belgian Data Protection Authority (APD), which plays a central role in implementing this right.
Practical application in Belgium
The procedure for deletion requests
To exercise this right, Belgian citizens must submit a deletion request directly to the relevant data controller (company, administration, etc.). This procedure follows a well-defined framework:
- The request must specify which data is to be deleted and include a justification in compliance with GDPR criteria.
- The GDPR imposes a 30-day response deadline for such requests. If the situation is complex, this period can be extended by 60 days.
If approved, the data must be permanently deleted, including from backups. If the request is denied, the data controller must provide clear and documented reasons.
The role of the Belgian Data Protection Authority (APD)
If the data controller refuses to grant the request, the individual can contact the Belgian Data Protection Authority (APD). This body plays a key role in resolving disputes related to personal data protection. For instance, in 2023, the APD handled several complaints about refusals to delete data from search engines or professional databases.
The APD assesses whether the GDPR and national legislation have been adhered to concerning the right to be forgotten in Belgium. It can also conduct in-depth investigations into the practices of data controllers.
Search engines and social media
Citizens may request the de-indexing of search results containing outdated or defamatory information. The legitimacy of such requests depends on several factors:
- The public’s right to information.
- The relevance of the data to the public interest, particularly when it concerns public figures.
European case law, notably the Google Spain ruling (CJEU, May 13, 2014), guides these assessments.
On platforms like Facebook, Instagram, or Twitter, users can request the deletion of content such as photos, videos, or posts. These requests are particularly relevant when the content was published without consent or damages one’s reputation. Social media platforms must comply with internal policies and GDPR obligations to address these requests.
Limitations and exceptions
Right to information vs. right to be forgotten
Firstly, the right to be forgotten must always be balanced against the right to freedom of expression and information, which is protected by the Charter of Fundamental Rights of the European Union (CFR). In Belgium, this conflict often arises in specific cases:
- When the data concerns public figures.
- When the information serves a general interest, such as historical or political facts.
In such cases, judges and regulators must assess whether the right to information outweighs the right to be forgotten. This evaluation always depends on the context and the impact of the data on an individual’s privacy.
Medical and financial data
In Belgium, sensitive data, such as health-related information, receives special protection. A notable provision is the right to be forgotten in the insurance sector, designed to protect former patients:
- A person cured of a serious illness, such as cancer, can request that this information not be used.
- After a specific period, this data should no longer affect the ability to secure a borrower’s insurance.
This right is a unique advancement in Europe, representing significant progress toward non-discrimination. Additionally, financial institutions must comply with specific retention periods for data. Once this period ends, they are required to delete the information unless otherwise legally obligated.
Legitimate interests of data controllers
Article 17 of the GDPR provides exceptions to the right to erasure. These exceptions are crucial to protecting certain fundamental rights and public interests. For example, data processing is still permitted in several cases:
- To exercise the right to freedom of expression or ensure the right to information.
- When processing is necessary to comply with a legal obligation, such as a tax or regulatory requirement.
- For reasons of public interest, particularly in public health or national security.
- To establish or defend legal claims, such as in judicial proceedings.
The impact of new technologies
Technological advancements, such as artificial intelligence and big data, present new challenges to the right to be forgotten. In this context, citizens and businesses must adapt by working with institutions like the Belgian Data Protection Authority (APD) to ensure responsible data management in the digital age.
For cases or disputes related to the right to be forgotten in Belgium, it is recommended to contact Arthur & Marin at info@arthurmarin.com or +32 465 345 345.
Our firm effectively supports individuals and businesses in legal proceedings, ensuring their rights are upheld.
