On 25 May 2013, the Belgian Privacy Commission (BPC) concluded a protocol with the Ministry of Justice in order to simplify the administrative procedure for the transfer of personal data to non-European countries based on contractual clauses.
Personal data can be exchanged freely within the EU, but the transfer of personal data outside the EU is prohibited unless there is an adequate level of protection. A data controller can provide such adequate level of protection by concluding an agreement with the non-EU based recipient of the personal data.
To that end, the data exporter may use the European Commission’s Model Clauses or draft its own ad hoc agreement. EU Model Clauses are automatically considered to offer an adequate level of protection and do not need to be approved by the BPC. However, ad hoc agreements are subject to authorization by Royal Decree.
The newly concluded Protocol simplifies the procedure for authorization by Royal Decree, but it also has consequences for the EU Model Clauses. Therefore, all agreements—even EU Model Clauses—must be sent to the BPC for approval. If the clauses of the agreement are in conformity with the EU Model Clauses, the BPC will inform the data exporter thereof in writing. The cross-border transfer will be considered lawful once the data exporter is notified about the BPC’s written approval.
If the agreement is not in accordance with the EU Model Clauses, the BPC will inform the data exporter that the agreement requires an approval by Royal Decree. The data exporter can then still decide whether it wants to align the terms of its agreement with the EU Model Clauses. If the data exporter does not wish to do so, the BPC will examine if the agreement contains sufficient measures to guarantee an adequate level of protection. If the BPC finds it to be sufficient, it will send an official positive recommendation, together with a proposition of a Royal Decree, to the Ministry of Justice within 60 days from the date of the file’s completion. The Ministry of Justice will subsequently examine whether the procedural rules of the Protocol had been observed and will submit the draft of the Royal Decree to the King.
Although the Ministry of Justice will still control the final publication of the Royal Decree in the Official Gazette, the BPC will assume a large part of the preparatory work.
