Professional secrecy

BPA does not contain any rules to reconcile the right of personal data protection with obligations of secrecy. These were included in the Act of 3 December 2017 on the creation of the Data Protection Authority (the "DPAA") which sets out the powers of the Belgian supervisory authority and the appropriate (procedural) safeguards for individuals.

That Act introduces a specific exception for medical data covered by professional secrecy. As a general rule, the DPAA states that investigative measures can give rise to an official report establishing an infringement. Such report has evidential value until proven otherwise and in principle, other inspection services or administrative supervisory authorities may use the material findings from the reports while preserving their evidential value. However, with respect to medical data, the DPAA states that such information may only be communicated and used in accordance with the relevant rules on medical professional secrecy.

Secondly, professional secrecy in general is taken into account in the context of on-site investigations. When there is a reason to believe that the principles of personal data protection have been violated, the inspectors of the Belgian DPA are entitled to enter the company, the service or any other premises to conduct on-site investigations. An exception is introduced for the premises of a professional that is under a duty of professional secrecy and for whom a legal arrangement is foreseen for on-site investigations and access to their premises. In such case, the inspectors are only allowed to access the premises in the presence of a representative of the professional association, except in case of prior written approval of the data subject or with an authorization of the investigating judge.

§ 7(3) permits data processing by healthcare professionals bound by secrecy;

§ 24 binds DPOs to secrecy.

The Data Protection Act 2018 includes two provisions in Schedule 1 that specifically implement Article 9(2)(h) and Article 9(2)(i). Both of these permit processing for purposes that broadly mirror the wording of the relevant articles, and do not establish clear additional restrictions on the use of data.

Health purposes: a list of health purposes is carried over from the GDPR. The safeguard in relation to professional secrecy is contained in Section 11(1), which states that article 9(h) will be available where it is carried out:
"by or under the responsibility of a health professional or a social work professional, or … by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law."

Both "health professional" and "social work professional" are specifically defined in Section 195. Both definitions call out to professionals under registration.

Public Health: the purpose must be "necessary for reasons of public interest in the area of public health" but not further examples are given. The safeguard for professional secrecy simply repeats the formulation in Section 11(1) (i.e. that processing must be under the responsibility of a health or social work professional or another person who owes a duty of confidentiality).

In Paragraph 19 of Schedule 2, controllers are exempted from rights under Articles 13, 14, 15 and the first three principles of the Act (lawfulness and fairness, purpose limitation and data minimisation) where the data are subject to legal professional privilege (or confidentiality of communications in legal proceedings, as this is known in Scotland).

Certain other exemptions apply to maintain secrecy in (typically public sector) records, including in certain health, education and child abuse records disclosed in court proceedings, and records where disclosure is prohibited under law. This can be found in the latter parts of Schedule 2.

Sections 131 and 132 of the Data Protection Act 2018 address secrecy of communications with the ICO. Section 131 requires the ICO to have consent, necessary public interest or other duty to disclose the data under its functions or under law.  The ICO is particularly required to propose guidance on how it will handle privileged communications that are shared with it under its functions. 

Privilege during enforcement activity

Controllers and processors are not required to divulge communications subject to legal advice privilege or litigation privilege. This is specifically included in the sections on information and assessment notices, both of which allow access to documents and premises in certain circumstances, and to Schedule 15 on powers of entry and inspection.