Law note · Belgium
Act of 30 July 2018 Article 9 and GBA/APD Biometric Recommendation and Enforcement
Belgium has no dedicated biometric-identifier statute; a biometric identifier is General Data Protection Regulation (GDPR) Article 9(1) special-category data, plus Act Article 9's access-designation and confidentiality duties. GBA/APD Recommendation 01/2021, read in full, concludes there is at present a lacuna in Belgian law such that any biometric authentication processing lacking explicit consent, other than eID and passport processing, has no legal basis.
Litigation Chamber Decision 114/2024, read in full, fined an employer 45,000 EUR for fingerprint-based workplace time registration, holding that employee consent failed the power-imbalance analysis and that record-keeping and DPIA duties were also breached.
The GBA/APD's own publication search returns zero results for voice recognition and 16 results for facial recognition, none of them a decision, so Belgium has no facial-recognition Litigation Chamber decision and no voiceprint guidance at all, established from the regulator's own index rather than an inference.
What it asks of an app
- Do not rely on employee consent as the legal basis for a workplace biometric time-registration or access system in Belgium; the Litigation Chamber fined an employer 45,000 EUR for exactly this in Decision 114/2024.
- Expect no statutory basis to exist at all for biometric authentication processing in Belgium outside explicit consent and the eID/passport exception, per GBA/APD Recommendation 01/2021's own finding of a legal lacuna.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: GBA/APD Aanbeveling nr. 01/2021 (direct read, full text)
GBA/APD Beslissing ten gronde nr. 114/2024 (direct read, full text)