Processing of personal data

1. DEFINITIONS

"Personal data" means any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

"Recipient" means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.

"Third party" means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data

2. CONTROLLER

The controller responsible for processing personal data in the context of the application of the legislation on access to the territory, residence, settlement and removal of foreign nationals is:

The Secretary of State for Asylum and Migration - represented by the Director General of the Immigration Office - Mr Freddy Roosemont.

Federal Public Service Home Affairs
Directorate General Immigration Office
Pacheco, Boulevard Pacheco 44, 1000 Brussels

3. DATA PROTECTION OFFICER ("DPO")

Tasks of the DPO:

The "DPO" may be contacted by data subjects whose data are processed by the Immigration Office on all matters relating to the processing of their data and more specifically with regard to:

  • the right to object to the processing.
  • the right to request the erasure of data and the restriction of data processing;
  • the right to request rectification;
  • knowing whether it is a matter of automated data processing;
  • the length of time the personal data is retained;
  • the possible transfer of personal data to third countries and the existence of appropriate safeguards;
  • the categories of recipients of personal data;
  • the categories of personal data concerned;
  • the legal grounds for the processing;
  • the purposes of the data processing;

Contact details of the "DPO":

You can contact the "DPO" of the Immigration Office:

Federal Public Service Home Affairs
Directorate General Immigration Office
For the attention of the "Data Protection Officer"
Pacheco,
Boulevard Pacheco 44, 1000 Brussels

4. PERSONAL DATA COLLECTED 

The Immigration Office undertakes to process only personal data that are adequate, relevant and not excessive in relation to the purposes for which they are collected (see point 5 below) and not to use them subsequently in a way that is incompatible with those purposes. 

In addition to the personal data that we collect directly from you, the Immigration Office also collects personal data about you from other bodies. Depending, inter alia, on the application for residence submitted, this may include the following categories of data: [1]

  1. Identification data: personal identification data (name, title, address, previous addresses, telephone number, identifiers assigned by the Immigration Office, etc.); identification data, issued by public services, other than the national register number (identity card number, passport number, driving licence number, pension number, etc.); biometric identification data (DNA data, fingerprints, photographs); etc.
     
  2. Financial details: financial identification data (bank account numbers, etc.); income, possessions, total income, professional income, savings, etc.; debts, expenses (total expenses, rent expenses, loans, etc.); solvency (assessment of income, financial status, creditworthiness); allowances, grants, etc.; pension details; etc.
     
  3. Personal characteristics: personal details (age, gender, date of birth, place of birth, marital status, nationality, etc.); military status (military status, military background, etc.); immigration status (visa details, work permit, residence or travel restrictions, right to stay, etc.); etc.
     
  4. Lifestyle: lifestyle; travel and movement details (information on stays and trips taken, travel visas, work permits, etc.); social contacts (friends, business associates, relationships other than close family, etc.); possessions (land, property or other possessions); etc.
     
  5. Psychological data: opinions about personality or character.
     
  6. Household composition: marriage or other current form of cohabitation (name of spouse/partner, maiden name of spouse/partner, date of marriage, date of cohabitation contract, number of children, etc.); marital history (details of previous marriages/unions, divorces, separations, names of previous partners, etc.); details of other family/household members (children, dependants, other household members, collaterals, parents and ascendants); etc.
     
  7. Hobbies and interests: leisure activities and interests (hobbies, sports, other interests, etc.).
     
  8. Affiliations: affiliations (other than professional, political or trade union) with charitable or voluntary organisations, clubs, associations, unions, organisations, groups, etc.
     
  9. Judicial data: suspicions and indictments (suspected offences, investigations or legal proceedings, etc.); convictions and sentences; judicial measures (guardianship, provisional administration, internment, collocation, etc.); administrative sanctions; etc.
     
  10. Characteristics of the dwelling: address of the dwelling; type of dwelling; duration of stay at the address; rent, charges; classification of the dwelling; etc.
     
  11. Data concerning health: physical health (medical file, medical report, diagnosis, treatment, test results, disability, infirmity, diet, etc.); special health requirements for managing a trip; mental health (medical file, medical report, diagnosis, treatment, test results, etc.); risk situations and behaviour; genetic data; data concerning care (data on the resources and procedures used for medical and paramedical care); etc.
     
  12. Education and training: academic curriculum (history of schools, institutions, universities attended, nature of courses taken, diplomas obtained, examination results, other diplomas obtained, assessments of academic progress, etc.); professional qualifications (professional certificates and training, special licences, etc.); professional experience (professional interests, research interests, academic interests, etc.); etc.
     
  13. Occupation and employment: current employment (employer, job title and description, grade, date of recruitment, place of work, specialisation or type of company, working terms and conditions, previous duties and experience, etc.); end of employment; career (previous jobs and employers, periods of non-employment, military service, etc.); occupational health; salary (payments, wages, etc.); etc.
     
  14. National Register Number / Social Security Identification Number;
     
  15. Racial or ethnic data;
     
  16. Data on sexual behaviour;
     
  17. Political views: political beliefs, voting preferences; political party affiliation; political positions held; membership or support of lobby groups or activist organisations; etc.
     
  18. Membership of a trade union: membership in a trade union or similar grouping; positions held; etc.
     
  19. Philosophical and religious beliefs.
     

5. PURPOSES OF THE PROCESSING

In accordance with Article 6 of the "GDPR", the personal data transmitted by the foreign national as well as those collected about him/her by the Immigration Office from third parties are necessary for the performance of a task carried out in the public interest, falling within the exercise of the public authority vested in the Immigration Office, namely: the application of the legislation on access to the territory, residence, settlement and removal of foreign nationals.

The said data (see point 3 above) are processed, in particular, for the following purposes:

  1. The identification of foreign nationals;
     
  2. The processing of applications for residence permits submitted by foreign nationals, both with Belgian diplomatic or consular posts abroad and directly on the territory of the Kingdom (with municipal administrations or the Immigration Office);
     
  3. Access to the Schengen territory and the Kingdom of Belgium;
     
  4. Following up the stay of foreign nationals in the territory of the Kingdom, including keeping them in a detention centre and removing them from the territory of the Kingdom, etc.;
     
  5. Investigating, identifying and following up criminal offences provided for, in particular, in the legislation on access to the territory, residence, settlement and removal of foreign nationals and in the legislation on the employment of foreign workers;
     
  6. Imposing administrative sanctions on foreign nationals and transport companies who do not comply with the provisions of the legislation on access to the territory, residence, settlement and removal of foreign nationals;
     
  7. Managing litigation against decisions made;
     
  8. Managing the correspondence between the Immigration Office and the persons and authorities or others who contact the Immigration Office.
     

6. RECIPIENTS OF THE DATA

The personal data concerning you collected and processed by the Immigration Office (or at least some of them) may, in particular, be communicated to the following categories of recipients:

  1. The data subject, their legal representatives;
     
  2. The professional advisers (e.g. lawyers) of the data subject or their legal representatives;
     
  3. The employer of the data subject;
     
  4. Other services attached to the Immigration Office: the Office of the General Commissioner for Refugees and Stateless Persons, municipal administrations, Belgian diplomatic or consular posts abroad, etc.;
     
  5. Federal, regional or community public services;
     
  6. The Judiciary, police, intelligence services;
     
  7. Social Security body
     

7. TRANSFER OF DATA TO A THIRD COUNTRY

In the context of its tasks, the Immigration Office may transmit some of your personal data to countries outside the European Union. In the case of data relating to the health of the applicant, the transfer will only take place after receiving the consent of the data subject.

The Immigration Office ensures, to the extent possible, that the agreements it concludes with third countries include clauses that ensure an adequate level of protection for your personal data. These agreements can be obtained from the DPO of the Immigration Office.

In the absence of adequacy decisions and the possibility of concluding agreements to ensure an adequate level of protection for your personal data, the Immigration Office may, nevertheless, exceptionally transmit some of your personal data to third countries, because the implementation of European and national migration policy is an important reason of public interest as referred to in Article 49 of the GDPR.

8. DATA RETENTION PERIOD

As a general rule, the Immigration Office keeps the personal data it processes for a period of 75 years after a file has been opened. After this period, the file is transferred to the State Archives, where it is archived for future historical and scientific research.

Retention periods may deviate from this general rule depending on the source and specific legal frameworks. 

9. PROCEDURE FOR REQUESTING A COPY OF THE ADMINISTRATIVE FILE

In the context of the Law of 11.04.1994 on the publicity of the administration, you can request a copy of your administrative file managed by the Immigration Office. The procedure for requesting a copy is explained via this link: Publicité de l'administration

10. RIGHT OF ACCESS, RECTIFICATION, ERASURE AND RESTRICTION OF PROCESSING

A.      Right of access:

You have the right to obtain confirmation that your personal data are being processed by the Immigration Office and, when this is the case, access to the following information:

  • the purposes of the data processing;
  • the legal grounds for the processing;
  • the categories of personal data concerned;
  • the categories of recipients of personal data;
  • the possible transfer of personal data to third countries and the existence of appropriate safeguards;
  • the retention period for personal data or the criteria used to determine this period;
  • knowing whether it is a matter of automated data processing;

For these questions, you can contact the "DPO" of the Immigration Office (see 3. The Data Protection Officer). You will be asked to prove your identity.

B.       Right of rectification:

You have the right to have inaccurate personal data rectified or to request that incomplete personal data be completed.

If you observe that the Immigration Office has processed inaccurate or incomplete personal data about you, we invite you to first contact the department handling your administrative file and ask it to correct the inaccurate data or complete the incomplete data.

The department handling your case may ask you for additional information or evidence to support your claim.

The contact details of the department that handles your file are listed in the letter from the Immigration Office or on our website: Contact | IBZ

The Immigration Office will inform the partners with whom it shares amended personal data of any rectification, unless such communication proves impossible or requires disproportionate effort.

If you have any further questions after contacting the relevant departments, you can address them to the "DPO" (see 3. The Data Protection Officer).

C.       Right to erasure:

Given that the processing of your personal data is necessary for the performance of a task falling under the exercise of official authority vested in the Immigration Office, you are not entitled to request and obtain the erasure of your personal data.

If you have questions concerning the right to erasure, you can address them to the "DPO" (see 3. The Data Protection Officer).

D.      Right to restriction:

Under certain circumstances, you may request that the processing of personal data by the Immigration Office be restricted, for example if the Immigration Office checks the accuracy of the personal data in the event that you dispute its accuracy (see B. Right of rectification).

If you request that the use of your personal data processed by the Immigration Office be restricted, you should first contact the department that manages your administrative file and ask it to restrict the use of your personal data.

The department handling your application may ask you for additional information or evidence to support your application.

The contact details of the department that handles your file are listed in the letter from the Immigration Office or on our website: Contact | IBZ

The Immigration Office will inform the partners with whom it shares amended personal data of any restriction, unless such communication proves impossible or requires disproportionate effort.

If you have any further questions after contacting the relevant departments, you can address them to the "DPO" (see 3. The Data Protection Officer).

E.       Right to data portability:

Given that the Immigration Office does not process your personal data on the basis of your consent or in execution of a contract, the right to data portability does not apply. Consequently, you are not entitled to receive your personal data from the Immigration Office in a structured, commonly used and machine-readable format for transmission to another controller.

If you have questions concerning the right to data portability, you can address them to the "DPO" (see 3. The Data Protection Officer).

F.       Right to object

You may object to the processing of personal data, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

However, the Immigration Office may object if there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

If you object to the processing of personal data managed by the Immigration Office, we invite you to first contact the department that manages your administrative file.

The contact details of the department that handles your file are listed in the letter from the Immigration Office or on our website: Contact | IBZ

If you have any further questions after contacting the relevant departments, you can address them to the "DPO" (see 3. The Data Protection Officer).

11. RESPONSE AND RESPONSE TIME 

If you invoke the right of access, the right to rectification, the right to erasure, the right to restriction or the right to object, you will receive information on the measures taken in response to your request within one month of receipt of the request. This period may be extended by two months in view of the complexity of your request and the number of ongoing requests. You will be informed of this extension of the response time.

If your request is not acted upon, you will be informed of the reasons for inaction no later than one month from the receipt of your request. You have the right to lodge a complaint with the supervisory authority and to seek legal redress.

12. LODGING A COMPLAINT WITH THE SUPERVISORY AUTHORITY

If you believe that the Immigration Office has not processed your personal data in accordance with the General Data Protection Regulation of 27 April 2016, you are entitled to lodge a complaint with the Data Protection Authority.

More information can be found on the website of the said Authority: 

https://www.dataprotectionauthority.be/citizen

Data Protection Authority

Rue de la Presse, 35
1000 Brussels
Email: contact[at]apd-gba.be
Tel: +32 2 274 48 00

 [1] 
This list is based on the categories of personal data drawn up by the Commission for the Protection of Privacy in its Recommendation No. 06/2017 of 14 June 2017 - Recommendation on the Register of Processing Activities (Article 30 of the GDPR) (CO-AR-2017-011).