Fraud prevention and private investigation in Belgium

Privacy law, and the GDPR in particular, requires a company to define what it may examine internally and what it may not. Belgian employment law adds limits of its own. The current state of the legislation, the case law and the legal literature still leaves considerable room for a company that takes the right measures.

The Law of 18 May 2024 regulating private investigation (Wet tot regeling van de private opsporing) has been in force since 16 December 2024. It repealed the Law of 19 July 1991 on the profession of private detective. Article 3 treats an activity as private investigation when four conditions are met cumulatively: a natural person acts on the instructions of a principal, that person gathers information about people or about the circumstances of an event, and the purpose relates to an actual or possible conflict. If one condition is not met, the activity falls outside the scope of the law.

Article 7 forbids the organisation of an internal private investigation service without prior authorisation from the minister responsible for the Interior. Article 43, fourth and fifth paragraphs, exempts the members of a personnel department who carry out incident investigations involving the staff of their own employer. They must still comply with the other provisions of the law. Article 8 forbids anyone to use the services of an unauthorised provider.

Article 4 excludes the professional activities of a lawyer from the scope of the law. Your lawyer is therefore exempt from the authorisation requirement. The investigation firm you engage is not. The further duties of a director are set out on our page for company directors.

Start with the reporting channel. The Law of 28 November 2022 obliges every legal entity in the private sector to set up internal reporting channels and follow-up procedures, after consultation with the social partners. Entities with fewer than fifty workers are exempt. That exemption does not apply to entities covered by the provisions on financial services, products and markets or by the anti-money laundering provisions.

The procedure is subject to two deadlines. You acknowledge receipt of a report within seven days. You give feedback within at most three months of that acknowledgement. You appoint an independent report manager with no conflict of interest, and you keep a register of every report received. The channel must handle written and oral reports and, at the reporting person’s request, a physical meeting within a reasonable period.

Then check whether you have a set of workplace rules. Article 65 of the Law of 18 May 2024 allows an investigation into your own worker only where the permission and the arrangements for private investigations in the workplace are stated expressly and transparently in a set of rules. Article 180 gives you two years from 16 December 2024 to comply. Article 66 also requires a written assignment document with ten compulsory particulars.

Monitoring of email and internet use follows collective bargaining agreement no. 81 of 26 April 2002. It allows four purposes, among them preventing unlawful or defamatory acts. You describe that purpose in advance, clearly and explicitly, and you inform the works council and the workers concerned. Camera surveillance at the workplace follows collective bargaining agreement no. 68 of 16 June 1998, which lists four purposes. Article 8 of the camera law of 21 March 2007 forbids any covert use of surveillance cameras.

Finally, record the processing. Article 30 of the GDPR requires a register of processing activities. The exemption for smaller organisations falls away as soon as the processing is not occasional, or is likely to present a risk to the rights and freedoms of the people concerned, or covers data on criminal offences. If the damage is already done, our page for victims of fraud sets out what follows.

Only within the limits of collective bargaining agreement no. 81 of 26 April 2002. It allows the monitoring of electronic online communication data for four purposes, among them preventing unlawful or defamatory acts. You describe that purpose in advance, clearly and explicitly. You inform the works council and the workers concerned. Article 15 allows direct individualisation for the first three purposes. The Belgian Data Protection Authority does not accept the worker’s consent as a legal basis for electronic monitoring.

Camera surveillance at the workplace follows collective bargaining agreement no. 68 of 16 June 1998, which lists four purposes. Article 8 of the camera law of 21 March 2007 forbids any covert use of surveillance cameras.

From fifty workers. Article 11, paragraph 2, of the Law of 28 November 2022 exempts entities with fewer than fifty workers from the duty to set up an internal reporting channel. The threshold is the average number of workers, fixed each year on 1 January over the four quarters of the preceding calendar year. Entities covered by the provisions on financial services, products and markets or by the anti-money laundering provisions do not have that exemption.

Not for an incident investigation run by your own personnel department. Article 43, fourth and fifth paragraphs, of the Law of 18 May 2024 exempts those members from the identification card and from the duty to belong to an authorised service or company, where they investigate staff of their own employer. They remain bound by the other provisions of the law. Organising an internal private investigation service on a structural basis does require authorisation from the minister responsible for the Interior.

That evidence is void. Article 101, fourth paragraph, of the Law of 18 May 2024 prescribes ten articles on pain of nullity, article 65 among them. That article allows an assignment aimed at a worker of the principal only where the permission and the arrangements for private investigations in the workplace are stated expressly and transparently in a set of rules. Article 180 gives the principal two years from 16 December 2024 to comply.

Yes, as soon as you act on the final report. Article 77 of the Law of 18 May 2024 obliges the principal to state in writing, within thirty days of that report, whether it will be acted on. If it will not, the reports are destroyed at once. If it will, the person concerned and every other identifiable person are informed in writing without delay. Article 78 lists what that notice contains, including the right to free access and correction.

Article 57 of the Law of 18 May 2024 bans nine categories of information. They include political, religious and trade union convictions, health data, sexual behaviour, racial or ethnic origin, and suspicions or prosecutions that have not been made public. Article 58 also bans information that lets the principal derive those data indirectly. Article 62 excludes assignments about social conflicts. Article 96 bans the use of material obtained through an offence or unlawfully.