Legal Framework: the GDPR
The General Data Protection Regulation (GDPR) includes a set of rules to better protect citizens’ personal data. The GDPR applies to personal data of natural persons, not legal entities.
The GDPR:
- imposes basic principles for the management, use, processing and control of personal data.
- gives citizens a number of rights regarding the processing of their personal data.
The Department of Finance and Budget processes data in accordance with the provisions of the GDPR, as well as the provisions of federal and Flemish regulations on the protection of natural persons’ personal data.
The GDPR provides various legal grounds on the basis of which personal data may lawfully be processed. For the Department of Finance and Budget, the following legal grounds in particular apply:
- you have provided consent to the use of your personal data; this applies, for example, when you share your telephone number or e-mail address with us so that we can contact you when processing your file;
- the processing of your personal data is necessary to fulfill our legal duties and obligations and perform tasks of public interest.
The principles of the GDPR
Lawfulness, fairness and transparency (article 5 (1) (a) GDPR)
Whenever the Department engages in the processing of personal data, it’s crucial to have a valid justification for doing so, a principle referred to as lawfulness under the GDPR.
The purposes for which the Department processes your personal data are the public interest tasks entrusted to the Department. As a public service, the Department can and may only process your personal data in the public interest, as defined by law and decree.
In some cases, the processing may also be imposed by law or decree maker. Then that legal obligation is the basis for the processing.
The GDPR concept of fairness is closely intertwined with lawfulness. This means not intentionally withholding information about the purpose and nature of data collection.
Transparency is inherently linked to fairness and involves communicating clearly, openly and honestly with data subjects about our identity, the reasons for processing their personal data and the methods used to do so.
Purpose limitation (article 5 (1) (b) GDPR)
The purpose limitation means data is “collected for specified, explicit, and legitimate purposes” only, as stated in the GDPR. It cannot be further processed in a manner that is incompatible with those purposes.
The purposes for which the Department processes your personal data are the public interest tasks entrusted to the Department. As a public service, the Department can and may only process your personal data in the public interest, as defined by law and decree.
In some cases, the processing may also be imposed by law or decree maker. Then that legal obligation is the basis for the processing.
Data minimisation (article 5 (1) (c) GDPR)
The data minimisation principle emphasizes that organisations should only collect, process and retain the personal data that is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Accuracy (article 5 (1) (d) GDPR)
Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
The Department of Finance and Budget receives much of the data it processes from other organizations authorized or designated to manage and share that data. These are called authentic sources. The Department takes all reasonable steps to correct inaccurate or incomplete data and to report the same to the source from which it received the data.
Storage limitation (article 5 (1) (e) GDPR)
Personal data cannot be kept longer than is necessary for the purposes for which the personal data are processed.
Integrity and confidentiality (article 5 (1) (f) GDPR)
The Department of Finance and Budget holds and handles a great deal of personal data securely. They are protected against unauthorized or unlawful processing, against loss, destruction or loss of quality. The Department applies all necessary technical and organizational measures to ensure such security. Access to personal data in the databases is logged.
The quality of security measures was assessed each time an authorization to process data was requested and obtained, and is part of previous authorizations.
Accountability (article 5 (2) GDPR)
The controller shall be responsible for, and be able to demonstrate compliance with the principles above.
The rights of data subjects
The right of access (article 15 GDPR)
Upon your request, the Department of Finance and Budget will give you access to the specific personal data it processes about you. You can send your request to DPO_FB@vlaanderen.be
The right to rectification (article 16 GDPR)
The Department of Finance and Budget uses correct data, often from other authentic data sources. If you notice that the Department of Finance and Budget nevertheless works with incorrect data, contact us via: DPO_FB@vlaanderen.be. You can also use contact us to request incomplete personal data to be completed. You must provide a supplementary explanation.
The right to erasure (article 17 GDPR)
The Department of Finance and Budget only processes personal data necessary for its statutory duties and assignments and for public interest tasks. These personal data are not kept longer than necessary for that purpose.
Only in a limited number of cases can you request the erasure of your personal data:
- if your personal data are no longer necessary for the purposes for which they are processed;
- if you withdraw your consent to the processing of the data and there is no other legal basis for the processing. This may be the case, for example, if you have communicated your e-mail address or telephone number, and you do not want these data to continue to be used;
- if you have objected to the data processing and there are no more compelling reasons to continue processing the data anyway;
- If the data are processed unlawfully;
- if the data must be erased to comply with the erasure obligation contained in European, national or Flemish regulations.
If you want the Department of Finance and Budget to delete certain of your data, you can contact us via DPO_FB@vlaanderen.be.
The right to restrict processing (article 18 GDPR)
The Department of Finance and Budget only processes personal data necessary for its statutory duties and assignments and for public interest tasks. These personal data are not kept longer than necessary for this purpose.
The right to restriction may be invoked if the processing does not comply with the basic principles of the GDPR:
- the processing is unlawful, but you prefer to limit the use of the data to the future, rather than requesting erasure;
- the Department of Finance and Budget no longer needs the personal data for its purposes, but you as a citizen still need it for the establishment, exercise or substantiation of a legal claim, such as a legal proceeding in which you are involved.
You can also invoke the right to restriction pending the decision on the rights below. This allows you to request that the processing of your personal data be stopped temporarily in the meantime:
- the right to rectification when the data may be inaccurate: while the Department of Finance and Budget checks whether your data is inaccurate, you may ask to temporarily stop processing;
- the right to object: while the Department of Finance and Budget verifies whether your objection is justified, you may ask to temporarily stop processing.
If you want the Department of Finance and Budget to restrict the processing of your data, contact us via: DPO_FB@vlaanderen.be.
The right to restriction is not an absolute right. There are a number of reasons on which the Department of Finance and Budget may base its decision not to grant your request. The fact that the data is necessary for the performance of statutory duties or public interest tasks is the most important of these.
The right to data portability (article 20 GDPR)
The Department of Finance and Budget processes personal data only for its statutory duties or for the public interest. In these cases, the right to data portability does not apply.
Data portability allows you as a citizen to take your data away from one processor for the purpose of transferring it to another processor that provides the same type of services. Telecom providers are a good example.
The right to object (article 21 GDPR) and the right not to be subject to a decision based solely on automated processing /profiling (article 22 GDPR)
You have the right to object to the processing of data by the Department of Finance and Budget. In this case, an assessment will be made as to whether there are compelling legitimate grounds for the processing that outweigh your personal rights or interests. You also have the right to object to direct marketing and profiling, but the Department of Finance and Budget does not make use of it.
Profiling refers to the automated processing of personal data to:
- evaluate personal characteristics of individuals;
- make automated decisions regarding individuals.
The Department of Finance and Budget does not use profiling.
Protocols (for the exchange of personal data)
Protocol ‘mededeling gegevens onderzoek verplaatsingsgedrag’
On March 23 2023 the Department of Finance and Budget concluded a protocol for the electronic communication of personal data of the research ‘displacement behavior’ with the Department of Mobility and Public Works. The data will only be processed completely anonymously (no identification data) by the contractors of the project “Onderzoek naar een sturende mobiliteitsfiscaliteit (‘Research towards a guiding mobility taxation’)”.
Protocol mededeling gegevens onderzoek verplaatsingsgedrag
Protocol ‘mededeling gegevens on board units vrachtswagens’
On December 12 2023 the Department of Finance and Budget concluded a protocol for the electronic communication of personal data of the on board units of trucks with the Agency for Roads and Traffic. The data will be carefully processed by the contractor of the project “Onderzoek naar een sturende mobiliteitsfiscaliteit (‘Research towards a guiding mobility taxation’)”.
Protocol mededeling gegevens on board units vrachtwagens
Protocol ‘mededeling gegevens erfbelasting’
The Department of Finance and Budget concluded a protocol with Vlabel in the context of inheritance tax on June 24, 2024. This protocol is an consolidation of the previous protocols.
Protocol mededeling gegevens erfbelasting
Protocol ‘mededeling gegevens verkeersbelasting en de belasting op de inverkeerstelling’
On Oct. 24, 2024, The Department of Finance and Budget concluded a renewed protocol in the context of road and circulation taxes. This protocol is a consolidation of the previous protocol and addendum with the addition of additional variables such as maximum allowable mass, codes related to emission standards, CO2, tax group and vehicle category, …
Protocol mededeling gegevens verkeersbelasting en de belasting op de inverkeerstelling
Contact
You can use the contact details below only for information related to data processing and privacy. For all other questions, please use our contact page.
Data Controller
Department of Finance and Budget
Addressed to Koen Algoed
Koning Albert II-laan 35 bus 61
1030 Brussels
Data Protection
Data Protection Office
DPO_FB@vlaanderen.be