07.02.19 Access to the National Register and Use of the National Registration Number: New Opportunities for Businesses
On 23 December 2018, the Act of 25 November 2018 containing various provisions concerning the National Register and the population registers entered into force. This Act contains a number of important amendments to the Act of 8 August 1983 on the National Register of Natural Persons (hereinafter ANR).
Inspired by the objectives of modernisation and administrative simplification, the legislator introduced a new framework for private undertakings to access the National Register and to process the national registration number (hereinafter NRN). Even though the options for private undertakings are burdensome and restrictive and the National Register’s administration service will need time to implement the new provisions, the new rules provide some interesting opportunities. This ezine will discuss the main implications for private undertakings.
Company interests are now recognized and taken into account
While the objectives of the National Register were traditionally focused on the public sector, a role for the private sector has now also been recognised, albeit to a limited extent.
New grounds to access the National Register: consent of the data subject
Pursuant to Article 5 of the ANR, the Minister of the Interior, and no longer the Sectoral Committee of the National Register, can grant authorisation for access to the National Register in a limited number of cases.
In principle, private undertakings only have access to the National Register for the information they require to perform tasks of general interest entrusted to them by or pursuant to legislation or for tasks that are explicitly recognised as such by the Minister of the Interior.
Article 5ter of the ANR now provides for an important exception to this principle. It provides that private (and public) institutions can receive automatic updates on changes regarding the (sur)name, principal place of residence and decease of a data subject if certain conditions are complied with, including:
- the data subject is of legal age;
- the data subject has authorised the National Register to send such automatic updates;
- the data subject has a contractual, reciprocal, explicit and formal relationship with the institution, requiring successive performances;
- the institution has informed the data subject of the purposes of processing and the retention period of the data;
- the purpose of processing should be one of the following (exhaustive enumeration):
- data may not be used for other purposes, e.g. it may not be sold to third parties or used for advertising purposes;
- the data subject must consent to the processing in accordance with the GDPR (the data subject can therefore withdraw his/her consent at any time, in this case not only via the institution but also via the National Register or the municipality);
- the contract may not be subordinated to the granting of consent and may not attach negative or positive consequences to the obtaining of consent (this is a guarantee for the voluntary nature of consent, in accordance with the GDPR);
- the institution must take measures to ensure the protection of the data, including the appointment of a Data Protection Officer (whose identity must also be communicated to the services of the National Register and not only to the data protection authority);
- the institution must draw up a reference directory of all data subjects who have agreed to the communication by the National Register of modified information; and
- data must be destroyed/deleted immediately upon termination of the contract (including information concerning the data subject in the reference directory) and the termination of the contractual relationship must be communicated to the services of the National Register.
Possible processing of the NRN without authorisation of the Minister of the Interior
Article 8 of the ANR states that the Minister of the Interior can grant authorisation to process the NRN in a limited number of cases (the same cases as mentioned in Article 5 ANR).
In the past, private undertakings seldom qualified for such authorisation. Article 8 ANR provides however for some new exceptions, so that companies no longer need an authorisation:
- when reading an electronic identity card for Belgians or a foreigner's card or when receiving an electronic signature certificate or an electronic authentication certificate. The access to the NRN is not in and of itself considered as a use of the number in that case;
- when the NRN is used exclusively for the purpose of identification and authentication of a natural person within the framework of an information application offered by an undertaking under Belgian law. A foreign undertaking can now request an authorisation for this use (which was not possible before because such grounds were not mentioned in Article 5 ANR); and
- when they are authorised to receive information regarding changes to data relating to the name, principal place of residence or decease of a data subject, as set out above. They may do so exclusively in the context of relations with the services of the National Register in order to communicate the data changes.
To ensure that the NRN is solely used for the exceptions expressly provided for by Article 8 of the ANR, rules are imposed with regard to the mandatory use of an encrypted conversion table, which establishes a link between the NRN and an identification number of the institution. The conversion table may only be used in the context of these exceptions.
The new law opens up important opportunities for the administrative simplification of relations between citizens and businesses. However, the impact is slowed down by restrictive requirements, such as the requirement for an explicit consent of the data subject and the requirement of a contractual relationship between him/her and the undertaking.
If your company complies with the above requirements and would like to have access to the National Register, it is time to draft a new consent form and to obtain a valid consent from the data subjects concerned.