Belgian DPA Opinion 198/2026 Demands Tighter Legal Limits on Health Data Sharing in Back to Work Ref

Key Takeaways

• The Belgian Data Protection Authority reviewed Articles 3 and 4 of a draft law that would expand medical follow-up for incapacity for work and require treating physicians to pass other healthcare professionals' findings to insurers' advising physicians.
• The Authority found that the draft delegates too much to the King, lacks the required precision and foreseeability, and was not supported by a data protection impact assessment.
• Organizations handling health data for insurance or control purposes should expect stricter statutory limits and prepare for them.

Deep Dive

The Belgian Data Protection Authority reviewed Articles 3 and 4 of a draft law that would expand medical follow-up for incapacity for work and require treating physicians to pass other healthcare professionals' findings to insurers' advising physicians. The Authority found that the draft delegates too much to the King, lacks the required precision and foreseeability, and was not supported by a data protection impact assessment. Organizations handling health data for insurance or control purposes should expect stricter statutory limits and prepare for them.

The Authority's key concerns are as follows:
- Missing impact assessment: No data protection impact assessment was carried out. The Authority considers one mandatory under GDPR Article 35(3) for large-scale processing of special category data, and it must precede processing. If residual high risk remains, prior consultation under Article 36 is required.
- Legality and foreseeability: Under Article 22 of the Constitution, ECHR Article 8, and GDPR Article 6(3), the essential elements of the processing must be set by the legislature. These include purpose, data categories, data subjects, retention period, and recipients. Only secondary elements, such as the format or timing of transmission, may be delegated to the King.
- Specific fixes: The pathologies covered must appear in the statute itself. Only reports resulting from the treating physician's referrals, and linked to the incapacity, may be included. The mechanics of "inclusion in the file" remain unclear, because the applicant's explanation describes the insured person handing over documents rather than the physician transmitting them.
- Purpose limitation and minimization: Article 37(3) of the Quality Act contemplates excluding insurance and control medicine from direct access to patient information. Diagnostic and control purposes are often incompatible with therapeutic purposes. The Authority also notes that the insurer's medical file has no clear legislative framework, a point raised earlier in Opinion 97/2026.

No compliance deadlines are set. The relevant dates are the request received on 29 July 2026, the opinion issued on 17 September 2026, and the repeal on 2 April 2026 of the Royal Decree on access to health data. That repeal leaves a gap in the access framework. The text provided is truncated at page 7 of 14, so later conclusions on Article 4 and any retention points are not covered here.

Recommended actions for compliance teams at insurers, health insurance funds, and employers or service providers in this chain:
- Monitor the draft's progress and the implementing Royal Decrees.
- Begin or update data protection impact assessments for incapacity and return-to-work workflows.
- Map flows of health data between treating physicians, other practitioners, and advising physicians.
- Confirm that only referral-based, incapacity-linked findings are collected.
- Review access controls and segregation between therapeutic and insurance or control medicine functions.
- Prepare for stricter documentation of necessity and proportionality.

The main risk is that the legislation, if adopted without correction, could be challenged for constitutional and GDPR noncompliance. That would create uncertainty for processing built on it. Processing sensitive health data of vulnerable persons for control purposes, with possible adverse consequences, carries high regulatory and reputational exposure.

Source: Belgian Data Protection Authority