Gespecialiseerde juridische oplossingen voor een wereld in beweging

On 24 April 2025, the Belgian Data Protection Authority’s Litigation Chamber issued Decision 79/2025, declaring that the automatic transfer of personal data by the Service Public Fédéral Finances to the United States Internal Revenue Service under the FATCA agreement violates the General Data Protection Regulation. This landmark ruling, following a Brussels Court of Appeal remand, underscores the primacy of data protection law over international agreements and offers critical lessons for businesses handling cross-border data transfers. This legal insight of Allegiance Law breaks down the decision’s implications and provides actionable strategies for ensuring General Data Protection Regulation compliance when concluding contracts.

In today’s fast-digitising world, cyberattacks are not just a threat-they are a statistical certainty. A successful cyberattack costs a company on average €200,000, and even more alarming, 60% of SMEs go bankrupt within six months of a serious breach. Cybersecurity is no longer a luxury-it is a legal and operational imperative. The EU understood this well, with two major legislative pillars now active: the DORA Regulation, in force since 17 January 2025 for the financial sector, and the broader-reaching NIS2 Directive, which applies across critical and important sectors.

The European Union's Artificial Intelligence Act (AI Act), which came into force on 1 August 2024, represents the world's first comprehensive legal framework governing artificial intelligence. While the majority of its provisions will become applicable from 2 August 2026, certain critical obligations took effect earlier, on 2 February 2025. These early requirements focus on prohibiting specific AI practices deemed to pose unacceptable risks and mandate organizations to enhance AI literacy among their personnel.

On 16 January 2025, the European Data Protection Board (EDPB) adopted the Draft Guidelines 01/2025 on Pseudonymisation, providing comprehensive insights into the application and benefits of pseudonymisation under the General Data Protection Regulation (GDPR).

On 7 October 2024, the European Data Protection Board (EDPB) published Opinion 22/2024, shedding new light on the responsibilities of data controllers when working with processors and sub-processors under the General Data Protection Regulation (GDPR).

On 15 February 2025, the Belgian Data Protection Authority (DPA) published its updated draft Recommendation 01/2025 on Direct Marketing, currently open for consultation until 10 May 2025.