The new Act on Private Investigations of 18 May 2024 replaces the old Act to regulate the profession of private detectives of 1991. The Act was published in the Belgian State Gazette on 6 December 2024 and entered into force on 16 December 2024. This new Act introduced a broader scope than the old Act, and therefore significantly affects employers who investigate their employees.
1. Scope
The Private Investigations Act applies to collecting intelligence obtained from processing information on natural or legal persons or concerning the facts committed by them. These private investigation activities include:
- Private and public employers conducting internal investigations (e.g., fraud, unfair competition), e.g. by internal investigation services. Also if no internal investigation service exists, the employer or his staff can fall under the scope.
- External investigators (e.g. private detectives) hired for this specific purpose.
The Act clarifies the roles of clients (employers), investigators, and internal/external investigation services.
Internal investigation services are organizational units or personnel within a company designated to conduct investigations into matters such as employee misconduct, fraud, or compliance violations. They operate as part of the employer's structure, distinct from external investigators.
Exclusions:
Certain activities fall outside the scope of this Act, such as:
- Investigations that arise directly from a legal obligation imposed on the employer or are merely the consequence of such a legal obligation (e.g. regulatory compliance checks, whistleblowing investigations mandated by law, an investigation by the prevention advisor based on the Wellbeing legislation).
- Investigations by certain professionals (lawyers, notaries, bailiffs, journalists,...).
- Routine HR inquiries involving direct employee communication or workplace data reviews Audits that do not involve an investigation regarding a specific person.
HR personnel investigating employees:
HR personnel conducting investigations into employee behaviour or incidents are only exempted from the mandatory licensing and some formal requirements if these investigations remain within the scope of standard workplace policies (e.g., analyzing security footage, access logs). However, they must adhere to other legal obligations, including respecting privacy and complying with GDPR regulations.
2. Conditions for Conducting Investigations
Transparency regarding the investigation procedure:
- Investigations must be explicitly permitted and regulated in an internal policy: the preparatory works give the examples of the internal work rules, a collective bargaining agreement or a decision of the works council. The preparatory works also mention the obligation to consult the social partners. In the Private sector, it could still be possible to lay down the rules in a policy, if the works council or other social dialogue bodies are consulted in advance. Public employers must comply with the applicable provisions regarding consultation of the social partners
- Employers have until December 16, 2026, to comply with this regulation requirement. If there is no policy by this deadline, all internal investigations and its findings will be null and void.
Investigators/Internal Investigation Services:
- Must possess a valid license issued by the Ministry of Home Affairs (except HR personnel, see above).
- Are required to comply with legal stipulations, including adherence to ethical standards and avoiding conflicts of interest.
- Investigators must verify that the purpose of their assignment serves legitimate interest.
3. Execution of Private Investigations
Private investigators have limited powers, akin to regular citizens. They must adhere to the following:
- Prohibited Methods:
- Using investigation methods that are reserved for the police or security forces.
- Entering private property without explicit consent.
- Observing private areas (e.g., homes, restrooms).
- Using deceptive or provocative techniques.
- Creating the impression during an interview that the targeted person is not free to answer as he/she wishes.
- Using or otherwise processing information or evidence:
- which he has obtained himself or by a crime or in an unlawful manner.
- of which he knew or should reasonably have known that they were obtained by a crime in an unlawful manner.
- The private investigator is prohibited from inciting other persons to obtain information or evidence unlawfully.
- Transparency Requirements:
- Obtain written consent from involved individuals for interviews or reconstructions.
- Provide clear information about the purpose and rules of the interview.
- Specific requirements for background checks regarding the civil, family, financial or professional situation of a person, e.g. to verify whether someone is suitable for recruitment: only if the person is informed about the identity of the employer, the reason of the investigation and with the written consent of the person.
- Documentation:
- Create a detailed investigation assignment document and maintain a case file for regulatory review.
- Deliver a final report to the employer within one month after the investigation.
- The report can only be used if it is strictly necessary to defend the legitimate interest(s) of the employer. It is prohibited to disclose the content to third parties.
- The employer must decide (and notify the investigator) within
30 days after receiving the final report if he wishes to use it. If
not, the report must be destroyed immediately. If yes, the
investigator must inform the targeted person and any other
identifiable person of:
- the identity and contact details of the controller or its representative;
- the nature and purpose of the processing of their personal data;
- the start and end date of the private investigation;
- his right to access, add, rectify or delete incorrect personal data free of charge.
4. Data Handling and Privacy
Private investigation activities must comply with the GDPR (General Data Protection Regulation):
- Employers, investigators, and investigation services are designated as joint data controllers.
- Consent must be specific, informed, and documented.
- Investigations into sensitive personal data (e.g., political beliefs, health) are prohibited unless explicitly justified.
- Registers must be retained for five years and destroyed after this period.
- Case files must be retained for three years and destroyed after this period
5. Control and Sanctions
Oversight:
- Compliance monitored by data protection authorities, police, and designated inspectors.
- Inspectors have broad powers to investigate breaches of the law.
Sanctions:
Non-compliance may result in administrative fines, nullification of evidence, and/or legal proceedings.
To repeat, the violation of the following rules will result in the nullification of all findings :
- Licence obligation (art. 7 et seq.);
- Internal regulations regarding private investigations (art. 65);
- Prohibited research topics (art. 57);
- Prohibited investigative means, methods, procedures (art. 80 et seq.);
- Rules regarding observations (art. 87);
- Use by the private investigator of information which he has obtained himself or through a crime or in an unlawful manner; or which he knew or should reasonably have known was obtained by a crime in an unlawful manner (art. 96);
- Use of data by the private investigator obtained from another private investigation case file, unless the investigation is mandated by the same client (employer) (art. 109).
Given that the violation of these rules is sanctioned by nullity means that it will be impossible to use the findings before a court as in this case the so-called Antigoon theory (which allowed the use of irregular evidence under certain circumstances) cannot be applied.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.