Belgium

Summary

Belgium presents a moderate crawling risk. Code penal art. 550bis criminalises unauthorised access to an IT system regardless of whether a technical barrier was overcome -- the offence is made out on intent plus absence of authorisation, which is a broader test than Germany or the Netherlands. Web scraping of public pages is not per se criminal, but context (ToS breach, post-C&D continuation) may supply the unauthorised-access element. Belgium was among the last EU states to transpose the DSM Directive; transposition was completed at end of 2023 via amendments to the Code de droit economique (CDE), establishing dual-track TDM exceptions aligned with Arts. 3 and 4 of the Directive, with opt-out by machine-readable means for commercial TDM. The full sui generis database right applies under the CDE. The APD/GBA enforces GDPR robustly and has engaged on scraping in cross-border proceedings (Meta Facebook data-scraping, 2022-2023). The EU AI Act Art. 53 opt-out obligation has been binding since August 2025. A new Belgian Criminal Code (BCC) is being phased in; when fully in force it will subdivide the hacking offence into external and internal access categories (Arts. 524-525 BCC).