Royal Decree of 31 July 2020 Approving the National Bank of Belgium Regulation of 12 May 2020 on the Location for Keeping Insurance or Reinsurance Documents

Royal Decree of 31 July 2020 Approving the Regulation of the National Bank of Belgium of 12 May 2020 on the Location for Keeping Insurance or Reinsurance Documents (MB 11 September 2020 Unofficial Coordination 11 September 2020)

Royal Decree of 31 July 2020 Approving the Regulation of the National Bank of Belgium of 12 May 2020 Concerning the Storage Location of Insurance or Reinsurance Documents (BS 11 September 2020 Unofficial Coordination 11 September 2020)

PHILIPPE, King of the Belgians, To all, present and future, Greetings.

FILIP, King of the Belgians, To all who are now and hereafter shall be, Our Greetings.

Having regard to the Law of 22 February 1998 laying down the organic statute of the National Bank of Belgium, Article 12bis;

Having regard to the Law of 13 March 2016 on the status and supervision of insurance and reinsurance undertakings, Articles 76 and 588, § 1, 2°;

Having regard to the Law of 4 April 2014 on insurance, Article 14;

On the proposal of the Minister of Economy and Consumers,

We have decided and decide:

Article 1. The Regulation of the National Bank of Belgium on the location for keeping insurance or reinsurance documents, annexed to this Royal Decree, is approved.

Article 2. The Minister responsible for the Economy is charged with the execution of this Royal Decree.

Given at Brussels, 31 July 2020

By the King: Minister of Economy and Consumers, Nathalie MUYLLE

---

Regulation of the National Bank of Belgium of 12 May 2020 on the Location for Keeping Insurance or Reinsurance Documents

The National Bank of Belgium,

Having regard to the Law of 22 February 1998 laying down the organic statute of the National Bank of Belgium, Article 12bis;

Having regard to the Law of 13 March 2016 on the status and supervision of insurance and reinsurance undertakings, Articles 76 and 588;

Having regard to the Law of 4 April 2014 on insurance, Article 14;

Having regard to the consultation with the Financial Services and Markets Authority (FSMA) and with the professional union of insurance and reinsurance undertakings, Assuralia,

Decrees:

Section I. — Definitions

Article 1. For the purposes of this Regulation, the following terms shall be understood as follows:

1° Bank: the National Bank of Belgium;

2° electronic storage: storage on a digital, photographic, microphotographic, magnetic, or optical medium;

3° insurance or reinsurance documents: all documents relating to the activities of insurance or reinsurance undertakings corresponding to the originals. This includes in particular (i) insurance or reinsurance contracts (policies and endorsements), (ii) letters sent to policyholders by these undertakings, and (iii) prudential reporting required by or pursuant to the Law of 13 March 2016 on the status and supervision of insurance and reinsurance undertakings for prudential supervision purposes, and (iv) reporting required by or pursuant to the Law of 4 April 2014 on insurance;

4° EEA: European Economic Area;

5° insurance or reinsurance undertakings: insurance or reinsurance undertakings under Belgian law within the meaning of Article 5, 1°, of the Law of 13 March 2016 on the status and supervision of insurance and reinsurance undertakings, including their branches established abroad, as well as branches established in Belgium of insurance undertakings subject to the law of a third country;

6° FSMA: the Financial Services and Markets Authority;

7° GDPR or 'General Data Protection Regulation': Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;

8° Law of 13 March 2016: the Law of 13 March 2016 on the status and supervision of insurance and reinsurance undertakings;

9° Law of 4 April 2014: the Law of 4 April 2014 on insurance;

10° originals: all paper or electronic documents as well as digital or other copies (on photographic, microphotographic, magnetic, electronic, or optical media) of paper documents insofar as these copies are equated with the originals pursuant to a legal provision;

11° third country: a State that is not a party to the EEA Agreement;

12° Delegated Regulation 2015/35: the Commission Delegated Regulation of 10 October 2014 supplementing Directive 2009/138/EC of the European Parliament and of the Council on the access to and exercise of the activities of insurance and reinsurance;

13° registered office: (i) the registered office of the Belgian insurance or reinsurance undertaking or its actual seat located in Belgium, or (ii) the operational seat located in an EEA Member State of the branch of the Belgian insurance or reinsurance undertaking, or (iii) the operational seat located in Belgium of the Belgian branch of the insurance or reinsurance undertaking subject to the law of a third country.

Section II — Files on the Storage of Insurance or Reinsurance Documents at a Location Other Than the Registered Office and Subject to a Simplified Authorization Procedure

Subsection 1 – Electronic Storage

Article 2. § 1. Insurance or reinsurance undertakings that intend to store their insurance or reinsurance documents electronically in a data center or a 'cloud' located at a place other than their registered office, which is situated in Belgium or in the EEA, may benefit from a simplified authorization procedure if they meet the following conditions:

1. the insurance or reinsurance undertakings have permanent access to the documents stored in the data center or 'cloud';

2. the insurance or reinsurance undertakings are able to respond in a complete and adequate manner and with speed (i.e., within two working days from the request) to access requests from the Bank, the FSMA, or the Belgian judicial authorities;

3. the insurance or reinsurance undertakings retain control over significant consequences regarding their risk profile, including if these depend on decisions taken by the service provider at the level of the data center or 'cloud'. This means that insurance or reinsurance undertakings must have the possibility to terminate the contract and transfer the relevant insurance or reinsurance documents to another system before the aforementioned modifications are implemented if they do not accept them;

4. regarding the insurance or reinsurance documents, the data center or 'cloud' (i) guarantees the integrity and availability of the documents stored there, (ii) guarantees the confidentiality of the insurance documents and the protection of personal data in accordance with the GDPR, and (iii) meets the prudential expectations issued by the Bank regarding IT security and continuity; and

5. if the storage of insurance or reinsurance documents is entrusted to a third party, an agreement is concluded between the two parties to regulate the storage of the documents and the rights and obligations related thereto.

§ 2. To benefit from this simplified authorization procedure, insurance or reinsurance undertakings must submit a file to the Bank comprising (i) a description of how the documents will be stored and (ii) a certificate from the Chairman of the management committee of the undertaking concerned confirming that the conditions set out in § 1 are met.

If electronic storage is subcontracted (in particular of the 'cloud' type), this file may form part of the notification of critical or important outsourcing to be submitted to the Bank pursuant to Article 92 of the Law of 13 March 2016 and Article 274 of Delegated Regulation 2015/35. In addition to the elements that must be included in any outsourcing file, the file referred to in the first paragraph must also include (i) the written agreement concluded with the service provider, (ii) a description of the insurance or reinsurance documents subject to the outsourcing (including but not limited to personal data), (iii) the EEA countries or regions where the insurance or reinsurance documents will be stored, and (iv) in the case of 'cloud' outsourcing, the 'cloud' model (public/private/hybrid/community).

The Bank may request the insurance or reinsurance undertaking to complete its file with the information it deems necessary to rule on the application.

§ 3. When the storage concerns documents relating to insurance contracts taken out by Belgian insurers or, in the case of insurers subject to the law of a third country, documents relating to contracts taken out by Belgian branches or relating to risks located in Belgium, the insurer must also submit this file to the FSMA pursuant to Article 14 of the Law of 4 April 2014. The Bank will consult with the latter before ruling.

§ 4. The Bank shall rule within 8 weeks from the date of receipt of the file, provided that the file can be considered complete within the meaning of paragraph 2 and that the undertaking has also notified the FSMA in accordance with paragraph 3. Upon the expiry of this period and in the absence of notification to the undertaking of a decision by the Bank, an appeal may be lodged with the Council of State. In this latter case, the appeal shall be treated as if the application had been rejected.

§ 5. If an insurance or reinsurance undertaking begins to store its insurance or reinsurance documents at a location other than its registered office without having previously obtained the Bank's agreement, the Bank has the possibility of taking administrative measures or imposing administrative sanctions pursuant to the Law of 13 March 2016.

§ 6. In the event of a major change to the storage system compared to the information included in the initial file, insurance or reinsurance undertakings must immediately inform the Bank and the FSMA.

Subsection 2 – Paper Storage

Article 3. § 1. Insurance or reinsurance undertakings that intend to store their insurance or reinsurance documents on paper at a location other than their registered office, insofar as that other location is situated in Belgium or in the EEA, may benefit from a simplified authorization procedure if they meet the following conditions:

1. documents relating to the same portfolio of activities are stored in the same place;

2. the storage location(s) must be accessible to the Bank, the FSMA, and the judicial authorities and must comply with fire protection measures to guarantee the integrity of the documents;

3. if not all documents are also stored on IT media located in Belgium or in the EEA offering guarantees of security and confidentiality, the storage location(s) must be situated in Belgium;

4. security and continuity measures must be subject to periodic control by the insurance or reinsurance undertaking; and

5. in the event of outsourcing, an agreement is concluded between the two parties to regulate the storage of the documents and the rights and obligations related thereto.

§ 2. To benefit from the simplified authorization procedure, insurance or reinsurance undertakings must submit a file comprising (i) a description of the planned storage system and (ii) a certificate from the Chairman of the management committee of the undertaking concerned confirming that the conditions set out in § 1 are met.

If paper storage is subcontracted, this file may form part of the notification of critical or important outsourcing to be submitted to the Bank pursuant to Article 92 of the Law of 13 March 2016 and Article 274 of Delegated Regulation 2015/35. In addition to the elements that must be included in any outsourcing file, the file referred to in the first paragraph must also include (i) the written agreement concluded with the service provider, (ii) a description of the insurance or reinsurance documents subject to the outsourcing (including but not limited to personal data), (iii) the EEA countries or regions where the insurance or reinsurance documents will be stored, and (iv) in the case of 'cloud' outsourcing, the 'cloud' model (public/private/hybrid/community).

The Bank may request the insurance or reinsurance undertaking to complete its file with the information it deems necessary to rule on the application.

§ 3. When the storage concerns documents relating to insurance contracts taken out by Belgian insurers or, in the case of insurers subject to the law of a third country, documents relating to contracts taken out by Belgian branches or relating to risks located in Belgium, the insurer must also submit this file to the FSMA pursuant to Article 14 of the Law of 4 April 2014. The Bank will consult with the latter before ruling.

§ 4. The Bank shall rule within 8 weeks from the date of receipt of the file, provided that the file can be considered complete within the meaning of paragraph 2 and that the undertaking has also notified the FSMA in accordance with paragraph 3. Upon the expiry of this period and in the absence of notification to the undertaking of a decision by the Bank, an appeal may be lodged with the Council of State. In this latter case, the appeal shall be treated as if the application had been rejected.

§ 5. If an insurance or reinsurance undertaking begins to store its insurance or reinsurance documents at a location other than its registered office without having previously obtained the Bank's agreement, the Bank has the possibility of taking administrative measures or imposing administrative sanctions pursuant to the Law of 13 March 2016.

§ 6. In the event of a major change to the storage system compared to the information included in the initial file, insurance or reinsurance undertakings must immediately inform the Bank and the FSMA.