Belgian DPA fine for unlawful processing of video images

Nov 24, 2020

Source: European Data Protection Board

The Belgian DPA imposed a fine of 1,500 EUR for unlawful processing of personal data made via a video surveillance system. The positioning of the cameras of this video system also constituted an infringement of the data protection by design principle, the DPA concluded.  

The facts
Two complainants had filed a complaint with the Belgian DPA with regard to the video surveillance system of their two neighbours, as well as the further use of the images made by the system.  The complainants demanded that the video surveillance system would be taken down.
The two defendants had installed a video surveillance system with five surveillance cameras (filming 24/7) on their private property. Two cameras that were mentioned in the complaint were positioned in such a way that those cameras filmed the public road or the private property of the complainants and had filmed at least one of the complainants while driving on the public road or entering private property of their own.
The images were used by the defendants in a dispute procedure between the defendants and the complainants regarding environmental planning.
In the same dispute procedure,  a photograph with the image of one of the complainants was used. The complainants thought this was a still image originally made by the video surveillance system, but the photograph turned out to be made by one of the defendants with a smartphone.

Role of national law concerning video surveillance cameras
A law of 21 March 2007 regulates the positioning and use of video surveillance cameras. Although the Belgian DPA is technically competent to take into account the provisions of the law, as it did in its decision to specify certain viewpoints, the primacy of the GDPR as EU law resulted in the decision that a priori analysed potential breaches of the GDPR.

Decision of the Litigation Chamber
The litigation chamber of the Belgian DPA upheld that:

–    the images with personal data made by two of the five surveillance cameras were not processed in a lawful way under article 6.1.f. GDPR, as there were legitimate interests for the defendants to protect their own private property, but the filming of large parts of the public road, as well as the filming of the private property of the complainants, was not deemed necessary to safeguard those legitimate interests. Moreover, the Belgian DPA found the interests of the defendants to process personal data through the two surveillance cameras to be overridden by the interests, fundamental rights and freedoms of the complainants;
–    the transfer of images made by the two surveillance cameras containing personal data in the context of the dispute procedure, constituted a breach of article 6.1. GDPR, as the images were unlawfully made in the first place, thus constituting unlawful processing impacting the further processing;
–    the making of a photograph of one of the complainants by one of the defendants, and the further processing thereof, was lawful under article 6.1. GDPR, as the processing was necessary for the defendants to safeguard a legitimate interest, and the latter interest was not overridden by the interests, fundamental rights and freedoms of the data subject;
–    as the two surveillance cameras were wrongfully positioned, resulting in the unlawful processing of images containing personal data, the defendants infringed article 25.1. GDPR .

The Litigation Chamber of the BE DPA therefore imposed a fine of 1,500 EUR for the infringements of article 6 GDPR. In addition, the Litigation Chamber issued a reprimand to the defendants for not respecting article 25.1. GDPR while placing their video surveillance system.

To read the original press release in French, click here. For Dutch, click here

To read the full decision (currently only available in Dutch), click here

Fur further information, please contact the Belgian DPA: contact@apd-gba.be

The press release published here does not constitute official EDPB communication, nor an EDPB endorsement. This press release was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. As the press release is represented here as it appeared on the SA’s website or other channels of communication, the news item is only available in English or in the Member State’s official language with a short introduction in English. Any questions regarding this press release should be directed to the supervisory authority concerned.

Recent news

EDPB calls for coherence of digital legislation with the GDPR

Brussels, 04 December - During its December 2024 plenary, the European Data Protection Board (EDPB) adopted a statement on the second report of the European Commission on the application of the General Data Protection Regulation (GDPR).* In its statement, the EDPB...

read more

EDPB stakeholder event AI models

The EDPB is holding a stakeholder event on “AI models” with participants representing European sector associations, organisations, NGOs, individual companies, law firms and academics.    During today’s event, the EDPB will collect input for of the preparation of a...

read more