APD/GBA (Belgium) - 154/2023

APD/GBA - 154/2023
Authority:	APD/GBA (Belgium)
Jurisdiction:	Belgium
Relevant Law:	Article 5(1)(b) GDPR Article 5(1)(c) GDPR CLA nr. 68 on Camera Surveillance at Work
Type:	Complaint
Outcome:	Upheld
Started:	06.10.2023
Decided:	23.11.2023
Published:	28.11.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	154/2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Dutch
Original Source:	APD / GBA (in NL)
Initial Contributor:	Matthias Vandamme

The Belgian data protection authority held that the constant surveillance of employees in a shop by CCTV was in violation of the principle of data minimisation (Article 5(1)(c) GDPR), as the surveillance was not necessary for maintaining security.

English Summary

Facts

On 6 October 2023, an employee (data subject) in a shop lodged a complaint with the Belgian DPA against their employer. The employer (controller) had installed several surveillance cameras in their six shops.

In the complaint, the data subject alleged that the cameras were installed in such a way as to place employees under constant surveillance, contrary to the stated purpose of the cameras, which was to provide security in the event of theft or aggression.

The data subject claimed that they received regular comments from the security company in relation to their performance at work. In the complaint, the data subject submitted that the surveillance was in violation of Collective Labour Agreement (CLA) No. 68 (on the protection of workers' privacy with regard to camera surveillance in the workplace).

Holding

The Belgian DPA found that the camera surveillance was in violation of the principle of data minimisation (Article 5(1)(c) GDPR) and CLA No. 68.

In this decisions, many references are made to CLA 68 on camera surveillance in the workplace. This is an important collective labour agreement for Belgian companies in the private sector as it lists the five purposes for which camera surveillance is permitted in the workplace:

• Safety and health;
• Protection of property;
• Monitoring the production process (machines only);
• Monitoring the production process (employees);
• Monitoring employee performance.

The CLA states that for the last two purposes, camera surveillance cannot be continuous. As such, the controller's use of continuous surveillance was in violation of CLA No. 68.

Moreover, the purpose of the cameras communicated to the employees was security, not the evaluation of employees' performance. Consequently, the continuous monitoring of employees was not necessary for the purpose of maintaining security in the shops, and as such, was a violation of Article 5(1)(c) GDPR.

The Belgian DPA acknowledged that the surveillance was also a violation of Article 8 ECHR (right to private life), and referred to the European Court of Human Rights (ECtHR) case of Antović and Mirković v. Montenegro. This case also concerned CCTV surveillance in the workplace. Here the European Court of Human Rights held that covert video surveillance of employees at their workplace was a considerable intrusion into their private life, and thus was a violation of Article 8 ECHR.

As a result, the Belgian DPA issued a warning to the shop owner and recommended that they should take steps to adequately inform employees about the purposes of camera surveillance.

Comment

As this is a 'prima facie' decision, not much information is available. In the decision, the Belgian DPA makes several references to the surveillance company. It emphasises that the monitoring company is the processor and the shop owner is the controller. They must then enter into a data processing agreement in which the processor is instructed on how to act. It is not known whether such an agreement exists.

In this case, the Belgian DPA did not address the filming of customers. For the sake of completeness, it should be noted that the Belgian Camera Act must also be complied with.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

1/7






                                                                                 Dispute Chamber


                                                   Decision 154/2023 of November 23, 2023



File number: DOS-2023-04114


Subject: Camera surveillance in store to which staff are subject



The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,

sole chairman;


Having regard to Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on

the protection of natural persons in connection with the processing of personal data and

on the free movement of such data and repealing Directive 95/46/EC (general

Data Protection Regulation), hereinafter GDPR;


In view of the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;



In view of the internal order regulations, as approved by the Chamber of Representatives

on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;


Considering the documents in the file;





has made the following decision regarding:
                                                                                                  .

Complainant: The complainant who wishes to remain anonymous, hereinafter “the complainant”; .

                                                                                                  .
The defendant: Y, hereinafter “the defendant” Decision 154/2023 - 2/7


I. Facts and procedure



    1. On 6 October 2023, the complainant filed a complaint with the Data Protection Authority against the

        defendant.


    2. The subject of the complaint concerns the installation of surveillance cameras in the six stores of the

        defendant. The complaint states that the cameras have been placed in such a way that

        personnel are permanently supervised, which would not be in accordance with

        the purpose of the cameras aimed at ensuring safety in the event of theft or

        aggression. The staff members would regularly receive comments from the security company

        which places the staff under permanent supervision. This would be contrary to the complaint

        with collective labor agreement no. 68 of 16 June 1998 on the protection of privacy of

        employees in relation to camera surveillance in the workplace.


    3. On October 23, 2023, the complaint will be declared admissible by the First Line Service on the basis of

        Articles 58 and 60 WOG and the complaint is filed on the basis of art. 62, §1 WOG transferred to the

        Dispute Chamber . 2





II. Justification


    a) Controller and processor



    4. First of all, the Disputes Chamber explains that it is authorized to hear this complaint

        refers to the surveillance cameras managed by the security company as
                   3
        processor on behalf of the defendant who has the capacity of
                                         4
        controller .The Disputes Chamber reminds that the defendant does so









1In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint has been declared admissible.
2
 In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file has been
this complaint has been transferred to her.
3Article 4 GDPR.

For the purposes of this Regulation the following definitions apply:

[…]
(8) 'processor' means a natural or legal person, public authority, agency or other body which, for the purpose of
the controller processes personal data;
4
 Article 4 GDPR;
For the purposes of this Regulation the following definitions apply:

[…]
7) 'controller' means a natural or legal person, public authority, agency or other body
who, alone or jointly with others, determines the purposes and means of the processing of personal data; when the

the purposes and means of such processing are determined by Union or Member State law, it may be stated therein
determines who the controller is or according to what criteria he is designated; Decision 154/2023 - 3/7



        is obliged to rely on a processor who complies with the provisions of the GDPR (Article 28.1

        GDPR) and concludes an agreement with the processor (Article 28.3 GDPR).

    5. To the extent that this decision involves data processing through registration of the camera images

        is assessed, it should be noted that this data processing falls under the

        responsibility of the defendant requires an adjustment to the conduct - and therefore the

        how the images are processed – by the processor.



    b) Camera surveillance


    6. The Disputes Chamber clarifies that the subject of the complaint only relates to the

        staff and therefore customers as such are not taken into account, in such a way that in this decision

        the applicable legal provisions on images processed from

        customers or other third parties. The Disputes Chamber has established that with regard to camera surveillance

        in the workplace, which targets the people who work there, the GDPR
                                                                                                        5
        applies, with a number of additional specific requirements as collective labor agreement no. 68

        as far as the private sector is concerned.

    7. Collective labor agreement no. 68 was concluded before the GDPR became applicable on May 25, 2018,

        but applies a number of principles whose compliance is mandated by the GDPR, including

        in particular the purpose limitation principle (Article 5.1 b) GDPR) and the principle of minimum

        data processing (Article 5.1 c) GDPR). This follows from both provisions of the GDPR

        camera surveillance with a view to ensuring safety and with a view to

        protection of the company's goods against theft – in this case the objectives are those

        are being pursued by the camera surveillance according to the complainant - although it is permitted and in

        is in accordance with the purpose limitation principle, but this must be done in such a way

        organized so that staff members are not permanently exposed to

        camera surveillance so that their work performance is monitored at any time,
        in order to respect the principle of minimal data processing. Thecontroloflabour

        of the employees is, after all, a purpose that can be distinguished from insurance

        of security and protection against theft. Camera surveillance allowing control of the

        After all, work takes place continuously is not in accordance with the principle of

        minimal data processing. The documents added to the complaint show that

        security company permanently monitors its employees.










5Collective Agreement No. 68 of 16 June 1998 on the protection of the privacy of employees
compared to camera surveillance in the workplace. Decision 154/2023 - 4/7


                                                                                                      6
    8. In the same sense, the European Court of Human Rights ruled on November 28, 2017

        in a case involving camera surveillance in the workplace that there had been a

        violation of Article 8 of the Treaty, and found that camera surveillance was not in place

        had been in accordance with the law. The Court noted that private life also

        may include professional activities and was of the opinion that this was also the case with the applicants.

        Article 8 therefore applied. As to the merits of the case, the Court ruled

        then that the camera surveillance constituted an infringement of the applicants' right to privacy and that
        the evidence showed that this supervision had been contrary to the provisions of national

        straight.


    9. The Disputes Chamber is of the opinion that on the basis of the above analysis

        concluded that the defendant committed an infringement of the provisions of the GDPR,

        which justifies making a decision on the basis in this case

        of Article 95, §1, 4° WOG, more specifically to warn the defendant that subjecting

        the staff members have permanent camera surveillance so that there is continuous control over the

        performance provided constitutes a violation of Article 5.1 c) GDPR. It belongs to the

        responsibility of the defendant to make agreements about this with the

        security company as processor (see edge no. 4).


    10. The Disputes Chamber is of the opinion that the defendant must be given the opportunity to:

        to adjust its actions in response to this first complaint, so that in the future

        similar facts and possibly new complaints about them can be avoided.
        Nevertheless, the Disputes Chamber points out that it concerns a serious infringement, but because it is

        As it concerns a relatively small company, she sees it from now on to proceed to treatment

        ground. In order to provide the defendant with the necessary instructions to file new complaints

        prevent, the Disputes Chamber formulates the recommendation that:


        – the defendant takes measures to ensure that the staff is properly informed

        about the purposes for which the surveillance cameras are used and to the extent that these

        an audit of work performance takes the necessary measures to ensure that a

        permanent control is excluded;


        – and that the measures taken are communicated to the Disputes Chamber.





6Case of ANTOVIĆ and MIRKOVIĆ v. MONTENEGRO, November 28, 2017 (judgment):

This case involved a complaint about an invasion of privacy by two professors from the University of Montenegro's School for
Mathematics after video surveillance was installed in the places where they taught. They stated that they had no effective control
about the information collected and that the supervision had been unlawful. However, the national courts rejected a claim
for damages, because they felt that the issue of private life had not been at stake, since the auditoriums where the
the applicants taught were public spaces. The Court also rejected the government's argument that the case was inadmissible because
there was no privacy issue involved as the monitored area had been a public work area. Decision 154/2023 - 5/7



    11. This decision is a prima facie decision taken by the Disputes Chamber

         in accordance with Article 95WOG on the basis of the complaint submitted by the complaint, in the context of

         the 'procedure prior to the decision on the merits' and not a decision on the merits of the

         Dispute Chamber within the meaning of Article 100 of the WOG.


    12. The purpose of this decision is to inform the defendant of the fact that

         may have committed an infringement of the provisions of the GDPR and has the opportunity to do so

         still agree to comply with the aforementioned provisions.


    13. However, if the defendant does not agree with the content of this prima facie case

         decision and are of the opinion that these factual and/or legal arguments can be valid

         that could lead to a different decision, they can be done via the e-mail address

         litigationchamber@apd-gba.be send a request for a hearing on the merits of the case to the

         Disputes Chamber within 30 days of notification of this decision. The

         Implementation of this decision will, if necessary, take place during the aforementioned period

         suspended.


    14. In the event of a continuation of the merits of the case, the Disputes Chamber will

         the parties pursuant to Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their

         submit defenses and add any documents they consider useful to the file. The

         If necessary, this decision will be permanently suspended.

    15. The Disputes Chamber rejects this for the sake of completeness so that a thorough treatment of the case can be done

         lead to the imposition of the measures stated in Article 100 of the WOG. 8


    16. Finally, the Disputes Chamber points out the following:







7
 Section 3, Subsection 2 WOG (Articles 94 to 97).
81° to dismiss a complaint;
 2° to order the dismissal of prosecution;

 3° order the suspension of the ruling;
 4° to propose a settlement;
 5° formulate warnings and reprimands;
 6° order that the data subject's requests to exercise his rights be complied with;
 7° to order that the person concerned is informed of the security problem;
 8° order that processing be temporarily or permanently frozen, restricted or prohibited;
 9° to order that the processing be brought into compliance;

 10° the rectification, restriction or deletion of data and its notification to the recipients of the data
recommend data;
 11° order the withdrawal of the recognition of certification bodies;
 12° to impose penalty payments;
 13° to impose administrative fines;
 14° the suspension of cross-border data flows to another State or an international institution
command;
 15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the

follow-up given to the file;
 16° decide on a case-by-case basis to publish its decisions on the website of the
Data Protection Authority. Decision 154/2023 - 6/7



        If either party wishes to make use of the option to consult and

        copying the file (art. 95, §2, 3° WOG), he must contact the secretariat
        of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment

        to capture.

        If a copy of the file is requested, the documents will be sent electronically if possible

        or otherwise delivered by regular mail.




III. Publication of the decision


    17. Considering the importance of transparency with regard to decision-making

        Dispute Chamber, this decision will be published on the website of the

        Data Protection Authority. However, it is not necessary to provide identification data for this purpose

        of the parties are communicated directly.






   FOR THESE REASONS,

   the Disputes Chamber of the Data Protection Authority will decide, subject to the

   submission of a request by the controller for substantive treatment

   in accordance with Article 98 et seq. of the WOG, in order to do so on the basis of art. 58.2. a) GDPR and Art. 95, §1, 4° WOG, de

   to warn the defendant that the intended processing is similar to that used

   is the subject of the present complaint, an infringement of Article 5.1 c) GDPR is made.




























9
  Due to the extraordinary circumstances due to COVID-19, the option of collection at the
secretariat of the Disputes Chamber NOT provided. Furthermore, all communication takes place electronically in principle. Decision 154/2023 - 7/7



Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification

This decision will be appealed to the Market Court (Brussels Court of Appeal), with the

Data Protection Authority as defendant.



Such an appeal can be lodged by means of an inter partes petition stating the conditions referred to in Article

1034ter of the Judicial Code must contain the entries listed. The petition 10

contradiction must be submitted to the registry of the Market Court in accordance with Article

1034quinquies of the Ger.W. , or via the e-Deposit IT system of Justice (Article 32ter

of the Ger.W.).







(get). Hielke Hijmans

Chairman of the Disputes Chamber












































10The petition states, under penalty of nullity:

  1° the day, month and year;
  2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
     company number;
  3° the surname, first name, place of residence and, where applicable, the capacity of the person to be summoned;
  4° the subject matter and brief summary of the grounds of the claim;
  5° the judge before whom the claim is brought;
  6° the signature of the applicant or his lawyer.

11The petition with its appendix will be sent by registered letter, in as many copies as there are parties involved, to the
registrar of the court or deposited at the registry.