APD/GBA (Belgium) - 154/2023
From GDPRhub
| APD/GBA - DOS-2023-04114 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(b) GDPR Article 5(1)(c) GDPR CLA nr. 68 on Camera Surveillance at Work |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 06.10.2023 |
| Decided: | 23.11.2023 |
| Published: | 28.11.2023 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | DOS-2023-04114 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD / GBA (in NL) |
| Initial Contributor: | Matthias Vandamme |
The Belgian data protection authority ruled that employees should not be kept under constant surveillance by CCTV with the aim of monitoring the performance of employees.
English Summary
Facts
A shop owner installed several surveillance cameras in his six shops. One of his employees lodged a complaint alleging that the cameras were installed in such a way as to place employees under constant surveillance, contrary to the stated purpose of the cameras, which was to provide security in the event of theft or aggression. The employee claims that they receive regular comments from the security company, which would result in the employees being under constant surveillance. According to the complaint, this would violate Collective Labour Agreement (CLA) No. 68 on the Protection of Workers' Privacy with Regard to Camera Surveillance in the Workplace.
Holding
The APD/GBA only ruled on the filming of the employees and left the customers that might be filmed out of scope.
The APD/GBA found that camera surveillance, which involves the continuous monitoring of employees, does not comply with the principle of minimum data processing. The security company continuously monitors the employees, as evidenced by the documents attached to the complaint.
The APD/GBA referred to the European Court of Human Rights case of Antović and Mirković v. Montenegro, 28 November 2017, which also concerned CCTV surveillance in the workplace and in which the ECHR found a violation.
The APD/GBA issued a warning to the shop owner that subjecting employees to permanent camera surveillance, which allows continuous monitoring of their performance, is a violation of Article 5(1)(c) GDPR. It also issued a recommendation that the shop owner should take steps to adequately inform employees about the purposes for which the cameras are used, and how to avoid continuous surveillance if one of the purposes is to monitor performance. The shop owner should inform the APD/GBA of the measures taken.
This is a 'prima facie' decision. This means that there has been no procedure on the merits of the case. The APD/GBA said it did not consider this necessary because the offender was a small business. This decision is intended to help the shop owner to improve.
Comment
As this is a 'prima facie' decision, not much information is available. In the decision, the APD/GBA makes several references to the surveillance company. It emphasises that the monitoring company is the processor and the shop owner is the controller. They must then enter into a data processing agreement in which the processor is instructed on how to act. It is not known whether such an agreement exists. Reading between the lines, one might think that the surveillance company overstepped its bounds.
In this case, many references are made to CLA 68 on camera surveillance in the workplace. This is an important document for Belgian companies in the private sector as it lists the five purposes for which camera surveillance is permitted: - Safety and health; - Protection of property; - Monitoring the production process (machines only); - Monitoring the production process (employees); - Monitoring employee performance.
The CLA states that for the last two purposes, camera surveillance can't be permanent.
In this case, the APD/GBA didn't deal with the filming of customers. For the sake of completeness, it should be noted that the Belgian Camera Act must also be complied with.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/7
Dispute Chamber
Decision 154/2023 of November 23, 2023
File number: DOS-2023-04114
Subject: Camera surveillance in store to which staff are subject
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans,
sole chairman;
Having regard to Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on
the protection of natural persons in connection with the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (general
Data Protection Regulation), hereinafter GDPR;
In view of the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG;
In view of the internal order regulations, as approved by the Chamber of Representatives
on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019;
Considering the documents in the file;
has made the following decision regarding:
.
Complainant: The complainant who wishes to remain anonymous, hereinafter “the complainant”; .
.
The defendant: Y, hereinafter “the defendant” Decision 154/2023 - 2/7
I. Facts and procedure
1. On 6 October 2023, the complainant filed a complaint with the Data Protection Authority against the
defendant.
2. The subject of the complaint concerns the installation of surveillance cameras in the six stores of the
defendant. The complaint states that the cameras have been placed in such a way that
personnel are permanently supervised, which would not be in accordance with
the purpose of the cameras aimed at ensuring safety in the event of theft or
aggression. The staff members would regularly receive comments from the security company
which places the staff under permanent supervision. This would be contrary to the complaint
with collective labor agreement no. 68 of 16 June 1998 on the protection of privacy of
employees in relation to camera surveillance in the workplace.
3. On October 23, 2023, the complaint will be declared admissible by the First Line Service on the basis of
Articles 58 and 60 WOG and the complaint is filed on the basis of art. 62, §1 WOG transferred to the
Dispute Chamber . 2
II. Justification
a) Controller and processor
4. First of all, the Disputes Chamber explains that it is authorized to hear this complaint
refers to the surveillance cameras managed by the security company as
3
processor on behalf of the defendant who has the capacity of
4
controller .The Disputes Chamber reminds that the defendant does so
1In accordance with Article 61 of the WOG, the Disputes Chamber hereby informs the parties that the complaint has been declared admissible.
2
In accordance with Article 95, § 2 of the WOG, the Disputes Chamber hereby informs the parties that the file has been
this complaint has been transferred to her.
3Article 4 GDPR.
For the purposes of this Regulation the following definitions apply:
[…]
(8) 'processor' means a natural or legal person, public authority, agency or other body which, for the purpose of
the controller processes personal data;
4
Article 4 GDPR;
For the purposes of this Regulation the following definitions apply:
[…]
7) 'controller' means a natural or legal person, public authority, agency or other body
who, alone or jointly with others, determines the purposes and means of the processing of personal data; when the
the purposes and means of such processing are determined by Union or Member State law, it may be stated therein
determines who the controller is or according to what criteria he is designated; Decision 154/2023 - 3/7
is obliged to rely on a processor who complies with the provisions of the GDPR (Article 28.1
GDPR) and concludes an agreement with the processor (Article 28.3 GDPR).
5. To the extent that this decision involves data processing through registration of the camera images
is assessed, it should be noted that this data processing falls under the
responsibility of the defendant requires an adjustment to the conduct - and therefore the
how the images are processed – by the processor.
b) Camera surveillance
6. The Disputes Chamber clarifies that the subject of the complaint only relates to the
staff and therefore customers as such are not taken into account, in such a way that in this decision
the applicable legal provisions on images processed from
customers or other third parties. The Disputes Chamber has established that with regard to camera surveillance
in the workplace, which targets the people who work there, the GDPR
5
applies, with a number of additional specific requirements as collective labor agreement no. 68
as far as the private sector is concerned.
7. Collective labor agreement no. 68 was concluded before the GDPR became applicable on May 25, 2018,
but applies a number of principles whose compliance is mandated by the GDPR, including
in particular the purpose limitation principle (Article 5.1 b) GDPR) and the principle of minimum
data processing (Article 5.1 c) GDPR). This follows from both provisions of the GDPR
camera surveillance with a view to ensuring safety and with a view to
protection of the company's goods against theft – in this case the objectives are those
are being pursued by the camera surveillance according to the complainant - although it is permitted and in
is in accordance with the purpose limitation principle, but this must be done in such a way
organized so that staff members are not permanently exposed to
camera surveillance so that their work performance is monitored at any time,
in order to respect the principle of minimal data processing. Thecontroloflabour
of the employees is, after all, a purpose that can be distinguished from insurance
of security and protection against theft. Camera surveillance allowing control of the
After all, work takes place continuously is not in accordance with the principle of
minimal data processing. The documents added to the complaint show that
security company permanently monitors its employees.
5Collective Agreement No. 68 of 16 June 1998 on the protection of the privacy of employees
compared to camera surveillance in the workplace. Decision 154/2023 - 4/7
6
8. In the same sense, the European Court of Human Rights ruled on November 28, 2017
in a case involving camera surveillance in the workplace that there had been a
violation of Article 8 of the Treaty, and found that camera surveillance was not in place
had been in accordance with the law. The Court noted that private life also
may include professional activities and was of the opinion that this was also the case with the applicants.
Article 8 therefore applied. As to the merits of the case, the Court ruled
then that the camera surveillance constituted an infringement of the applicants' right to privacy and that
the evidence showed that this supervision had been contrary to the provisions of national
straight.
9. The Disputes Chamber is of the opinion that on the basis of the above analysis
concluded that the defendant committed an infringement of the provisions of the GDPR,
which justifies making a decision on the basis in this case
of Article 95, §1, 4° WOG, more specifically to warn the defendant that subjecting
the staff members have permanent camera surveillance so that there is continuous control over the
performance provided constitutes a violation of Article 5.1 c) GDPR. It belongs to the
responsibility of the defendant to make agreements about this with the
security company as processor (see edge no. 4).
10. The Disputes Chamber is of the opinion that the defendant must be given the opportunity to:
to adjust its actions in response to this first complaint, so that in the future
similar facts and possibly new complaints about them can be avoided.
Nevertheless, the Disputes Chamber points out that it concerns a serious infringement, but because it is
As it concerns a relatively small company, she sees it from now on to proceed to treatment
ground. In order to provide the defendant with the necessary instructions to file new complaints
prevent, the Disputes Chamber formulates the recommendation that:
– the defendant takes measures to ensure that the staff is properly informed
about the purposes for which the surveillance cameras are used and to the extent that these
an audit of work performance takes the necessary measures to ensure that a
permanent control is excluded;
– and that the measures taken are communicated to the Disputes Chamber.
6Case of ANTOVIĆ and MIRKOVIĆ v. MONTENEGRO, November 28, 2017 (judgment):
This case involved a complaint about an invasion of privacy by two professors from the University of Montenegro's School for
Mathematics after video surveillance was installed in the places where they taught. They stated that they had no effective control
about the information collected and that the supervision had been unlawful. However, the national courts rejected a claim
for damages, because they felt that the issue of private life had not been at stake, since the auditoriums where the
the applicants taught were public spaces. The Court also rejected the government's argument that the case was inadmissible because
there was no privacy issue involved as the monitored area had been a public work area. Decision 154/2023 - 5/7
11. This decision is a prima facie decision taken by the Disputes Chamber
in accordance with Article 95WOG on the basis of the complaint submitted by the complaint, in the context of
the 'procedure prior to the decision on the merits' and not a decision on the merits of the
Dispute Chamber within the meaning of Article 100 of the WOG.
12. The purpose of this decision is to inform the defendant of the fact that
may have committed an infringement of the provisions of the GDPR and has the opportunity to do so
still agree to comply with the aforementioned provisions.
13. However, if the defendant does not agree with the content of this prima facie case
decision and are of the opinion that these factual and/or legal arguments can be valid
that could lead to a different decision, they can be done via the e-mail address
litigationchamber@apd-gba.be send a request for a hearing on the merits of the case to the
Disputes Chamber within 30 days of notification of this decision. The
Implementation of this decision will, if necessary, take place during the aforementioned period
suspended.
14. In the event of a continuation of the merits of the case, the Disputes Chamber will
the parties pursuant to Articles 98, 2° and 3° in conjunction with Article 99 WOG invite their
submit defenses and add any documents they consider useful to the file. The
If necessary, this decision will be permanently suspended.
15. The Disputes Chamber rejects this for the sake of completeness so that a thorough treatment of the case can be done
lead to the imposition of the measures stated in Article 100 of the WOG. 8
16. Finally, the Disputes Chamber points out the following:
7
Section 3, Subsection 2 WOG (Articles 94 to 97).
81° to dismiss a complaint;
2° to order the dismissal of prosecution;
3° order the suspension of the ruling;
4° to propose a settlement;
5° formulate warnings and reprimands;
6° order that the data subject's requests to exercise his rights be complied with;
7° to order that the person concerned is informed of the security problem;
8° order that processing be temporarily or permanently frozen, restricted or prohibited;
9° to order that the processing be brought into compliance;
10° the rectification, restriction or deletion of data and its notification to the recipients of the data
recommend data;
11° order the withdrawal of the recognition of certification bodies;
12° to impose penalty payments;
13° to impose administrative fines;
14° the suspension of cross-border data flows to another State or an international institution
command;
15° to transfer the file to the public prosecutor's office in Brussels, who will inform it of the
follow-up given to the file;
16° decide on a case-by-case basis to publish its decisions on the website of the
Data Protection Authority. Decision 154/2023 - 6/7
If either party wishes to make use of the option to consult and
copying the file (art. 95, §2, 3° WOG), he must contact the secretariat
of the Disputes Chamber, preferably via litigationchamber@apd-gba.be, in order to make an appointment
to capture.
If a copy of the file is requested, the documents will be sent electronically if possible
or otherwise delivered by regular mail.
III. Publication of the decision
17. Considering the importance of transparency with regard to decision-making
Dispute Chamber, this decision will be published on the website of the
Data Protection Authority. However, it is not necessary to provide identification data for this purpose
of the parties are communicated directly.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority will decide, subject to the
submission of a request by the controller for substantive treatment
in accordance with Article 98 et seq. of the WOG, in order to do so on the basis of art. 58.2. a) GDPR and Art. 95, §1, 4° WOG, de
to warn the defendant that the intended processing is similar to that used
is the subject of the present complaint, an infringement of Article 5.1 c) GDPR is made.
9
Due to the extraordinary circumstances due to COVID-19, the option of collection at the
secretariat of the Disputes Chamber NOT provided. Furthermore, all communication takes place electronically in principle. Decision 154/2023 - 7/7
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notification
This decision will be appealed to the Market Court (Brussels Court of Appeal), with the
Data Protection Authority as defendant.
Such an appeal can be lodged by means of an inter partes petition stating the conditions referred to in Article
1034ter of the Judicial Code must contain the entries listed. The petition 10
contradiction must be submitted to the registry of the Market Court in accordance with Article
1034quinquies of the Ger.W. , or via the e-Deposit IT system of Justice (Article 32ter
of the Ger.W.).
(get). Hielke Hijmans
Chairman of the Disputes Chamber
10The petition states, under penalty of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be summoned;
4° the subject matter and brief summary of the grounds of the claim;
5° the judge before whom the claim is brought;
6° the signature of the applicant or his lawyer.
11The petition with its appendix will be sent by registered letter, in as many copies as there are parties involved, to the
registrar of the court or deposited at the registry.
