APD/GBA (Belgium) - 100/2026
From GDPRhub
| APD/GBA - 100/2026 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 4(11) GDPR Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 5(2) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 12(2) GDPR Article 15 GDPR Article 24(1) GDPR Article 28(3) GDPR Article 12 of the Belgian Camera Act Article 8 of the European Convention on Human Rights |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 11.05.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 100/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD (in NL) |
| Initial Contributor: | dalja10 |
The DPA ordered the management of an apartment complex to verify if it had a legitimate interest to keep and operate surveillance cameras and reprimanded it for failing to inform residents, to respond to an access request and to have an agreement in place with a processor.
English Summary
Facts
A resident (the data subject) filed a complaint with the Belgian DPA (APD) regarding the recording of images within an apartment complex (‘Residence II’) via six surveillance cameras aimed at the shared courtyard and underground garage, as well as the transmission of surveillance videos to a processor and a specific phone application.
Previously, the DPA issued Decision 36/2020 regarding the same processing activities in the apartment complex ‘Residence I’.
The DPA launched an investigation into the processing activities invoked in the complaint.
During the investigation, the DPA identified a controller in charge of the processing activities before 29 September 2020 and emphasised that Decision 36/2020 was addressed to only that controller. Furthermore, it noted that the controller at the time partially complied with the DPA decision 36/2020 by deactivating the surveillance cameras at Residence I and transferring the responsibility for the use of the already installed cameras to the present controller.
The DPA also clarified that the “Y1 Residence” represented by the property manager was the controller starting from October 2020 for the surveillance cameras in Residence II and dismissed the complaint with regard to the other entity named in the complaint.
Holding
Firstly, the DPA found that residents could not freely give their consent under Article 6(1)(a) GDPR in conjunction with Article 4(11) GDPR since the documents provided in relation with the apartment complex stated an obligation of the residents to consent to video surveillance.
Furthermore, the DPA held that the mere presence of the surveillance cameras, even after their deactivation in 2023, and the residents’ lack of control over their functioning constituted a violation of the residents’ right to private life under Article 8 of the European Convention on Human Rights.
Therefore, the DPA held that the current controller must decide whether to use the surveillance cameras or not, but may only do so under a legitimate interest according to Article 6(1)(f) GDPR in the absence of valid consent from the residents. In that sense, the controller must carry out a balancing of interests for each of the surveillance cameras. Thus, the DPA ordered the controller to bring its processing activities into compliance by verifying if it may rely on legitimate interest as a legal basis.
Secondly, the DPA reprimanded the controller for three categories of infringements.
On one hand, the DPA held that the controller breached the transparency principle in Article 5(1)(a) GDPR, Article 5(1)(b) GDPR (‘purpose limitation’), Article 5(1)(c) GDPR (‘data minimisation’), Article 5(2) GDPR (‘accountability’) and Article 24(1) GDPR (‘responsibility of the controller’). Among other things, the DPA noted that the current controller failed to inform residents about the location and functioning of the security cameras.
On the other hand, the DPA also found that the controller violated Article 12(2) GDPR in conjunction with Article 15 GDPR and Article 12 of the Belgian Camera Act by failing to respond to the data subject’s access request.
Finally, the DPA found that the controller did not enter into an agreement with the processor of the surveillance camera footage in breach of Article 28(3) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/21 Dispute Chamber Decision on the merits 100/2026 of 11 May 2026 File number: DOS-2023-02083 Subject: Camera surveillance Residence […] The Dispute Chamber of the Data Protection Authority; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”; Having regard to the Act of 3 December 2017 establishing the Data Protection Authority, hereinafter “WOG”; 1 Having regard to the Rules of Internal Procedure, as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Gazette on 15 January 2019; Having regard to the documents in the file; Has taken the following decision regarding: Complainant: Ms. X1, in her capacity as co-owner acting as agent with notarial care power of attorney Mr. X2, […], hereinafter “the complainant” The respondents: -Y1 Residentie […], with registered office at […], with enterprise number […], represented by Solitt Beheer BV, in the capacity of trustee for the period 2020-2022, hereinafter “first respondent” - Y2 NV, with registered office at […] with enterprise number […], represented by the director and permanent representative, Mr. Z, 1The GBA recalls that the Law of 25 December 2023 amending the Law of 3 December 2017 establishing the Data Protection Authority (DPO), and the new internal rules of the GBA, entered into force on 1 June 2024. The new provisions apply to complaints, mediation files, requests, inspections, and procedures before the Disputes Chamber commencing from this date. The new WOG is available via this link: https://www.ejustice.just.fgov.be/cgi loi/change lg.pl?language=nl&la=N&cn=2017120311&enble hete=wet, rules of internal order via this link: < https://www.gegevensbeschermingsautoriteit.be/publications/reglement-van- interne-orde-van-de-gegevensbeschermingsautoriteit.pdf>. Files initiated before 1 June 2024, of which this file forms part, are, however, subject to the provisions of the WOG and the rules of internal order as they existed before this date. Decision on the merits 100/2026 — 2/21 also represented by Sirius Legal, Ms. Caroline Selleslagh and Mr. Dagmar Thielman, hereinafter “second defendant” hereinafter collectively “the defendants” I. Facts and proceedings 1. On 4 May 2023, the complainant lodged a complaint with the Data Protection Authority against defendants. 2. The subject matter of the complaint concerns the use of surveillance cameras in the apartment complex [Residentie 2], whereby the complainant refers to the decision previously taken by the Disputes Chamber regarding the apartment complex [Residentie 1]. According to the complainant, there are numerous indications from which it appears that the data controller has not complied with the decisions on grounds 36/2020 of 9 July 2020. 3. On 23 May 2023, the complaint is declared admissible by the First Line Service on the basis of Articles 58 and 60 of the WOG, and the complaint is transferred to the Disputes Chamber on the basis of Article 62, § 1 WOG. 4. On 27 June 2023, in accordance with Article 96, § 1 WOG, the request of the Disputes Chamber to conduct an investigation is forwarded to the Inspection Service, together with the complaint and the inventory of documents. 5. On 27 November 2023, the investigation by the Inspection Service is concluded, the report is added to the file, and the file is forwarded by the Inspector General to the President of the Disputes Chamber (Article 91, § 1 and § 2 WOG). The report contains the following findings: • infringement of Article 31 GDPR since the substantive decision 36/2020 of 9 July 2020 was not complied with. Because the cooperation between the Inspection Services and the second defendant, represented by the managing director, proceeded with difficulty, evidence for and against the defendant could not be optimally obtained or assessed. Substantive decision 100/2026 — 3/21 • Infringement of Article 5.1 a), b) and c) GDPR, Article 5.2 GDPR and Article 24.1 GDPR, since neither the second defendant nor the first defendant as controller before and after 29 September 2020, provided transparent information. The lawfulness of the processing cannot be demonstrated. The principle of minimal data processing or necessity was not sufficiently elaborated. The controllers (defendants) do not demonstrate that these principles of Article 5.1 a), b) and c) of the GDPR are complied with. This follows from the accountability obligation (Article 5.2 GDPR) in conjunction with Article 24.1 GDPR. Decision on the merits 100/2026 — 4/21 • Infringement by the first defendant, as controller, of Articles 12.2 and 15 GDPR (obligation to facilitate rights and the right of access) and of Article 12 of the Camera Act (the right of access to the images as a filmed person), since the syndic should have acted on behalf of the second defendant whom it represents. • Infringement of Article 28.3 GDPR, since neither the second defendant nor the first defendant, as controllers, entered into a contractual agreement regarding the transfer and processing of the personal data by the processor (and manufacturer). • Infringement of Article 4 of the Camera Decree by both the second defendant and the first defendant, as controllers, due to the lack of mention on the pictograms of the name of the controller and of its representative, namely the property manager, as well as the lack of mention of the postal address and, where applicable, the email address of the property manager. • Infringement of Article 6 of the Camera Decree of 2018, since neither the second defendant nor the first defendant as controllers carried out an annual check on the accuracy of the declaration nor made any adjustments thereto, for the period from 23 September 2020 to 8 September 2023. • Infringement of Articles 7, 8 and 9 of the Camera Decree of 2018 by both the second defendant and the first defendant as controllers, since no register of image processing activities could be submitted when requested to do so. 6. On 14 November 2024, the Disputes Chamber decides pursuant to Article 95, § 1, 1° and Article 98 WOG that the file is ready for substantive consideration and the parties concerned are notified by registered mail of the provisions referred to in Article 95, § 2, as well as those in Article 98 WOG. They are also notified pursuant to Article 99 WOG of the deadlines for submitting their defenses. The deadline for receipt of the defendants' statement of defense was set at 23 December 2024, that for the statement of defense of the interested third parties at 3 February 2025, that for the statement of reply of the complainant at 24 February 2025, that for the defendants' statement of reply at 17 March 2025 and that for the statement of reply of the interested third parties at 7 April 2025. If the interested third parties indicate to the Disputes Chamber that they do not wish to intervene in the proceedings, the following time limits apply: The deadline for receipt of the defendants' statement of defense was set at 23 December 2024, that for the statement of reply of the complainant Decision on the merits 100/2026 — 5/21 at 13 January 2025 and that for the statement of reply by the defendants on 3 February 2025. 7. On 14 November 2024, the complainant electronically accepts all communication regarding the case and requests a copy of the file (Article 95, § 2, 3° WOG), which was transferred to him on 21 November 2024. 8. On 4 December 2024, the first defendant electronically accepts all communication regarding the case, requests a copy of the file (Article 95, § 2, 3° WOG), which was transferred to him on 10 December 2024, and indicates his intention to exercise the opportunity to be heard, in accordance with Article 98 WOG. In addition to this, the first defendant requests an extension of the deadlines for submitting pleadings. 9. On 13 December 2024, at the request of the counsel for the first defendant, the extension of the pleading deadlines was granted and recorded by the Disputes Chamber as follows: The final date for receipt of the defendants' statement of defense was set thereby at 13 January 2025, that for the statement of defense of the interested third parties at 24 February 2025, that for the statement of reply of the complainant at 17 March 2025, that for the defendants' statement of reply at 7 April 2025 and that for the statement of reply of the interested third parties at 28 April 2025.If the interested third parties indicate to the Disputes Chamber that they do not wish to intervene in the proceedings, the following time limits apply: The latest date for receipt of the statement of defense from the defendants was set therein to 13 January 2025, that for the statement of reply from the complainant to 4 February 2025, and that for the statement of reply from the defendants to 24 February 2025. 10. On 23 December 2024, the Disputes Chamber will receive the statement of defense from Solitt Beheer BV, in the capacity of syndic of the first defendant for the period 2020-2022. 11. On 13 January 2025, the Disputes Chamber will receive the statement of defense from the first defendant. 12. On 4 February 2025, the Disputes Chamber will receive the statement of reply from the complainant. 13. On 24 February 2025, the Disputes Chamber receives the reply brief from the first defendant. 14. Notwithstanding the message sent by the Disputes Chamber on 12 February 2025 to the second defendant to remind him that a request can be made for a copy of the file, to be heard, and to submit grounds for defence via the email address used by him, the Decision on the Substantive Matters 100/2026 — 6/21, no response to this was received from the second defendant. 15. On 5 September 2025, the parties are notified that the hearing will take place on 19 November 2025. 16. On 5 October 2025, the second defendant responds with a request for the transfer of a copy of the file (Article 95, § 2, 3° WOG), which was transferred on 14 October 2025. The second defendant also indicates that he wishes to make use of the opportunity to be heard, in accordance with Article 98 WOG, with the request to postpone the hearing on 19 November 2025. 17. On 14 October 2025, the Disputes Chamber proceeds to set new decision deadlines in order to respect the rights of defence of all parties, including those of the second defendant. The deadline for receipt of the defendants' statement of defense was set to 12 November 2025, that for the complainant's statement of reply to 26 November 2025, and that for the defendants' statement of reply to 10 December 2025. The date of the hearing is also set to 19 January 2026. 18. On 12 November 2025, the Disputes Chamber will receive the statement of defense from the second defendant. 19. On 26 November 2025, the Disputes Chamber will receive procedural documents from the complainant. 20. On 10 December 2025, the Disputes Chamber will receive the summary statement from the second defendant. 21. On 19 January 2026, the parties will be heard by the Disputes Chamber. 22. On 23 January 2026, the official record of the hearing is submitted to the parties. 23. On 6 February 2026, the Dispute Chamber receives several comments regarding the official record from the second defendant, which it decides to include in its deliberations. II. Reasoning Controller 24. In order to clearly delineate the mutual relationship between the two defendants and the extent to which they assume the capacity of controller, the Decision on the merits 100/2026 — 7/21 Dispute Chamber examines to what extent the purpose and the means are determined by the 2 defendants within the meaning of Article 4. 7) GDPR. 25. The starting point here is the Substantive Decision 36/2020 of 9 July 2020, in which the Dispute Resolution Chamber imposed the following on Z1 NV (which was the sole defendant): “the Dispute Resolution Chamber of the Data Protection Authority, after deliberation, decides to: - pursuant to Article 58.2. f) and Article 100, §1, 8° WOG, to order the defendant that the processing by means of surveillance cameras relating to the apartment block Residentie […] (Phase 1) be permanently prohibited in respect of it and the processing by means of surveillance cameras relating to both Phase 1 and Phase 2 be temporarily prohibited until Y1 Phase 1 and Y1 Phase 2 have jointly taken a decision regarding the use of these surveillance cameras; - pursuant to Article 58.2. d) GDPR and Article 100, §1, 9° WOG, to order the defendant to bring the processing into compliance with Article 6.1. GDPR by the provision of the required documents, including the plans regarding the installation of the surveillance cameras and the login code, to the “Association of Co-owners of the building Residence […] ” with enterprise number 0538.454.720, to whom the status of controller belongs,. - to impose an administrative fine of EUR 5,000 pursuant to Art. 100, §1, 13° WOG and Art. 101 WOG.” 26. In the inspection report, the Inspection Service sets out the connection between the substantive decision 36/2020 of 9 July 2020 and the facts that are the subject of the present complaint, regarding the designation of the controller. This investigation is necessary, since the complainant alleges that the controller has not complied with the aforementioned substantive decision 36/2020. The report analyzes the present situation by stating that, following the substantive decision 36/2020, the Inspection Service determines the controller for the data processing by means of camera surveillance concerning Residence […II]. The Inspection Service hereby reiterates not only the reasoning of the Dispute Chamber as set out in the aforementioned decision 2 Article 4 GDPR For the purposes of this Regulation, the following is understood to mean: […] 7) “controller”: a natural or legal person, a public authority, an agency or another body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or Member State law, it may be determined therein who the controller is or according to which criteria he is designated; […] Decision on the merits 100/2026 — 8/21 on the merits, but also takes into account Opinion 22/2008 of the Privacy Commission, the 3 predecessor of the Data Protection Authority . 27. The Inspection Service states that the developer of Residence […II] was the second defendant and Z1NV acted as the “acting” syndic of the first defendant. The Inspection Service takes into account that the second defendant made the decision regarding the installation of the cameras, the invoices were sent to the second defendant, and the second defendant had access to the camera images at the processor of the first defendant. These elements lead the Inspection Service to determine that from the installation and start of the surveillance cameras (June 20, 2016) until September 29, 2020, the second defendant is identified as the controller within the meaning of Article 4.7) GDPR for the camera surveillance of the first defendant. The processing here concerns the recording of images by means of 6 surveillance cameras aimed at the shared inner courtyard and underground garage for the residents of Y1 [… I] and II and the transmission of surveillance images to the processor and software supplier for consultation via software application for smartphones. The Inspection Service establishes that the second defendant determined the purpose of and the means for the data processing of the camera images. 28. The report points out that as of 23 September 2020, account must be taken of the following changes: • transfer of the role of syndic from Z1 NV to Z2 BV for Y1 [… II]. • Z2 BV was, as syndic, secretary for the Extraordinary General Meeting of 23 September 2020 of the Y1 [… II]. • At the Extraordinary General Meeting of 23 September 2020, a vote was taken in favor of retaining the surveillance cameras with 851 / 914 votes in favor. • Z2 BV obtained access from BV [..] Assistance as of 29 September 2020. 29. The Inspection Service establishes that the first defendant can be identified as controller as of 29 September 2020. In doing so, the Inspection Service takes into account the transfer of the syndic role from Z1 NV to Z2 BV, the decision of the first defendant at the extraordinary general meeting of 23 September 2020 regarding the retention of the camera images and access to the surveillance images and access codes (login) for Z2 BV from BV [..] Assistance. 3 Opinion on its own initiative No. 22/2008 of 11 June 2008 on certain applications of the Law of 8 December 1992 on the protection of privacy with regard to the processing of personal data in cases of compulsory co-ownership https://www.gegevensbeschermingsautoriteit.be/publications/advies-nr.-22-2008.pdf 4 Date on which the syndic's access to the surveillance footage was realized. Decision on the merits 100/2026 — 9/21 30. Also in the context of the investigation into the possible joint controllers, the Inspection Service takes as a starting point the decision on the merits 36/2020 of 9 July 2020. In the decision in question, the Disputes Chamber refers to the joint processing activity regarding camera surveillance of Y1 [… I] and the first defendant and the joint decision to be taken regarding the use of these surveillance cameras. 31. In accordance with the findings of the Inspection Service, the Disputes Chamber no longer considers Y1 […I] and the first defendant as (joint) controllers. 32. In view of the management of the surveillance cameras and access to the recorded images the Inspection Service identifies the second defendant as controller until 29 September 2020 and subsequently the first defendant up to the present as controller for: • the processing of camera surveillance at the joint location of (…) being: the joint courtyard and the entrance to the underground garage of Y1 […I] and the first defendant. • the forwarding of the surveillance camera images to the processor and the software supplier. 33. The Disputes Chamber notes that the second defendant emphasized, both in the submissions and during the hearing, that as soon as the decision on the merits 36/2020 was notified to the parties concerned, every effort was made to organize a special general meeting within a reasonable period of approximately two months on 23 September 2020, at which the transfer of responsibility for the camera surveillance to the first defendant was arranged. 34. Moreover, the Disputes Chamber notes that the first defendant does not dispute acting as controller since 23 September 2020 as a result of the transfer of that responsibility for the surveillance cameras by the second defendant, as a result of which the first defendant acts as the sole controller since 23 September 2020. 35. This transfer of the capacity of controller from the second defendant to the first defendant is undeniably established on the basis of the documents in the file, in particular those concerning the special general meeting of the first defendant of 23 September 2020. 36. Although the complainant cites in his argumentation that the second defendant imposes the surveillance cameras in the capacity of the building owner, the Disputes Chamber notes that – with regard to the period after 23 September 2020 – it does not appear from any document that the second Decision on the merits 100/2026 — 10/21 the defendant has any decision-making power whatsoever regarding the purpose and means of the data processing and thus has any impact whatsoever on the placement and use of the surveillance cameras by means of which the images are recorded. As the second defendant argues, the mere fact that the second defendant is co- owner of Residence [… II] and acts as chairman of Y1 II without having any decision-making power regarding the management of the co-ownership does not constitute an indication that the second defendant assumes the role of controller within the meaning of Article 4.7) GDPR. 37. The second defendant emphasizes both in the conclusions and during the hearing that from as soon as the decision on the merits 36/2020 was notified, in the subsequent months, namely from 9 July 2020 (date on which the Decision on the merits 36/2020 was taken) until 23 September 2020 (date of transfer of responsibility for the camera surveillance to the first defendant and the appointment of the syndic), the necessary actions were taken following the Decision on the merits 36/2020: - In order to explain the decision to all co-owners, the general meeting was convened as soon as possible; - During this general meeting, the syndic was also nominated and was immediately accepted; - The cameras of phase 1 were completely switched off. 38. In view of the short period of time that has elapsed since the notification of the decision on the merits 36/2020 of 9 July 2020 to the parties involved therein and the transfer to Y1 [… II] of responsibility for data processing by means of camera surveillance, the second defendant makes it plausible, in the opinion of the Disputes Chamber, plausible that the definitive injunction imposed by the Disputes Chamber was partially complied with shortly after the aforementioned decision. Indeed, the surveillance cameras of Residence [… I] were completely switched off and responsibility for the use of the already installed cameras was transferred to the competent Y1, in this case the first defendant. 39. As the Inspection Service rightly establishes, the second defendant took no action to comply with the temporary prohibition on the use of the surveillance cameras relating to both Residence […I] and Residence[…II] until Y1 I and the first defendant jointly make a decision regarding the use of those shared cameras. In this regard, the Disputes Chamber notes that in decision on the merits 36/2020 Z1 NV held the capacity of defendant and controller, whereas in the present case the second defendant acts as defendant, albeit together with the first defendant. This capacity of Decision on the merits 100/2026 — 11/21 controller was linked in decision on the merits 36/2020 to the fact that Z1 NV acted as the client and took the initiative regarding the installation and use of the surveillance cameras. In the present case file, it is also the developer who installed and put the surveillance cameras into use, namely the second defendant. This can be explained as follows and is confirmed as such in the inspection report: • Residence [… 1] was not built by the second defendant, but by Z1 NV; • Residence […II] has the second defendant as developer, whereas Z1 NV is merely the landowner. 40. Given the finding that the second defendant was not a party to the decision on the merits 36/2020, since it is to be distinguished as a legal entity from Z1 NV, which was the defendant in the decision on the merits 36/2020, the decision on the merits 36/2020 has no direct effect for the second defendant. 41. The fact that the permanent representative of both Z1 NV (respondent in decision on the merits 36/2020) and the second respondent is the same natural person does not, in principle, detract from this, given that it concerns two distinct companies that each must comply with their obligations under the GDPR separately. 42. However, it is established before the Disputes Chamber that the second respondent had indirect knowledge of the temporary prohibition in decision on the merits 36/2020. Indeed, the Inspection Service established that Z1 NV assumed the role of trustee for Y1 I and the first respondent, as a result of which the respondents, via the permanent representative who was also simultaneously the trustee, ought to have had knowledge of decision on the merits 36/2020, including the temporary prohibition. The Disputes Chamber notes that, regarding the implementation of the temporary prohibition, as regards the second defendant, this only concerns the period from the notification of the decision on the merits 36/2020, namely 9 July 2020, until the moment of transfer of responsibility for camera surveillance to the first defendant and the appointment of the new syndic, namely 23 September 2020. This is an extremely short period which justifies the judgment of the Disputes Chamber's finding that, regarding the temporary prohibition, it is not appropriate to impose a corrective measure or a reprimand or an administrative fine on the second defendant for non- compliance with the temporary prohibition on data processing by means of the cameras relating to both Residence […I] and Residence [… II]. With regard to the non- compliance with the temporary prohibition by the second defendant, the Disputes Chamber therefore decides to dismiss the complaint. The definitive prohibition regarding Residence […I], as well as the transfer of responsibility for the surveillance cameras to Y1 II was realized within the same short period of time, such that the Disputes Chamber considers this as Decision on the merits 100/2026 — 12/21 executed within a reasonable time and the complaint must also be dismissed with regard to this part. 43. The Disputes Chamber decides, applying criterion B.6 of the dismissal policy, to dismiss the 5 complaint, insofar as it is directed against the second defendant, since the subject matter of the complaint has disappeared as a result of the measures taken by the second defendant as controller. Legal basis 44. Regarding the legal basis, Decision on the merits 36/2020 expressly stated that data processing by means of camera surveillance cannot be based on consent (Article 6.1a) GDPR), since the consent in no way meets the requirements as laid down in Article 4.11) GDPR, which states that consent of the data subject means: “any freely given, specific, informed and unambiguous expression of will by which the data subject accepts the processing of personal data concerning him by means of a statement or an unambiguous active act”. 45. In the present decision, the Dispute Resolution Chamber also reiterates that the element “free” implies actual choice and control for the data subjects. As a general rule, the GDPR prescribes that if a data subject has no actual choice, feels compelled to give consent or it will have negative consequences for him if he does not consent, the consent is not valid. If consent is included as a non-negotiable part of the terms and conditions, it shall be deemed not to have been freely granted.Consequently, consent is not deemed to have been freely given if the data subject cannot refuse or withdraw his consent without adverse consequences. When assessing whether consent has been freely given, account must also be taken of the specific situation of including consent in contracts for the processing of personal data which is not necessary for the performance of that contract (Article 7.4 GDPR). Each 7 5 https://www.gegevensbeschermingsautoriteit.be/publications/sepotbeleid-van-de-geschillenkamer.pdf 6 Guidelines 05/2020 on consent in accordance with Regulation 2016/679 https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation- 2016679_nl 7Article 7.4. GDPR “When assessing whether consent can be freely given, account shall be taken, inter alia, of whether, for the performance of a contract, including a contract for services, consent is required for the processing of personal data which is not necessary for the performance of that contract.” See also Recital 43 GDPR “[…] Consent shall be deemed not to have been freely given if separate consent cannot be given for different processing operations of personal data despite the fact that this is appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on consent despite the fact that such consent is not necessary for such performance.” Decision on the merits 100/2026 — 13/21 an element which involves undue pressure or influence on the data subject which prevents a data subject from exercising his or her free will, invalidates consent. 46. In order to verify whether decision on the merits 36/2020 was complied with, the Inspectorate Service questioned the defendants regarding this. The reason for this is the fact that the Disputes Chamber stated in decision on the merits 36/2020 that the data processing by means of surveillance cameras could possibly be based on Article 6.1 f) GDPR and that, for the pursuit of the legitimate interest, a balancing of interests must be carried out. The report states as a result of this questioning that the defendants did not, in their communication with the Inspectorate Service, refer to a legal basis or to the existence of a previously carried balancing of interests. The report also indicates that no document was attached showing that such a balancing of interests was effectively and concretely carried out. 47. The Disputes Chamber notes that the question arises here whether, at the time of transfer 8 by Z1 NV of responsibility for the data processing via the surveillance cameras to the first defendant, namely on 23 September 2020, and this pursuant to decision on the merits 36/2020, the first defendant was notified of the order of the Disputes Chamber to bring the processing into compliance with Article 6.1 GDPR. Indeed, it is at that moment that the first defendant acquires the status of controller with regard to the data processing via the surveillance cameras, as a result of which the GDPR obligations must be complied with, in particular the legal basis for such data processing. 48. The Inspection Service has not been able to establish that the substantive decision 36/2020 of 9 July 2020 of the Disputes Chamber was communicated to the first defendant and/or to its trustee, and this neither by Z1 NV nor by the second defendant. 49. The inspection report states that following the special general meeting of 21 October 2021, the then trustee of the first defendant, namely Z2 BV, was informed of the substantive decision 36/2020 of 9 July 2020 of the Disputes Chamber by a resident and not by Z1 NV / the second defendant. 50. The inspection report states that the (syndic of the) first defendant did not comply with the substantive decision 36/2020 of 9 July 2020 of the Dispute Resolution Chamber until 20 September 2023. 51. On September 20, 2023, the new property manager Z3 BV, following the Inspection investigation, instructed the processor to switch off the surveillance cameras until the annual general meeting in December 2023. 8 Z1 NV in its capacity as defendant in Decision on the merits 36/2020 of July 9, 2020 Decision on the merits 100/2026 — 14/21 52. In the defendants' conclusions, it is argued and supported by documents that the surveillance cameras have effectively been switched off since September 22, 2023. The second defendant, who was the only defendant present during the hearing, confirms during the hearing that the surveillance cameras are still present, but are by no means functioning and have therefore not been actively in use since September 22, 2023. In the conclusions of the defendants, it is emphasized that at the extraordinary general meeting of 23 September 2020, as well as at the subsequent extraordinary general meeting dated 21 October 2021 and the general meeting of 27 April 2022, camera surveillance was placed on the agenda and the first defendant voted each time by an absolute majority in favor of retaining the camera surveillance. 53. In addition to decision on the merits 36/2020 of 9 July 2020, the Disputes Chamber does not disregard the wish of the vast majority of the residents of Residence[… II] to have camera surveillance. During the hearing, it became apparent that the deactivation of the cameras since September 22, 2023, notwithstanding the request of most residents to have camera surveillance, stems from the controversy that prevailed regarding the cameras, as a result of which the then-syndic decided to proceed with deactivating them. The first defendant also confirms in the conclusions that the surveillance cameras have been inactive since September 22, 2023 and, notwithstanding that the use of the surveillance cameras was approved at the general meeting of December 13, 2023, have been kept inactive due to a single dissenting vote by the complainant. 54. It is established that the first defendant was aware of decision 36/2020 at least from October 21, 2021, and was therefore able to implement it. 55. In any event, the Disputes Chamber establishes that in the present case file it cannot be argued that the consent of the residents is freely given within the meaning of Article 6.1 a) GDPR in conjunction with Article 4. 11) GDPR. The first defendant cites in the conclusion that the deed of incorporation dated 30/12/2014 of Residence […II] stipulates the following: “3. CAMERA SURVEILLANCE The common areas (courtyard, garage entrance and garages – this list is not exhaustive) will be monitored by means of cameras. Every owner/user must respect this form of surveillance and must expressly give their consent regarding the privacy notices in this regard.” 56. The first defendant argues that the following was included in the internal rules of 23/09/2023: “g. Privacy Act: You are hereby informed that the building is equipped with camera surveillance in the entrance halls, stairwells, the basement, and the parking garage” Decision on the merits 100/2026 — 15/21 57. The Disputes Chamber states that it appears from the deed of incorporation that the complainant was obliged to consent to the camera surveillance; it appears from the internal rules only that the complainant was informed of the presence of the camera surveillance. 58. The complainant also cites these elements to argue that the surveillance cameras are unilaterally imposed and that no consent was given for this. The Disputes Chamber agrees with the complainant on this point. 59. The Disputes Chamber notes that the surveillance cameras have been out of use since 22 September 2023 and that no camera images have been processed since then, yet the surveillance cameras are nevertheless still present. The mere presence of the cameras, even if they are inactive, and the lack of opportunity for the residents to exercise any control whatsoever over whether or not the surveillance cameras are functioning, constitutes in itself an infringement of the fundamental right to respect for private life (Article 8 ECHR). 60. In this light, the Disputes Chamber is therefore of the opinion that the current controller, being the first defendant, must take a decision regarding the use of the surveillance cameras and only to the extent that their use can be based on Article 6.1 f) GDPR, in the absence of valid consent. This requires that for each of the six cameras, a balancing of interests must be made in accordance with the conditions laid down in the case law of the Court of Justice and the guidelines of the European Data Protection Committee (EDPB). 10 61. In accordance with the case law of the Court of Justice of the European Union, three cumulative conditions must be met in order for a controller to be able to validly rely on this legal ground, “namely, firstly, the pursuit of a legitimate interest of the controller or of the third party(ies) to whom the data are provided, secondly, the necessity of the processing of the personal data for the pursuit of the legitimate interest, and, thirdly, the condition that the fundamental rights and freedoms of 11 the data subject do not prevail” (Rigas judgment). 9Article 8.1 of the European Convention on Human Rights: “Everyone has the right to respect for his private life, his family life, his home and his correspondence.” 10Guidelines of the European Data Protection Board 01/2024 on the processing of personal data on the basis of legitimate interest (Article 6(1)(f) GDPR), as adopted on October 8, 2024 https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2024/guidelines-12024-processing-personal- data-based en 1CJEU, May 4, 2017, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA “Rīgassatiksme”, recital 28. See also CJEU, 11 December 2019, C-708/18, TKt/AsociaţiadeProprietariblocM5A-ScaraA, Recital 40. Decision on the merits 100/2026 — 16/21 62. In order to be able to rely on the legal basis of “legitimate interest” in accordance with Article 6.1 f) of the GDPR, the controller must, in other words, demonstrate that: - the interests pursued by the processing can be recognized as legitimate (the “purpose test”); - the intended processing is necessary for the realization of these interests (the “necessity test”); In order to satisfy the second condition, it must be demonstrated that the processing is necessary for the realization of the purposes pursued. This means, more specifically, that the question must be asked whether the same result can be achieved by other means without processing of personal data or without unnecessarily intrusive processing for the data subjects and - weighs the balancing of these interests against the interests, fundamental freedoms and basic rights of the data subjects in favour of the controller (the “balancing test”). In order to determine whether 12 See paragraph 29 of the Guidelines of the European Data Protection Committee 01/2024 on the processing of personal data on the basis of legitimate interest (Article 6(1)(f) GDPR): [My own translation]: “In order to assess what is “necessary”, it must be examined whether the legitimate interests pursued in the data processing cannot in practice be realized equally effectively by other means which restrict the fundamental rights and freedoms of the data subjects less. If reasonable, equally effective but less intrusive alternatives exist, the processing cannot be considered “necessary”. In this regard, the Court expressly recalled that the condition regarding the necessity of the processing must be assessed in conjunction with the principle of “data minimisation” laid down in Article 5(1)(c) GDPR, according to which personal data must be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed” must be. The Court also stressed that processing may be carried out “only to the extent strictly necessary” for the purposes of the established legitimate interest. This requirement of strict necessity is also emphasized, for example, in Recital 47 of the GDPR, which states that “the processing of personal data which is strictly necessary for the prevention of fraud[…] constitutes a legitimate interest of the controller concerned.” 13See paragraphs 32-33 of the European Committee for Data Protection Guidelines 01/2024 on the processing of personal data on the basis of legitimate interest (Article 6(1)(f) GDPR): [Own translation]: “This condition entails that the conflicting rights and interests at stake must be weighed against each other, which in principle depends on the specific circumstances of the concrete case.46 In addition to the assessment of the legitimate nature of the interest pursued by the controller or a third party and the analysis of the necessity of the processing, as described above, the controller must establish and describe the following: i) The interests, fundamental rights and freedoms of the data subjects. ii) The effects of the processing on the data subjects, including a. The nature of the data to be processed, b. The context of the processing, and c. Any further effects of the processing. iii) The reasonable expectations of the data subject. iv) The final balancing of conflicting rights and interests, including the possibility of further mitigating measures. Decision on the merits 100/2026 — 17/21 the third condition of Article 6.1(f) of the GDPR – the so-called “balancing test” between the interests of the controller, on the one hand, and the fundamental freedoms and rights of the data subject, on the other hand – can be met, account must be taken of the reasonable expectations of the data subject in accordance with Recital 47 of the GDPR. More specifically, it must be evaluated whether the data subject may reasonably expect, at the time and in the context of the collection of the personal data, that processing for that purpose can take place”. This is also emphasized by the Court in its judgment “TK v/ Asociaţia de Proprietari bloc M5A-ScaraA” of 11 December 2019, in which it states: “Also relevant to this balancing are the reasonable expectations of the data subject that his or her personal data will not be processed when, in the given circumstances of the case, the data subject cannot reasonably expect any further processing of the data”. 63. The Dispute Chamber assumes that the purpose test and the necessity test can be met. Depending on the result of the balancing of interests to be conducted by the first defendant for that purpose, the first defendant must proceed as follows: In the event that the balancing of interests to be carried out per camera leads to the following: • the interest of the complainant prevails, then these cameras must be removed; • the interest of the first defendant prevails, then these cameras may be retained provided that all other provisions of the GDPR are also complied with, including in particular the principle of transparency and the duty to inform (Article 5.1 a) GDPR in conjunction with Articles 12 and 13 GDPR), facilitating the exercise of the rights of the data subject (including the right of access – Article 15 GDPR), the conclusion of an agreement with the processor of the camera images (Article 28.3 GDPR). Transparency 64. The first defendant argues that it was not a party to the proceedings that gave rise to decision on the merits 36/2020, such that the decision was therefore not enforceable against it and that it was also never notified of it by the parties that were involved. Although the Disputes Chamber follows this argumentation, at least for the period up to 21 October 2021, it nevertheless points out that the first defendant has since 23 Be reminded that the objective of the balancing is not to completely avoid any impact on the interests and rights of the data subjects. The objective is rather to avoid a disproportionate impact and to assess the weight of these aspects in relation to each other.” 14 Recital 47 GDPR. 15 CJEU, 11 December 2019, C-708/18, TK v Asociaţia de Proprietaribloc M5A-ScaraA, recital 58. Decision on the merits 100/2026 — 18/21 September 2020 – moment of transfer of responsibility for the surveillance cameras – acts as controller for the data processing on the basis of the cameras present, as a result of which it must comply from that moment with all GDPR obligations, including the accountability obligation (Article 5.2 16 GDPR read in conjunction with Article 24.1 GDPR). As is apparent from the inspection report, from the transfer to the first defendant of responsibility for the use of the surveillance cameras, no action was taken by the first defendant to comply with the basic principles of the GDPR, in particular the principle of lawfulness and transparency, as well as the indication of the legal basis on which the data processing by means of camera surveillance is based. As established by the Inspection Service, the Dispute Chamber establishes that, as of 23 September 2020, there has been an infringement by the first defendant of Articles 5.1a), b) and c) read in conjunction with Article 5.2 GDPR and Article 24.1 GDPR, since the first defendant does not comply with the transparency obligation. The Dispute Chamber bases this on the findings of the Inspection Service, in which this is clarified as follows: • No information was provided to the residents of Y1 II regarding the precise location and fields of view of the cameras, as well as the plan of the various surveillance cameras and the possible existing necessity of the surveillance cameras. The minutes of the general and special meetings of the Y1 do not show that the residents were informed in advance about the installation and management of the surveillance camera footage.The Inspection Service also establishes that the residents were not fully informed by Y1 II prior to the special general meeting of 23 September 2020, during which a vote was held to retain the surveillance cameras with 851/914 votes. • Towards data subjects: use of the pictogram, but without mentioning the correct identity and contact details of the data controller on the pictogram, thereby constituting an infringement of Article 7 of the Camera Act and Article 4 of the Camera Decree. • Towards the authorities: the notification of the surveillance cameras was made, but the information stated in the notification was not updated, as a result of which Article 7 of the Camera Act and Article 6 of the Camera Decree were not complied with. Also 16 Article 5.2. GDPR The controller is responsible for compliance with paragraph 1 and can demonstrate this "accountability") 17 Act of 21 March 2007 regulating the installation and use of surveillance cameras 18 Royal Decree of 10 February 2008 establishing the manner in which it is indicated that camera surveillance is taking place. Decision on the merits 100/2026 — 19/21 the register of image processing activities was missing as a result of which Article 7 of the Camera Act and Articles 7 to 9 of the Camera Decree were not implemented. 65. In addition, the Inspection Service establishes that the first defendant committed an infringement of Articles 12.2 read in conjunction with Article 15 of the GDPR and of Article 12 of the Camera Act because no right of access was granted to the complainant's right of access and his request to that effect dated 19 April 2023. The syndic stated that this request was not granted. The first defendant argues that no infringement was committed against the aforementioned provisions regarding the right of access of the data subject, since the complainant requested access to the images filmed between 7-10 April 2023 in order to ascertain who was on the private terrace during the execution of works. The first defendant argues that it was not the complainant himself, but a third party who was filmed, whereas Article 12 of the Camera Act grants the right only to the person being filmed, to obtain access to the images relating to himself, not to the images relating to a third party. 66. The Disputes Chamber establishes that the first defendant failed to comply with the complainant's request for access. The first defendant acknowledges having completely ignored the complainant's request for access, and thus failing to comply with it as described in Article 12.2 of the GDPR. The fact that a negative response may be required to the request for access – in order to respect the rights and freedoms of others – does not relieve a controller of his obligation to respond to a request in a timely manner. Therefore, the Disputes Chamber is of the opinion that it is established that an infringement was committed by the first defendant of Articles 12.2 in conjunction with Article 15 GDPR and of Article 12 of the Camera Act. 19 67. Regarding the infringement of Article 28.3 GDPR by Y1 II as established by the Inspection Service, the Disputes Chamber notes that the first defendant does not proceed to any substantive defense on this point, but merely states in the conclusion that it will act in accordance with the wisdom of the Disputes Chamber. Based on the findings of the Inspection Service, this leads the Disputes Chamber to the conclusion that Y1 II did not enter into an agreement with the processor of the camera images resulting in an infringement of Article 28.3 GDPR. 68. With regard to the infringement of Article 31 GDPR, the Dispute Resolution Chamber proceeds to a dismissal of the case (Article 100, §1, 2° WOG), having regard to the specific nature of this case. Indeed, the complexity regarding the responsibility and capacity of each of the 19Article 28.3. GDPR: Processing by a processor shall be governed by a contract or other legal act under Union law or Member State law which binds the processor in relation to the controller, and which defines the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects, and the rights and obligations of the controller. That agreement or other legal act stipulates in particular that the processor: […] Decision on the merits 100/2026 — 20/21 parties with, in addition, for the first defendant successive syndications acting as representative of the first defendant, as well as the determination of the role that Z1 NV does or does not have in this file, has had a significant influence on the manner in which the communication and cooperation with the Inspection Service proceeded. III. Publication of the decision 69. In view of the importance of transparency regarding the decision-making of the Dispute Chamber, this decision is published on the website of the Data Protection Authority. However, it is not necessary for the identification details of the parties to be disclosed directly for this purpose. FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority, after deliberation, decides to: - On the basis of Article 58.2, d) GDPR and Article 100, §1, 9° WOG, to order the first defendant to bring the processing into compliance with Article 6.1 GDPR by verifying for each of the cameras whether the data processing by means of image recording can be based on the legal basis as provided for in Article 6.1 f) GDPR. - To inform the Disputes Chamber within a period of 3 months from the date of notification of this decision regarding its implementation. - on the basis of Art. 58.2. b) GDPR and Article 100, §1, 5° WOG, to issue a reprimand with respect to the first defendant for infringement of: o Articles 5.1 a), b) and c) in conjunction with Article 5.2 GDPR and Article 24.1 GDPR, o Articles 12.2 in conjunction with Article 15 GDPR and Article 12 of the Camera Act due to disregard of the complainant's right of access, o as well as for the infringement of Article 28.3 GDPR in the absence of an agreement with the processor of the camera images; - On the basis of Article 100, § 1, 2° WOG, to order a dismissal of the case with respect to the defendants for the infringement of Article 31 WOG. - Pursuant to Article 100, § 1, 1° WOG, to dismiss the present complaint with regard to the second defendant. Decision on the merits 100/2026 — 21/21 Pursuant to Article 108, § 1 of the WOG, an appeal against this decision may be lodged with the Market Court (Brussels Court of Appeal) within a period of thirty days from the notification, with the Data Protection Authority as defendant. Such an appeal may be lodged by means of a petition in adversarial proceedings which must contain the 20 notifications listed in Article 1034ter of the Judicial Code. The petition in adversarial proceedings must be submitted to the registry of the Market Court in accordance with Article 1034quinquies of the Judicial Code. , or via the e-Deposit IT system of the Ministry of Justice (Article 32ter of the Judicial Code). (Get). Hielke H IJMANS Director of the Disputes Chamber 20 The petition shall state, under penalty of nullity: 1° the day, the month and the year; 2° the name, first name, domicile of the petitioner and, where applicable, his capacity and his national register or enterprise number; 3° the name, first name, domicile and, where applicable, the capacity of the person to be summoned; 4° the subject matter and a brief summary of the grounds of the claim; 5° the court before which the claim is brought; 6° the signature of the petitioner or of his lawyer. 21 The petition with its annex shall be sent, in as many copies as there are parties concerned, by registered mail to the registrar of the court or deposited at the registry.
