APD/GBA (Belgium) - 45/2026
From GDPRhub
| APD/GBA - 45/2026 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1) GDPR Article 7 § 2 para. 7 The Surveillance Camera Act |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 05.03.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 45/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD (in FR) |
| Initial Contributor: | dt |
The DPA warned two individuals to ensure their surveillance camera no longer films public roads after a neighbour complained about the camera capturing footage of them and the general public.
English Summary
Facts
An individual (the data subject) lodged a complaint with the Belgian DPA (APD) regarding the installation and use of a surveillance camera by two neighbours (presumed controllers). The data subject claimed that the camera was adjustable, faced and filmed the street in front of the controllers’ house since January 2023 and that it featured a flashlight activated by a motion detector at night.
The complaint was part of a larger dispute between the parties.
The controllers claimed that the installation of the surveillance camera was in response to an incident where the tires of their car had been punctured.
Holding
The DPA understood the controllers’ claim about the installation of the surveillance camera as a deterrent against tire punctures as a legitimate interest for personal data processing in the sense of Article 6(1)(f) GDPR.
However, the DPA held that the controllers could not rely on this legal basis for the processing of personal data via the surveillance camera. The DPA explained that the camera captured images of the public road, making the personal data processing unlawful under Article 7§ 2 para. 7 of the Surveillance Camera Act. The DPA also emphasised that the camera footage infringed the data subject’s and her family’s right to privacy and right to data protection by processing frequently their personal data due to placement of the camera.
Therefore, the DPA found that the controllers may have breached Article 5(1)(a) GDPR and Article 6 GDPR in conjunction with Article 7 § 2 para. 7 of the Surveillance Camera Act and issued a warning to ensure their surveillance camera no longer films public roads.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/8
Litigation Chamber
Decision 45/2026 of March 5, 2026
Case Number: DOS-2023-01484
Subject: Complaint concerning the use of a surveillance camera in the context of a
neighborhood dispute
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the
protection of natural persons with regard to the processing of personal data and
on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the “GDPR”;
Having regard to the Law of December 3, 2017 establishing the Data Protection Authority, hereinafter referred to as the “LCA”;
Having regard to the Law of 21 March 2007 regulating the installation and use of surveillance cameras (hereinafter
"Camera Law");
Having regard to the internal rules of procedure as approved by the Chamber of Representatives on 20
2 December 2018 and published in the Belgian Official Gazette on 15 January 2019 ("ROI");
Having regard to the documents in the file;
The Litigation Chamber of the Data Protection Authority (“DPA”) has made the following decision:
Regarding:
The complainant: X, residing at […], hereinafter referred to as “the complainant”
The defendants: Y1 and Y2, residing at […], represented by Ms. Aurélia
LUYPAERTS, hereinafter referred to as “the defendants”
1. The amendments made to the Data Protection Act (DPA) by the Law of 25 December 2023 amending the Law of 3 December 2017 establishing the Data Protection Authority (“Law of 25 December 2023”) entered into force on 1 June 2024 and apply only to complaints, mediation cases, requests, inspections, and proceedings before the Litigation Chamber initiated on or after that date. Cases initiated, as in this instance, before 1 June 2024 remain subject to the provisions of the DPA as it existed before that date (https://www.autoriteprotectiondonnees.be/publications/loi-
organique-de-l-apd.pdf).
2. The new internal regulations (“ROI”) of the Data Protection Authority (DPA), resulting from the amendments made to the Data Protection Act (LCA) by the Law of 25 December 2023, entered into force on 1 June 2024 and apply only to complaints, mediation cases, requests, inspections, and proceedings before the Litigation Chamber initiated from that date. Cases initiated, as in this instance, before 1 June 2024 remain subject to the provisions of the ROI as it existed before that date (https://www.autoriteprotectiondonnees.be/publications/reglement-d-ordre-interieur.pdf). Decision 45/2026 — 2/8
I. Facts and Procedure
1. The subject of the complaint concerns the installation and the use of a surveillance camera by
the defendants, the complainant's neighbors, in the context of a neighborhood dispute.
2. The complainant alleges that the defendants installed a surveillance camera on the
front of their home on January 21, 2023, and have been filming the public street ever since.
The complainant adds that this camera is steerable, regularly changing its point of view,
and equipped with a motion detector that triggers a light at night.
3. On January 30, 2023, the complainant contacted the local police officer to complain about both
the installation of the camera by the defendants and the noise caused by the piano played by one of them.
4. On February 4, 2023, a report of the interview with the complainant's partner was drawn up,
who stated that he had initiated a proceedings before the Justice of the Peace concerning her
allegations of noise disturbance due to the defendants' piano. The complainant's partner
also mentions the defendants' camera, adding that it activates every day,
when someone passes by.
5. On March 29, 2023, the complainant filed a complaint with the Data Protection Authority against the
defendants.
6. On April 13, 2023, the complaint was deemed admissible by the Frontline Service on the
basis of Articles 58 and 60 of the LCA (Law on Access to Information) and the complaint was forwarded to the Litigation Chamber
pursuant to Article 62, § 1 of the LCA.
7. On May 3, 2023, the complainant submitted to the Litigation Chamber photos from the defendants' surveillance camera,
time-stamped May 2, 2023.
8. On September 12 In 2024, pursuant to Article 95, §2 of the LCA, the Litigation Chamber
informs the parties that the present case is pending, of the content of the complaint, and of
the possibility of consulting and copying the file at the registry of the Litigation Chamber.
The parties are invited to submit any comments they may have to the
Litigation Chamber no later than September 26, 2024.
9. On September 25, 2024, the defendants submitted their observations to the Litigation Chamber.
They raise, in particular, numerous neighborhood disputes not related to
the jurisdiction of the APD, involving them and the complainant, and for which
proceedings in the Justice of the Peace Court are currently underway. Regarding the pending complaint, the
defendants argue that the installation of the surveillance camera in question was a consequence of
3. Pursuant to Article 61 of the LCA, the Litigation Chamber informs the parties by this decision that The complaint was
declared admissible.
4
Pursuant to Article 95, § 2 of the LCA, by this decision, the Litigation Chamber informs the parties that, following
this complaint, the case file has been forwarded to it. Decision 45/2026 — 3/8
one of the defendants noted that their car tires had been slashed. The
defendants added that they suspected their neighbors, including the complainant, and had installed
the camera in question as their “only means of deterrence.” The defendants also
expressed their willingness to reach an amicable agreement with the complainant.
10. On October 4, 2024, the complainant submitted her observations regarding the
defendants' response to the Litigation Chamber, the appellant simply ruling on her complaint concerning
the defendants' use of the camera in question. The complainant did not provide any
additional evidence.
11. On February 17, 2025, the complainant submitted to the Litigation Chamber new
photos showing the presence of the camera located on the defendants' facade, which the
complainant dated to January 29, 2025.
II. Grounds
II.1. Applicability of the GDPR and the Camera Act
12. The Litigation Chamber notes first and foremost that the complaint relates to the
processing of personal data carried out by a fixed surveillance camera
installed on the facade of the defendant's private property, i.e., an enclosed space not
accessible to the public.
13. Pursuant to Article 4, §1, paragraph 1 of the LCA, the Data Protection Authority is "responsible for monitoring the
application of Regulation 2016/679 and laws containing provisions relating to the
protection of the processing of personal data in order to protect the fundamental rights and freedoms of individuals." physical rights with regard to the processing of their personal data.
The Camera Law is part of the body of legislation
over which the Data Protection Authority (DPA) is responsible.
14. The Court of Justice of the European Union (hereinafter “CJEU”) has previously confirmed that
the recording of images of people, particularly by surveillance cameras, falls under the
concept of “personal data” within the meaning of European data protection law.
6. Surveillance using video recording of
people constitutes automated processing of personal data within the meaning of
7. Article 2.1 of the GDPR. Data processing in this context must therefore benefit from
the protection offered by the GDPR.
5. Article 2, 3° of the Camera Law: “Enclosed place not accessible to the public: any building or place delimited by an enclosure intended
solely for the use of regular users.”
6. CJEU Judgment of 11 December 2014, František Ryneš v. Úřad pro ochranu osobních údajů, C-212/13, ECLI:EU:C:2014:242; (hereinafter: the Ryneš judgment), paragraph 22.
7
Compare the analysis in the Ryneš judgment of the replaced legal standard mutatis mutandis, paragraph 25. Decision 45/2026 — 4/8
15. In the present case, the complainant accuses the defendants of having installed and used a
surveillance camera on the facade of their home, facing the public road and
filming anyone passing in front of the camera, including the complainant and her
partner. Therefore, the GDPR applies to the processing of the recordings made by
the surveillance camera in question.
16. As regards the The Cameras Act applies:
a. to "surveillance cameras" as defined in Article 2, paragraph 4 of the Cameras Act, namely "any fixed, temporary fixed, or mobile observation system
whose purpose is the surveillance and monitoring of premises, and which, for this purpose, processes images";
b. when these surveillance cameras are intended for one of the two purposes listed in the first paragraph of Article 3 of the Cameras Act, and in particular when they are
used to "prevent, detect, or establish offenses against persons or property."
17. When a surveillance camera is installed in an enclosed space not accessible to the public,
the data controller who decides to install a surveillance camera and
process the images it captures may only do so when the purpose (within the meaning of the GDPR
and the French Law on Cameras) pursued by its installation and use is to “[…] gather
evidence of incivilities, acts constituting an offense or causing damage, to
search for and identify the perpetrators of the acts, those disturbing public order,
witnesses or victims.”
18. In this case, the purpose pursued by the installation and use of the surveillance camera
by the defendants falls precisely within the scenarios outlined above, it being understood
that the defendants state in their observations of September 25, 2024, that the installation
of the camera as the “only means of deterrence” was following a flat tire on their
car, suspecting that the complainant and/or her partner were
responsible (§9).
19. Therefore, the Camera Act also applies to the situation.
20. Consequently, the legal assessment to be carried out by the Litigation Chamber in
the following sections will be conducted in light of both the GDPR and the Camera Act.
8 Article 7, § 3, paragraph 2, Camera Act. s Decision 45/2026 — 5/8
II.2. Alleged violation of Articles 5.1(a) and 6.1 of the GDPR read in conjunction with Article 7, §2, paragraph 7 of the Camera Law
21. Article 5.1(a) of the GDPR stipulates that personal data must be “processed lawfully, fairly and transparently in relation to the data subject (lawfulness, fairness, transparency).”
22. Article 6 of the GDPR sets out, in its first paragraph, six distinct legal bases. It considers, in particular, that processing is lawful if it “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” This is the legal basis invoked by the defendants
given that they use their front-facing camera to deter another flat tire
on their car.
23. Article 7, §2, paragraph 7 of the Camera Act stipulates that “[…] the data controller
shall ensure that the surveillance camera(s) are not specifically directed towards a
place for which it does not itself process the data. In the case of monitoring an entrance
[to an enclosed place not accessible to the public] located at the front of an open place or an enclosed place
accessible to the public, the surveillance camera(s) shall be oriented in such a way as to limit the
capture of images of that place to its strict minimum.”
24. The Litigation Chamber finds that the defendants cannot claim a legitimate
interest to justify the data processing resulting from the use of their
surveillance camera filming the public highway.
25. In this case, it appears from the case file that the camera in question was installed by the defendants on their building facade, and therefore could only film the public road, and more specifically, the sidewalk where the defendants' and the plaintiff's cars are parked, as well as the street.
Furthermore, it appears that a spotlight is attached to the defendants' camera, thus also allowing it to film the public road at night. The plaintiff also claims that this spotlight is activated by movement, but provides no evidence to support this allegation.
26. The Litigation Chamber therefore finds that the camera installed by the defendants films only the public road and any person walking on it within range of said camera, whether it be the plaintiff, her partner, or third parties. Furthermore, given that the
houses of the defendants and the complainant are adjoining, the Litigation Chamber
finds that it is inevitable for the complainant to appear in the images filmed by the
disputed camera located on the defendants' facade when entering and leaving her home.
Since her personal data is frequently processed in this way, Decision 45/2026 — 6/8
the interference with the complainant's right to privacy and right to the protection of personal data is manifest.
27. Moreover, in light of the case file, it appears that the complainant occupies her home not
only with her partner, but also with their three minor children. The Litigation Chamber
therefore also takes into account the fact that, in addition to the complainant, these children
could be affected by the data processing resulting from the use of the defendants'
surveillance camera.
28. Finally, the defendants claim to have installed the surveillance camera in question following a
flat tire on their car, parked on the public road, as a “deterrent” against their neighbors, namely the complainant and her partner, whom they
suspect.
29. It therefore appears that the defendants intend to use the camera to monitor and film the
public road, a location for which they do not themselves process the data. In this regard, the
Litigation Chamber notes that the placement and direction of the camera implies the
processing of data of any person passing on the public road within range of the
camera, and therefore not only of the complainant and her partner.
30. In light of the aforementioned elements, the Litigation Chamber finds that the defendants
cannot claim a legitimate interest, given that the processing of data
from images filmed by a surveillance camera filming the public highway is unlawful,
because it contravenes Article 7, §2, paragraph 7 of the Camera Act.
31. Pursuant to Article 95, §1, 4° of the LCA and Article 58.2.a) of the GDPR, the Litigation Chamber
has the power to notify a data controller or processor that
the planned processing operations are likely to violate the provisions of the
GDPR.
32. The Litigation Chamber considers, based on the aforementioned facts, that it is necessary to
find that the defendants are likely to violate Articles 5.1(a) and 6.1 of the GDPR, read
in conjunction with Article 7, 62, paragraph 1 of the Law on Cameras, due to the installation and
use of a surveillance camera filming the public highway, including the complainant,
when she wishes to enter or leave her home, as well as third parties using the
public highway. This justifies, in this case, the issuance of a warning so that the
defendants take care, in the future, not to use their surveillance camera in such a way as to film
the public highway.
33. The purpose of this warning decision is to remind the defendants, presumed
data controllers, of their obligation to comply with the aforementioned provisions of the GDPR,
so as to enable them to comply with these provisions in the future with regard to the
processing operations at issue in this case. Decision 45/2026 — 7/8
34. This decision is a prima facie decision rendered by the Litigation Chamber
pursuant to Article 95 of the LCA on the basis of the complaint filed by the complainant,
within the framework of the “preliminary proceedings before the substantive decision” and not a decision on the
substantive issues of the Litigation Chamber within the meaning of Article 100 of the LCA.
35. The purpose of this decision is to inform the defendant, presumed to be the data controller, that it may have violated the provisions of the GDPR,
so that it may still comply with the aforementioned provisions.
36. If the defendants disagree with the content of this prima facie decision
and believe they can provide factual and/or legal arguments that could lead
to a new decision, they may request a review by the Litigation Chamber
according to the procedure established by Articles 98 and 99 of the Belgian Law on Administrative Procedure (LCA), known as the "substantive proceedings" or "trial on the merits." This request must be
sent to the email address litigationchamber@apd-gba.be within 30 days of
notification of this prima facie decision. If applicable, the enforcement of this
decision is suspended during the aforementioned period.
37. Should the case proceed further on its merits, pursuant to Articles 98, 2° and 3°
in conjunction with Article 99 of the LCA, the Litigation Chamber will invite the parties to submit their
pleadings and to attach to the file all documents they deem relevant. If so, this
decision is hereby definitively suspended.
38. In the interest of transparency, the Litigation Chamber further emphasizes that
proceedings on the merits may lead to the imposition of the measures mentioned in
Article 100 of the LCA.
III. Publication of the Decision
39. Given the importance of transparency regarding the decision-making process of the Litigation Chamber,
this decision is published on the APD website. However, it is not
Section 3, Subsection 2 of the LCA (Articles 94 to 97 inclusive).
Article 100, § 1. The Litigation Chamber has the power to:
1° dismiss the complaint without further action;
2° order the case to be dismissed;
3° suspend the proceedings;
4° propose a settlement;
5° issue warnings and reprimands;
6° order compliance with the data subject's requests to exercise their rights;
7° order that the data subject be informed of the security issue;
8° order the freezing, limitation, or temporary or permanent prohibition of the processing;
9° order the processing to be brought into compliance;
10° order the rectification, restriction, or erasure of the data and notification thereof to the data recipients;
11° order the withdrawal of the accreditation of certification bodies;
12° impose penalty payments;
13. To impose administrative fines;
14. To order the suspension of cross-border data flows to another State or an international organization;
15. To forward the case to the Public Prosecutor's Office in Brussels, which will inform it of the action taken;
16. To decide on a case-by-case basis whether to publish its decisions on the website of the Data Protection Authority.
