The APD/GBA (Belgian DPA) in April 2020 decided upon a complaint made in September 2018 with the authority.[1] The affected person claimed that he was filmed by CCTV of a store while walking outside on the sidewalk.
The DPA investigated the complaint and requested from the store owner what can be expected:
- Storage period of images;
- Location where the images are stored;
- Information regarding any subcontractors involved in the monitoring;
- Measures taken to adjust the scope of the camera in regards to passers-by in the street outside the store; and
- The used sign indicating the use of CCTV.
Notably, the DPA also requested an extract from the records of processing activities according to Art. 30 GDPR. As a rule, only companies with more than 250 employees are required to maintain such documentation, displaying all relevant processing of personal data within the company. The authority thereby confirms that the use of CCTV recording public spaces has to be regarded as likely resulting in a risk to the rights and freedoms of data subjects and that the use of CCTV has to be regarded as processing that is not just occasional (see Art. 30 para. 5 GDPR).
Finally, the authority also pointed out the national requirement in Belgium to declare the use of CCTV recording public spaces to the data privacy commission as required by Art. 6 §2 (1) of the national video surveillance act.
[1] https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_16-2020_FR.pdf