Defendant : Westtoer APB a public entity giving autonomous services in the area of tourism in the province of West -Flanders. – Violation Found (Belgium, 2021)

Facts : 1/ The defendant is an autonomous provincial public entity working in the sector of tourism for the province of West-Flanders. 2/ The defendant decided to place intelligent cameras in order to provide a passer-by counts at specific locations in the context of the Covid-19 epidemic. 3/ To this end, the defendant issued a public contract on behalf of the coastal municipalities, which was awarded on June 9, 2020 to company X, which acts as processor. 4/ An investigation was launched by the DPA to submit a file to the Inspection Service since the serious evidence that the use of intelligent cameras by the defendant could give rise to an infringement of the fundamental principles of the protection of personal data. The DPA's inspection states the following : 1) Infringement by the defendant of the principles of lawfulness, propriety and transparency as well as the principle of purpose limitation and the principle of data minimization and accountability. The Inspectorate states first of all that the defendant does not adequately demonstrate that the data subjects are properly and transparently informed and that the defendant insufficiently demonstrates that the processing of personal data by the relevant intelligent cameras is for specific, explicit and legitimate purposes. The defendant insufficiently demonstrates that the personal data processed by the intelligent cameras is adequate, relevant and limited to what is necessary for the purposes for which the data is processed. 2) Infringement of Article 6.1 GDPR. The Inspectorate is of the opinion that the defendant does not demonstrate why it is necessary for the achievement of its mission of public interest to process personal data via intelligent cameras. 3) The Inspection Service determines that the information provided by the defendant through the privacy statement published on the website www.westtoer.be/nl/data processing is not completely correct and transparent. 4) The Inspectorate determines that the DPIA made by the defendant does not comply with the requirements of the GDPR and that the Data Protection Officer was insufficiently involved. The Inspectorate also makes a number of additional observations, outside the scope of the serious indications, especially: - consent for the use of cookies on the website of the Defendant does not comply with the GDPR. - the register of processing activities of the defendant does not meet the requirements of the GDPR - the data protection officer is not is employed full-time and does not report directly to the highest level manager of the defendant. - What requirements must be met by a controller concerning the justification of the lawfulness of the processing of personal data through a system of intelligent cameras within the meaning of Article 6 GDPR ? - What must be taken into account by the controller when processing personal data through a system of intelligent cameras in order to respect the principles of data protection by default and by design ? - What obligations must be met by the controller in this context in terms of transparency and information given to the data subjects ? Holding : 1) Sufficient legal ground for the intended processing. A complete examination of the legal basis is not conducted by the litigation chambers which finds that the defendant makes a plausible case for performing a task of public interest. The litigation chamber states that it is primarily the task of the authorities at whose request the processing operations are carried out take place - in this case the province of West Flanders and the coastal municipalities involved to ensure that a legal basis iexists that meets the requirements of article 6.3 GDPR. This does not alter the fact that a controller as the defendant has the duty to ascertain the extent to which an adequate legal basis is provided. In this decision, the Disputes Chamber limits itself to these general considerations the legal basis 2) The necessity and proportionality of the processing : The defendant proves that the processing meets the necessity and proportionality principles with a view in its implementation and intended purpose and also proves sufficiently the absence of an alternative- less intrusive system that would similarly achieve the same goals. 3) Data protection by default and by design : The chamber concludes that the defendant has included data protection by default and by design at early stage in the design of the processing operations through the use of the system of intelligent cameras has included the appropriate technical and organizational measures since the outset (launching of the public contract) regarding the passer-by census system. In practice, the defendant opted for a stand-alone system, not connected to any network, whereby the processing of personal data by means of video equipment is kept to a minimum and no other personal data becomes collected. 4) Transparent information to data subjects : The privacy policy and register of the defendant are not entirely complete but in view of the cooperation of the defendant and the amendment of the privacy statement during the course of the proceedings, the litigation chamber does not consider it necessary to issue a sanction but does recommend to the defendant to take measure to comply with the GDPR. 5) Other remarks : The litigation chamber does find that the way the defendant justifies the processing of personal data via cookies present on its website is not sufficient and that the data protection officer also does not report to the highest level of management of the defendant. Decision of the DPA : - finds that the system of intelligent cameras implemented by the defendant does not violate article 5.1 a), b) and c) and is in accordance with article 25 GDPR; - orders the defendant to complete the information that it provides about its processing operations in its privacy statement in accordance with Articles 12 and 13 GDPR, in particular with regard to the additional information requested from the data subject in the context of a request on the basis of Articles 15 to 21 of the GDPR. - orders the defendant to align its register of processing activities with the requirements of Article 30 GDPR and in particular to specify to which third countries transfer of personal data takes place within the period of one month after the notification of this decision. - Formulates a reprimand with regard to the defendant for violation of articles 6.1 a), 7.1, 7.3 (consent cookies) and 38.3 GDPR (data protection officer must report directly to the highest management level of the controller).