DPA case Decision 138-2022 – Complaint Upheld (Belgium, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian company used surveillance cameras that invaded the privacy of its neighbors. The DPA found that the company violated GDPR by not properly registering the purpose of the surveillance and not informing authorities as required by law.
What happened
A company installed surveillance cameras that recorded neighboring properties without proper registration or notification.
Who was affected
The neighbors whose privacy was affected by the surveillance cameras.
What the authority found
The DPA ruled that the company violated multiple GDPR principles regarding lawfulness and transparency in its use of surveillance.
Why this matters
This case highlights the need for businesses to comply with privacy laws when using surveillance technology and to respect the privacy of others.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
This decision concerns the use of a surveillance camera which partly pointed at the living space and garden of some neighbors (the data subjects). The controller stated that the purpose of the cameras was to protect its collection of high value motorcycles and that it had never been its intention to violate someone else's privacy. The data subjects filed separate complaints at the DPA which were combined in a single procedure. One of the data subjects also went to the police, which resulted in a police investigation at the controller’s place at 27 October 2022. The police came to several conclusions, amongst others the fact that the controller didn't register the purpose of the video surveilance before he placed the security camera. It was obligatory to register the purpose of camera surveilance to the police before the camera was placed. The police also found that the controller didn't notify the police about the placement of the surveillance camera, despite the fact that this was a legal obligation under national law (Article 7(2)(2) Camerawet). The DPA conducted an investigation into the controller. The investigations unit held that the controller violated Articles 5(1)(a), 5(1)(b), 5(1)(c), 5(2) and 24(1) GDPR. The investigations unit also held that the controller violated several local legislations, specifically Article 5 Camerawet, Article 3 Koninklijk Besluit 10 February 2008 and Articles 7, 8, 9 Camerabesluit. The DPA held that it had the jurisdiction to decide this complaint. First, the recordings of natural persons with surveillance cameras are personal data. Second, the fact that the controller placed the cameras on his own property does not trigger the "household exemption" under Article 2(2)(c) GDPR. When the cameras also record, as in this case, public or private spaces, this provisions doesn’t apply. Therefore, the GDPR was applicable. The DPA held the controller had violated the principle of lawfulness, fairness and transparency under Artic
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Decision 138-2022 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case Decision 138-2022 - Belgium (2022). Retrieved from cookiefines.eu
Last updated: