DPA case 188/2022 – Complaint Upheld (Belgium, 2022)

The data subject used a personalised license plate for his car, which he used for his business. The data subject was the sole owner of his company and did not have any employees. The personalised license plate he was using referred to Galatasaray, a well known Turkish football club. The licence plate contained letters and numbers that referred to this club. The producer of a television show (controller) used the same personalised licence plate on a similar looking car displayed in certain scenes of the show. This car in the series belonged to a fictional character, who was part of a fictional criminal organisation. In Belgium, the registration of (personalised) licence plates is conducted by a federal institution. Using the website of this institution, people could verify if a licence plate was already in use by someone else, without disclosing the respective identity. This way, it could be checked beforehand if a desired personalised licence plate was already in use. The data subject asked the controller to remove the license plate from the TV show pursuant to Article 17(1)(c) GDPR, because people recognised his licence plate as the one appearing in the TV show. According to the data subject, people also associated the data subject with the fictional criminal organisation from the show. The controller refused to remove the licence plate because, she argued, the license plate did not constitute personal data. In case that the licence plate was personal data, the controller stated that she was allowed to use this licence plate because of their freedom of (artistic) expression. In its reply to the data subject on 21 January 2022, the controller did not refer to the legal provision of Article 17(3)(a) GDPR, when refusing the data subject's request for erasure. The data subject filed a complaint at the Belgian DPA on 22 February 2022, who started an investigation into the controller. Is a licence plate personal data (Article 4(1) GDPR)? The Belgia