- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 60/2023 – Complaint Upheld (Belgium, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Belgian supermarket faced a complaint after using CCTV footage to investigate a customer's feedback. The DPA found that the supermarket did not have a valid reason to access the footage for this purpose.
What happened
The supermarket accessed CCTV footage without a legal basis to address a customer complaint.
Who was affected
A customer who provided feedback about an unfriendly cashier and had their image used without consent.
What the authority found
The Belgian DPA ruled that the supermarket lacked a legal basis for processing the CCTV footage in relation to the customer survey.
Why this matters
This case underscores the need for businesses to have clear legal grounds for using personal data. Companies should be cautious when using surveillance footage to ensure they comply with privacy regulations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller is a supermarket, and the data subject a customer. After receiving an unsatisfactory customer satisfaction score from a customer satisfaction survey, the controller contacted the data subject to see how it could improve its service. The data subject complained about an unfriendly cashier. The controller then informed the data subject that they would start an investigation, without providing more information on how this would happen. To check which cashier was meant by the data subject, the controller checked the CCTV footage, which did not show any unpleasant behaviour. The controller informed the data subject about this, and also included a picture of the data subject laughing together with the cashier. This picture was taken from the CCTV. The data subject was not pleased with this and submitted a complaint with the DPA. In their defense, the controller stated that this was a one time mistake done by an employee without the intent to infringe the privacy of the data subject. In hindsight, the controller and its employees found the processing to be unlawful and contradictory to internal practices. The controller suspended the processing of all surveys while waiting for the decision of the DPA. On top of that, the controller reached out to the data subject to apologise and to search an amicable solution. The Belgian DPA began by assessing if they CCTV images were accessed lawfully in light of the customer satisfaction survey follow-up based on Article 5. The controller did not dispute the fact that there was no legal basis for this processing and that it should not have happened. Never the less, the DPA assessed whether Article 6(1)(f) could be applicable. The DPA found that the balancing test conducted for the legitimate interest basis was in favour of the data data subject as there was no way to know, nor reasonably expect that the CCTV images would be used for the surveys. As such, the DPA concluded a lack of legal basis for processing and a brea
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 60/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 60/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: