DPA case 129/2023 – Dismissed (Belgium, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A parking space provider in Belgium faced a complaint about its use of Automatic Number Plate Recognition (ANPR) cameras but the authority dismissed the case. The complainant questioned whether a data protection impact assessment was done, but the authority found no significant personal impact from the situation. This case shows that not all privacy complaints will lead to action if they lack evidence of harm.
What happened
The parking provider was questioned about its data protection impact assessment related to its ANPR system.
Who was affected
A customer who inquired about the data protection impact assessment.
What the authority found
The authority dismissed the complaint due to lack of sufficient personal impact and evidence of a GDPR infringement.
Why this matters
This ruling indicates that complaints must demonstrate clear personal impact to be taken seriously. Businesses should ensure they have proper assessments and responses to privacy inquiries.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller is a parking space provider using Automatic Number Plate Recognition (ANPR) Cameras. The controller used an ANPR system to facilitate the automatic opening and closing of entry bariers to the premises. After a customer payed for the parking time registed to a vehicle with a certain number plate, the exit to the premises automatically opened for a vehicle with that number plate. Using this system, the controller collected the following information (1) the automatic registration of a car's number plate once it has entered the premises, (2) an exact timestamp of entering the premises and duration of parking, and (3) a picture of each vehicle. On 12 July 2023, the data subject contacted the controller asking whether a data protection impact assessment had been undertaken prior to the implementation of the system, and if so, what the outcome of it was. On 14 July 2023, the controller replied stating that their new payment mechanism "guarantees the privacy of all users", but disregarded the data subject's question regarding the data protection impact assessment. On 18 July 2023, the data subject filed a complaint with the Belgian DPA regarding the controller's failure to respond adequately to their request. The Belgian DPA dismissed the complaint on the grounds of (1) "lack of sufficient personal impact" for the purposes of Article 35 GDPR, and (2) "insufficient documentary evidence" that an "effective" infringement of the GDPR had taken place. In reaching its conclusion on these two grounds, the DPA stated that "the complainant raises a socially relevant issue, but does not demonstrate that an effective infringement of the GDPR has occured. As the complainant does not exercise any rights of a data subject and is merely asking for more information regarding a possible data protection impact assessment, the [DPA] finds that the grievances raised by the complainant do not meet the criteria of high personal impact."para 12. The DPA concluded t
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 129/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 129/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: