DPA case 154/2023 – Complaint Upheld (Belgium, 2023)

On 6 October 2023, an employee (data subject) in a shop lodged a complaint with the Belgian DPA against their employer. The employer (controller) had installed several surveillance cameras in their six shops. In the complaint, the data subject alleged that the cameras were installed in such a way as to place employees under constant surveillance, contrary to the stated purpose of the cameras, which was to provide security in the event of theft or aggression. The data subject claimed that they received regular comments from the security company in relation to their performance at work. In the complaint, the data subject submitted that the surveillance was in violation of [https://leewhiteconsultants.com/Libraries/Articles/CLA68EN.pdf Collective Labour Agreement (CLA) No. 68] (on the protection of workers' privacy with regard to camera surveillance in the workplace). The Belgian DPA found that the camera surveillance was in violation of the principle of data minimisation (Article 5(1)(c) GDPR) and CLA No. 68. In this decisions, many references are made to CLA 68 on camera surveillance in the workplace. This is an important collective labour agreement for Belgian companies in the private sector as it lists the five purposes for which camera surveillance is permitted in the workplace: * Safety and health; * Protection of property; * Monitoring the production process (machines only); * Monitoring the production process (employees); * Monitoring employee performance. The CLA states that for the last two purposes, camera surveillance cannot be continuous. As such, the controller's use of continuous surveillance was in violation of CLA No. 68. Moreover, the purpose of the cameras communicated to the employees was security, not the evaluation of employees' performance. Consequently, the continuous monitoring of employees was not necessary for the purpose of maintaining security in the shops, and as such, was a violation of Article 5(1)(c) GDPR. The Belgian DPA ac