DPA case 57/2024 – Complaint Upheld (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian authority upheld a complaint from a person who was asked to surrender their ID card as a deposit when renting a mobility aid. The authority found that this practice was against the law. This case shows that businesses must follow legal guidelines when handling personal identification.
What happened
The Belgian data protection authority upheld a complaint against a company for unlawfully requiring an ID card as a deposit.
Who was affected
The person who complained about being asked to surrender their ID card when renting a mobility aid.
What the authority found
The authority ruled that keeping an ID card as a deposit violated data protection laws.
Why this matters
This ruling reinforces the importance of following legal requirements when handling personal identification. Companies should review their policies to ensure compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 25 June 2022, the data subject was asked for his identity card as a deposit when renting an mobility aid to visit the controller's estate. He would get his identity card back upon returning the device. The data subject pointed out to the controller that this practice was not in accordance with the law. The controller replied that everyone surrendered their ID card as a deposit. Therefore, the data subject proceeded to do so and received a ticket in exchange. On the same day, the data subject filed a complaint using the controller's email address for privacy related matters. Three days later, the controller responded that the use of an ID document was allowed as no copies or scans would be made. The data subject responded by indicating that internal regulations mentioned an alternative deposit of 100€ for those who did not have or did not want to provide proof of identity, an option which he was not proposed. He also referred to the Belgian DPA website ("GBA") which read that an ID card cannot be kept as a deposit, as it prevents the data subject from fulfilling it's legal obligation to carry their card (Royal Decree of 25 March 2003 on Identity cards - KB van 25 maart 2003 betreffende de identiteitskaarten). On 5 July 2022, the data subject filed a complaint with the GBA. Firstly, regarding the material scope of the GDPR, the GBA indicated that under Article 2(1) GDPR, the latter shall apply to the processing of personal data by automatic means or which form part of a filing system. The CJEU clarified the concept of "file" by holding that "the concept of a ‘filing system’ [...] covers a set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, if those data are structured according to specific criteria which, in practice, enable them to be easily retrieved for subsequent use." ([https://gdprhub.eu/index.php?title=CJEU_-_C-25/17_-_Jehovan_todistajat CJE
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 57/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 57/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: