DPA case 57/2024 – Complaint Upheld (Belgium, 2024)

On 25 June 2022, the data subject was asked for his identity card as a deposit when renting an mobility aid to visit the controller's estate. He would get his identity card back upon returning the device. The data subject pointed out to the controller that this practice was not in accordance with the law. The controller replied that everyone surrendered their ID card as a deposit. Therefore, the data subject proceeded to do so and received a ticket in exchange. On the same day, the data subject filed a complaint using the controller's email address for privacy related matters. Three days later, the controller responded that the use of an ID document was allowed as no copies or scans would be made. The data subject responded by indicating that internal regulations mentioned an alternative deposit of 100€ for those who did not have or did not want to provide proof of identity, an option which he was not proposed. He also referred to the Belgian DPA website ("GBA") which read that an ID card cannot be kept as a deposit, as it prevents the data subject from fulfilling it's legal obligation to carry their card (Royal Decree of 25 March 2003 on Identity cards - KB van 25 maart 2003 betreffende de identiteitskaarten). On 5 July 2022, the data subject filed a complaint with the GBA. Firstly, regarding the material scope of the GDPR, the GBA indicated that under Article 2(1) GDPR, the latter shall apply to the processing of personal data by automatic means or which form part of a filing system. The CJEU clarified the concept of "file" by holding that "the concept of a ‘filing system’ [...] covers a set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, if those data are structured according to specific criteria which, in practice, enable them to be easily retrieved for subsequent use." ([https://gdprhub.eu/index.php?title=CJEU_-_C-25/17_-_Jehovan_todistajat CJE