DPA case 132/2025 – Complaint Upheld (Belgium, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A bike rental company in Belgium was found to have improperly handled customer ID verification by requesting unnecessary personal information. This matters because it highlights the importance of only collecting data that is truly needed and being transparent with customers about how their data is used.
What happened
The bike rental company required customers to provide a photo of their ID card for verification without proper justification.
Who was affected
Customers who rented bikes and had their ID photos processed by the company.
What the authority found
The authority ruled that the company did not have a valid legal basis for processing the customer's ID photo, violating GDPR rules on data processing.
Why this matters
This case emphasizes that companies must be careful about the data they collect and ensure they have a valid reason for processing it. Businesses should review their data collection practices to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller is a bike rental company that operates on a subscription basis. In order to rent a bike a customer must first register online. For electric bicycles, after registration, the controller required the verification of customers by requesting a photo of their ID card. Then it transmitted the ID image to a processor, a company specialising in identity verification software, which verified its authenticity. Only after the verification could a customer make an appointment to pick up a bicycle. At the time of the bike pick up, the customer had to present their identity card again. Following a billing dispute, in January 2024, the data subject made an access request to which the controller did not respond. In March 2024, the data subject lodged a complaint with the DPA (Autorité de protection des données/Gegevensbeschermingsautoriteit – APD/GBA), claiming that the photographing of the back of her identity card, on which her national registry number appeared, was not necessary, and that the processing of her photo in her ID card was unlawful. She further complained that she was not informed in advance about the processing of her ID photo, of her national registration number and of the processing of location data of the rental bicycle. Lastly, she complained that her access request was not answered. The controller claimed that the processing of personal data for the verification was necessary in order to fulfill its contractual obligations, and, in any case, it was necessary for purposes of fraud prevention. It added that the processor used a privacy filter and only processed the personal data on the ID temporarily, before the masking of the data effectively took place. According to the controller, this processing was considered merely a ‘reading of data points’, which was permitted under Belgian law. After the complaint was lodged, the controller stopped performing this verification process and deleted the data collected as a result of this processing. F
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 132/2025 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 132/2025 - Belgium (2025). Retrieved from cookiefines.eu
Last updated: