DPA case 132/2025 – Complaint Upheld (Belgium, 2025)

The controller is a bike rental company that operates on a subscription basis. In order to rent a bike a customer must first register online. For electric bicycles, after registration, the controller required the verification of customers by requesting a photo of their ID card. Then it transmitted the ID image to a processor, a company specialising in identity verification software, which verified its authenticity. Only after the verification could a customer make an appointment to pick up a bicycle. At the time of the bike pick up, the customer had to present their identity card again. Following a billing dispute, in January 2024, the data subject made an access request to which the controller did not respond. In March 2024, the data subject lodged a complaint with the DPA (Autorité de protection des données/Gegevensbeschermingsautoriteit – APD/GBA), claiming that the photographing of the back of her identity card, on which her national registry number appeared, was not necessary, and that the processing of her photo in her ID card was unlawful. She further complained that she was not informed in advance about the processing of her ID photo, of her national registration number and of the processing of location data of the rental bicycle. Lastly, she complained that her access request was not answered. The controller claimed that the processing of personal data for the verification was necessary in order to fulfill its contractual obligations, and, in any case, it was necessary for purposes of fraud prevention. It added that the processor used a privacy filter and only processed the personal data on the ID temporarily, before the masking of the data effectively took place. According to the controller, this processing was considered merely a ‘reading of data points’, which was permitted under Belgian law. After the complaint was lodged, the controller stopped performing this verification process and deleted the data collected as a result of this processing. F