On 20 April 2020, the litigation chamber of the Belgian Data Protection Authority (DPA) blamed a store for failing to comply with the requirements to install and operate a surveillance camera system (i.e. any fixed, temporarily fixed or mobile observation system intended to prevent or detect offenses against persons or goods), pursuant to the Act of 21 March 2007 governing the installation and use of surveillance cameras (the Camera Act).
In the current case, the store concerned failed to keep an internal record of surveillance camera activities, pursuant to Articles 7 to 9 of the implementing Royal Decree of 8 May 2018. This record must contain certain information, such as an indication of the type of location of the surveillance cameras and the location where the images are processed. The record of processing activities required under Article 30 of the GDPR had not been properly established either.
Also, since 25 May 2018, surveillance cameras must be notified to the police via the website www.declarationcamera.be, what the store didn’t do. In this regard, it is worth reminding that notifications that were previously made to the former Belgian Privacy Commission will no longer be valid after the end of a two-year “grace” period; new notifications must be filed before 25 May 2020, so in less than a month! Furthermore, failure to comply with the Camera Act may also be criminally prosecuted, i.e. fines of up to EUR 160,000.00.
More practical information can be found on the dedicated website of the Federal Public Service Interior
Last but not least, don’t forget that the use of CCTV at the workplace is governed by the Collective Bargaining Agreement n° 68. In other words, when surveillance cameras fall within the scope of the Camera Act as well as the CBA n° 68 (e.g. cameras placed in a shop filming both employees and customers), you must comply with both regulations.
The decision (in French) of the DPA (N° 16/2020) can be found on: