A recent ruling against RTL Belgium has highlighted the importance of GDPR-compliant cookie consent practices. The Belgian Data Protection Authority (DPA) ordered RTL to adjust its cookie banners to ensure that users can easily reject cookies with equal prominence as the “Accept All” option. This decision emphasises the need for transparency, usability, and fairness in cookie consent mechanisms, setting a strong precedent for how businesses should approach consent requests under the GDPR.
What happened?
The complaint, brought forward by the digital rights group NOYB, accused RTL Belgium of using misleading design tactics to nudge users into accepting cookies. The investigation found that the “Accept All” button was highlighted with a vibrant colour and placed prominently, while the “Reject All” option was obscured in a secondary layer of the banner. The DPA ruled that RTL’s practices violated GDPR principles, ordering RTL to include a “Reject All” button in the banner’s first layer, to standardise button colours, and to ensure that withdrawing consent is as simple as providing it.
What does it mean for your organisation?
This ruling demonstrates that authorities are increasingly taking action and imposing fines for non-compliant cookie practices. The Belgian DPA's decision specifically cited violations of GDPR Articles 5 and 6, alongside Article 5(3) of the ePrivacy Directive, which mandates clear and informed consent for cookie use. Here are some key considerations:
• Clarity and Accessibility: Ensuring that “Accept All” and “Reject All” options are equally visible and accessible in cookie banners is not just good practice—it’s now a regulatory expectation. Cookie consent should be simple and intuitive, with both acceptance and rejection options on the first screen.
• Design Neutrality: Avoid using eye-catching colours or design tactics that push users towards accepting cookies. The DPA’s ruling against RTL Belgium illustrates that manipulative design is seen as a breach of GDPR’s transparency and fairness requirements, particularly under Articles 5 and 6, and ePrivacy Article 5(3).
• User Control and Consent Withdrawal: The GDPR requires that withdrawing consent be as easy as giving it. Ensure that users can revoke cookie consent through an accessible and straightforward method, without hidden links or complex steps.
Here are steps your organisation can take to strengthen cookie consent practices:
• Implement an Equal-Weight Banner Design: Ensure both “Accept All” and “Reject All” options are presented with the same visual prominence on the first layer of your cookie banner. Avoid using contrasting colours or placements that could bias users toward one choice over the other.
• Include a ‘Reject All’ Option by Default: Displaying both “Accept All” and “Reject All” options upfront aligns with GDPR and ePrivacy expectations for freely given and informed consent. Regulatory guidance increasingly highlights this as best practice to ensure that users have a genuine choice in managing non-essential cookies.
• Simplify Consent Withdrawal: As highlighted in our June newsletter, effective cookie management involves offering clear pathways for users to manage or withdraw consent. It should be as easy to withdraw consent, as it was to give it in the first instance.
• Maintain Transparent and Up-to-Date Policies: Ensure your cookie consent banner links to an updated Cookies Policy and Privacy Notice. As previously noted, transparency in data collection and processing practices helps build user trust and fulfils GDPR requirements for clear and comprehensive information.
The takeaway?
Transparency, usability, and respect for user choice are at the core of-compliant cookie practices. Prioritising these elements not only avoids regulatory risks but also enhances user trust, ensuring fair data processing choices on your digital platforms.
Tales from the coalface
Each month, we examine pressing Data Protection issues encountered by our clients. This month, we look at CCTV use in the workplace and the fine balance between ensuring security and protecting employee data protection rights under GDPR.
CCTV Use in the Workplace: Balancing security needs with employee data protection rights under GDPR
CCTV has long been a staple in workplace security, offering a sense of safety and a means to protect against theft, misconduct, and property damage. However, the deployment of CCTV systems must be carefully managed to comply with GDPR, particularly in relation to employee data protection rights. Recently, one of our clients implemented a new CCTV system to enhance security at their premises. While the intention was to monitor high-risk areas such as entry points and car parks, some cameras were placed in internal workspaces without sufficient consultation or transparency. The employees raised concerns that they were being unfairly monitored, particularly in areas where they expected greater privacy, such as rest areas and break rooms.
Upon reviewing the case, it became clear that the organisation had not conducted a Data Protection Impact Assessment (DPIA) or a Legitimate Interests Assessment (LIA) prior to installing the cameras, nor had they informed staff adequately about the purpose of the CCTV or how the footage would be used. This left the company vulnerable to complaints and potential non-compliance with GDPR.
What does GDPR say about CCTV in the workplace?
According to the DPC’s guidance, under GDPR, the use of CCTV involves processing personal data, as individuals can be identified through the footage. Employers must have a lawful basis for using CCTV, and the principle of proportionality applies—CCTV should only be used when necessary, and in areas where employee data protection rights are not unduly infringed
Key considerations include:
• Transparency: Employees must be informed about the presence of CCTV, its purpose, and how the footage will be used. This information should be clearly outlined in a privacy notice and displayed through appropriate signage, as per transparency obligations under GDPR.
• Lawful basis: The use of CCTV must be justified under one of the GDPR’s lawful bases for processing personal data, e.g. legitimate interests (Article 6(1)(f)). An LIA should be conducted to ensure that the legitimate interest in using CCTV does not disproportionately impact employee rights and freedoms.
• Necessity and Proportionality: CCTV should be limited to areas where there is a genuine need for surveillance, such as entrances, exits, and areas with security risks. The DPC’s guidance emphasises that recording in areas where employees have an increased expectation of privacy, such as break rooms or restrooms, is generally unjustified and could be excessive
• DPIA and LIA: A DPIA is required for high-risk processing, such as monitoring employees through CCTV. When legitimate interest is the lawful basis, an LIA should assess whether it is appropriate and proportionate.
• Retention: The DPC’s guidance stresses that CCTV footage should not be retained longer than necessary. Organisations must establish clear retention policies in line with the principle of data minimisation and the shortest retention period possible
Results and Lessons Learned
Following the concerns raised by employees, the organisation conducted a review of its CCTV policies and procedures. A Data Protection Impact Assessment (DPIA) and a Legitimate Interests Assessment (LIA) were completed to assess the risks associated with the CCTV setup and ensure the balance between security needs and employee rights. Cameras were repositioned to focus on high-risk areas, removing them from spaces where employees expected greater privacy. Clear signage was installed, and employees received an updated privacy notice outlining the purpose, lawful basis, and retention policy of the CCTV footage.
For any organisation using CCTV in the workplace, it’s essential to strike a balance between security needs and employee data protection rights. Below are some best practices to consider:
• Conduct a DPIA and LIA: Before installing CCTV, ensure both a DPIA and LIA are conducted to assess potential risks and justify the use of CCTV.
• Be transparent: Use clear signage and privacy notices to inform employees and other individuals about the purpose of the CCTV and who to contact for further information
• Limit use: Only install cameras where there is a genuine need for surveillance and avoid areas where employees would expect privacy.
• Retention policies: Ensure that footage is retained for the shortest period necessary, and securely deleted when no longer needed.
• Employee consultation: Engage employees in discussions about CCTV and its usage to ensure transparency and address any data protection concerns.
By following these steps and incorporating the DPC’s guidance, your organisation can ensure that its CCTV use complies with GDPR while respecting the data protection rights of employees.
If you need assistance with your CCTV policies or need support with data protection compliance, get in touch with Ambit Compliance. Our team can offer guidance on every aspect of CCTV deployment, from conducting DPIAs and ensuring lawful processing to implementing transparent policies and best practices. Our goal is to help your organisation meet its compliance obligations while maintaining effective security measures.
Contributors to this blog:
Dwayne Morgan and Gillian Traynor
