GDPR PRACTICES FOR IDENTITY VERIFICATION IN THE BICYCLE RENTAL SECTOR IN BELGIUM

This article studies the Belgian Data Protection Authority’s decision of 19 August 2025 about a bicycle rental company that demanded users to provide their identity cards, where more information was placed for the contract performance, and, moreover, allowed continuous geolocation tracking. The case shows how personal data must be practically processed in compliance with the General Data Protection Regulation (GDPR). It spotlights the legal issues of necessity, legal interests, data minimization, together with the privacy, transparency, proportionality, and rights to access. The examination also stresses that location data, while not explicitly defined in the GDPR, qualifies as personal data too. The sanctions levied by the Belgian authority, including a reprimand and a warning, confirm the importance of executing robust safeguards to secure lawful processing and respect for data subjects’ rights. Also, by brooding on scholarly lookouts with a practical case, the study recommends enriching identity verification practices in shared mobility services, ensuring GDPR obedience while keeping user trust.