GDPR Compliance

1. The legal basis we rely on

The processing of licence plates is based on legitimate interest, set out in Article 6.1.f of the GDPR. This basis requires a three-step test, which we have documented:

• The interest pursued : allowing road users to pass on useful information or a word of thanks (headlights left on, a door not properly closed, an object left on the roof) rather than settling the situation through confrontation. Some messages directly serve the interest of the driver concerned.
• Necessity : the licence plate is the only shared identifier between road users who do not know each other. Without it, no contact is possible. The alternatives we considered proved either ineffective or more intrusive.
• The balancing test : we weighed our interest against that of the people concerned, taking into account that a plate is permanently visible in public space, that the data processed is not sensitive, and that we cannot identify vehicle keepers.

Our conclusion: the safeguards described below, together with a simple and free right to object, allow this processing to rest on legitimate interest.

2. The safeguards we apply

These safeguards are the counterpart to relying on legitimate interest. They are central to our analysis:

• Systematic transformation of messages : every message is rewritten by artificial intelligence into courteous language before publication. No message is published as it was written.
• Removal of identifying elements : precise locations, descriptions of people and detailed time references are automatically removed, to prevent any indirect identification.
• Partial masking of plates : plates are never displayed in full when consulted publicly.
• No identification of vehicle keepers : we have no access to the vehicle registration register (DIV) and no technical or legal means of knowing who owns a vehicle. We process no geolocation data.
• No resale of data : data is never sold, rented or passed on to third parties for commercial purposes. No advertising is based on licence plates.

3. Your right to object

Anyone can request that a plate be blocked. The request is free, requires no account and does not have to be justified. We do not contest any objection and do not invoke any compelling grounds to refuse it. Through the dedicated page, blocking takes effect immediately: no message can be sent to the plate any more and existing messages are no longer visible. They are permanently deleted within 48 hours.

Block a licence plate

4. Our correspondence with the Data Protection Authority

We consulted the First Line Service of the Belgian Data Protection Authority (DPA), which sent us written guidance on 27 April 2026 (ref. DOS-2026-01358).

It is important to be precise about the scope of this exchange: the DPA does not validate platforms and does not take a position on whether a project is compliant or not. This is general guidance. The compliance test is the responsibility of the data controller, that is to say us. This is precisely the purpose of the analyses summarised on this page.

5. Is a data protection impact assessment (DPIA) required

We examined whether our processing required a data protection impact assessment, in the light of Article 35.3 of the GDPR, the Belgian list of processing operations concerned (DPA decision no. 1/2019) and the nine criteria of the European WP248 guidelines. None of the cases in Article 35.3 applies, no category on the Belgian list corresponds, and the indicative threshold of two criteria out of nine is not reached.

Conclusion: a DPIA is not required at the current scale of the service. This assessment will be carried out again if the service evolves significantly, in particular if photos, geolocation, a business offering or strong growth in usage are introduced.

These internal documents are kept up to date and can be provided to the supervisory authority on request.

6. Contact us

For any question about this page, about our analyses, or to exercise your rights: hello@platewave.be

Information about the site publisher can be found in our Legal Notices.