View source for AZOP (Croatia) - Decision 17-05-2022

{{DPAdecisionBOX

|Jurisdiction=Croatia
|DPA-BG-Color=
|DPAlogo=LogoHR.png
|DPA_Abbrevation=AZOP
|DPA_With_Country=AZOP (Croatia)

|Case_Number_Name=Usž-27/22-4
|ECLI=

|Original_Source_Name_1=Visoki upravni sud Republike Hrvatske
|Original_Source_Link_1=https://sudskapraksa.vsrh.hr/decisionText?id=090216ba80d2cc49&q=%2522op%25C4%2587a+uredba+o+za%25C5%25A1titi+podataka%2522
|Original_Source_Language_1=Croatian
|Original_Source_Language__Code_1=HR
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Type=Other
|Outcome=
|Date_Started=
|Date_Decided=17.05.2022
|Date_Published=17.05.2022
|Year=2022
|Fine=9.375,00
|Currency=HRK

|GDPR_Article_1=
|GDPR_Article_2=
|GDPR_Article_3=
|GDPR_Article_4=
|GDPR_Article_5=
|GDPR_Article_6=
|GDPR_Article_7=Article 6 GDPR
|GDPR_Article_Link_7=https://gdprhub.eu/index.php?title=Article_6_GDPR
|GDPR_Article_8=
|GDPR_Article_Link_8=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=Article 31 of the Croation Law on the Implementation of the GDPR
|National_Law_Link_1=https://www.babic-partners.hr/wp-content/uploads/2019/02/Croatian-implementation-of-GDPR.pdf
|National_Law_Name_2=
|National_Law_Link_2=
|National_Law_Name_3=
|National_Law_Link_3=

|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=Presido Croatia
|
}}

The Croatian High Administrative Court confirmed that co-owners of a residential building as well as persons authorised by the controller had the right to access personal data collected through video surveillance as they received consent pursuant to [[Article 6 GDPR|Article 6(1)(a)]]. 

== English Summary ==

=== Facts ===
This case concerns an appeal to the Croatian DPA decision on video surveillance in a residential building. 

A tenant, the data subject, submitted a request to the Croatian DPA regarding a violation of the right to the protection of personal data. He stated that the data recorded through a video surveillance system installed in their residential building was available to all residents in violation of the GDPR. The keys to the room where the video surveillance equipment was installed could be used by everyone.

The DPA found no violation as the residents of the building gave their consent to the installation and maintenance of video surveillance. The data subject alleged that the processor, a representative of the co-owners appointed by the controller, threatened to misuse the data. The data subject appealed the decision to court.

The Court of First Instance established that co-owners confirmed with their signatures and gave their consent to the installation of video surveillance at the expense of the building's reserves and that the video surveillance was a shared device in the building. Furthermore, the co-owners confirmed with their signatures that they agree that the recordings could be viewed by the representative of the co-owners of the residential building. It was determined that the number of consents was more than 2/3 of the co-owned parts required for the establishment of video surveillance in a residential building.  

Consequently, the Court of First Instance rejected the data subject's claim for annulment of the DPA decision and ordered them to compensate the costs of this administrative dispute in the amount of HRK 9,375.00. 

The data subject filed an appeal against the first instance verdict due to an incorrectly established factual situation, incorrect application of substantive law and a violation of procedural rules.

== Holding ==
In all three proceedings it was determined that the video surveillance had been set up on the legal basis of consent, in line with [[Article 6 GDPR|Article 6(1)(a) GDPR]]. 

The Court recalled that [https://www.babic-partners.hr/wp-content/uploads/2019/02/Croatian-implementation-of-GDPR.pdf Article 31 of the Croatian Law on the Implementation of the GDPR] stipulates that the establishment of video surveillance in residential or business-residential buildings requires the consent of co-owners who make up at least 2/3 of the co-owned parts. Video surveillance can only cover access to entrances and exits from residential buildings and common rooms in residential buildings.

That being said, the Court did not find any infringements and dismissed the appeal as unfounded. 

<pre>
Business number: Usž-27/22-4

                           

Business number: Usž-27/22-4

 

 

 

 

IN THE NAME OF THE REPUBLIC OF CROATIA

 


 

The High Administrative Court of the Republic of Croatia in a panel composed of the judges of that court, Gordana Marušić-Babić, the president of the panel, Mira Kovačić and Ph.D. Sanje Otočan, member of the council, and court advisor Martine Barić, recorder, in the administrative dispute of the plaintiff J. K., Z., against the defendant Agency for the Protection of Personal Data of the Republic of Croatia, Z., with the participation of the interested person V. H., Z., represented by attorney S. B., to the lawyer in Z., for the right to the protection of personal data, deciding on the plaintiff's appeal filed against the judgment of the Administrative Court in Zagreb, business number: UsI-3120/20-12 dated November 3, 2021, at the council session held on May 17, 2022.

 

he decided

 

The appeal is rejected and the judgment of the Administrative Court in Zagreb, business number: UsI-3120/20-12 of November 3, 2021, is confirmed.

 

Explanation

 

1. The judgment of the first-instance court, point I of the sentence, rejected the claim of the plaintiff for annulment of the decision of the defendant of the Agency for the Protection of Personal Data of the Republic of Croatia, CLASS: UP/I-041-02/20-08/43, URBROJ: 567-12/07- 20-01 of October 5, 2020. Point II of the sentence of the verdict orders the plaintiff, within 30 days from the date of finality of this verdict, to compensate the interested person for the cost of this administrative dispute in the amount of HRK 9,375.00.

2. The defendant's decision rejected the plaintiff's request to establish a violation of the right to the protection of personal data as unfounded.

3. The prosecutor files an appeal against the first-instance verdict due to an incorrectly established factual situation and incorrect application of substantive law, as well as a violation of procedural rules. In essence, it states that the protection of personal data must be ensured for every natural person. He objects to the report on the supervision of May 18, 2018, because it did not state that an official of the Agency had to determine that the data controller did not act in accordance with Articles 27 and 28 of the Act on the Implementation of the General Regulation on Data Protection (the Act). He states that the residential building is managed by L.-G. d.o.o., and refers to articles 93 and 379 of the Law on Property and Other Real Rights. He states that the defendant accepted the interested person as the executor of data processing. He points out that it is not true that the collected data is not misused because the tenant's representative threatened the tenants by calling for the use of video footage, and the tenant's representative is not a competent state body that has access to video data. He states that in the surveillance report it was not established that there is an automated system of records for recording access to video surveillance recordings with defined parameters from Article 28 of the Act. It refers to Article 31 of the Act, and points out that the installation of video surveillance is an improvement, not a regular job of the regular administration, so the consent of all co-owners is required according to Article 41 of the Act on Property and Other Real Rights, and in this regard it also refers to the opinion of the Ministry of Justice dated February 20, 2013. It points out that the defendant also made a decision contrary to the one contested in this case. He proposes to accept the appeal, change the first-instance verdict or return the case to the court for retrial, and to adopt the claim and the claim for the costs of the litigation.

4. In the response to the appeal, the defendant states that the reasons for the appeal are unfounded. He points out that he acted in accordance with Article 57 paragraph 1 and Article 58 paragraph 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals in connection with the processing of personal data and on the free movement of such data and on repealing Directive 95/46 EC (General Data Protection Regulation) and Articles 34 and 36 of the Law on the Implementation of the General Data Protection Regulation ("Official Gazette" 42/18 - Law), that he acted within the limits of his authority. He states that he acted on the basis of the request of the prosecutor, that he correctly established the factual situation and correctly applied the regulations. He points out that it is not true that the representative of the co-owner is the processor because the co-owners of the residential building have determined the purpose and means of processing personal data in the form of using a video surveillance system for the protection of persons and property, so the representative of the co-owner has the right to access personal data collected through video surveillance as the responsible person of the data controller. as well as the persons authorized by him, bearing in mind that the building in question has 4 separate entrances and elected representatives of the co-owners for each individual entrance. He points out that the Law on Ownership and Other Real Rights does not apply, bearing in mind the Law on the Implementation of the General Regulation on Data Protection, which has been in force since May 25, 2018, and Article 31 of that Law. cases in which supervision was established before and after the adoption of the Law on the Implementation of the General Regulation on Data Protection. He suggests rejecting the appeal and confirming the contested decision.

5. The plaintiff has submitted a submission expressing his opinion on the response to the defendant's appeal. to which answer he objects and considers that the contested decision did not prevent the misuse of video surveillance and video recordings.

6. The interested person, although invited, did not submit a response to the appeal.

7. The appeal is not founded.

8. Examining the challenged judgment within the limits of the grounds of appeal in accordance with Article 73, paragraph 1 of the Administrative Disputes Act ("Official Gazette" 20/10, 143/12, 152/14, 94/16, 29/17 and 110 /21. - ZUS), this Court found that the appeal was unfounded.

9. According to the data in the case file and the explanation of the contested verdict, the plaintiff submitted a request to the defendant to the Agency for the Protection of Personal Data on March 14, 2020, to determine the violation of the right to the protection of personal data, in which he stated that the data of the video surveillance system installed in the residential building in A. V. H. 12, 14, 16, 18 are available to all tenants of the apartment building because the keys to the room where the video surveillance equipment is installed are divided by stairwells, and that the co-owner's representative wrote the names of the co-owners to whom he distributed the keys in all stairwell noticeboards so that everyone can use the recorded personal data .

10. In the conducted procedure, it was determined that the residential building in A.V.H. 12, 14, 16, 18 made a decision and the co-owners confirmed with their signatures and gave their consent to the installation of video surveillance in the said residential building at the expense of the building reserve, they confirmed with their signatures that video surveillance of a common device in the building as a job of regular administration and that the recorder is located in the common areas of the building. Furthermore, the co-owners confirmed with their signatures that they agree that the representatives of the co-owners of the residential building, V. H., the representative of entrance number 12, D. J., the representative of entrance 14, Đ., can view the recordings. Š., representative of entrance 16, Z. B., representative of entrance 18. According to the signature list of the co-owners of the residential building in question, it was established that the number of consents collected is more than 2/3 of the co-ownership parts required for the establishment of video surveillance in the residential building. Attached to the file is the report on the supervision of the authorized officer of the Personal Data Protection Agency dated May 18, 2018. The court of first instance also refers to the judgment of the Municipal Court in Novi Zagreb, business number P-1003/16 of April 27, 2018, which was modified by the judgment. County Court in Zadar business number: 12 Gž-910/18 from November 15, 2018 and rejected the plaintiff's claim, because in that procedure it was determined that the video surveillance was installed in a manner based on the law, and in that case the court considered the issue of regular or extraordinary investments, improvements and the issue of co-ownership ratios and majority consent of co-owners.

11. Article 31 of the Law on the Implementation of the General Regulation on Data Protection stipulates that the establishment of video surveillance in residential or business-residential buildings requires the consent of co-owners who make up at least 2/3 of the co-owned parts (paragraph 1). Video surveillance can only cover access to entrances and exits from residential buildings and common rooms in residential buildings (paragraph 2).

12. Bearing in mind all the data of the case file, the mentioned Article 31, and Articles 26, 27 and 28 of the Act on the Implementation of the General Data Protection Regulation and Article 6 of the General Data Protection Regulation which entered into force and are directly applies in all EU member states from May 25, 2018, which relevant provisions are cited by the first-instance court in the judgment, the claim was properly rejected. This is because it was correctly established in the proceedings and the dispute that in the specific case there was no violation of either the provisions of the General Data Protection Regulation or the Law on the Implementation of the General Data Protection Regulation.

13. The prosecutor, with the reasons stated in the appeal, did not cast doubt on the legality of the disputed verdict, which was passed on the basis of properly established facts, and with the proper application of substantive law.

14. Following the above, on the basis of Article 74 paragraph 1 of the ZUS, it was necessary to decide as in the sentence of the verdict.

 

In Zagreb on May 17, 2022.

 

President of the council:

Gordana Marušić-Babić
</pre>