APD/GBA (Belgium) - 98/2024
From GDPRhub
| APD/GBA - 98/2024 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 12(3) GDPR Article 15 GDPR Article 31 GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 24.07.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 98/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | APD/GBA (Belgium) (in FR) |
| Initial Contributor: | wp |
The DPA found a person installing a CCTV within the premises was a data controller, obliged to fulfil the duties of data controller stemming from the GDPR, including answering the access request under Article 15.
English Summary
Facts
One of the resident (controller) installed five cameras (CCTV) within their premises. The controller obtained a consent of their neighbour to process the CCTV data.
A data subject claimed two cameras covered their garden, which was contrary to what they agreed to. Then, the data subject asked the controller to move the cameras adequately and give data subject access to the recordings to verify their content. Despite multiple tries, the controller did not respond to the request.
In the meantime, the controller installed additional camera – a doorbell camera facing data subject’s driveway and private entrance.
The data subject consulted the Belgian DPA (APD/GBA) on what further actions they should take. The DPA suggested to contact the local police or to start proceedings before the DPA.
The Police found the setting of two cameras was changed, so it did not cover the data subject’s premises. Nevertheless, the doorbell camera was programmed to send notification every time someone showed up within its range. The data subject, requested the controller to change the setting of the doorbell camera as well, but the controller did not reply.
A moment later, the controller replaced two cameras with new, advanced models (vide-angle lenses) and changed the location of the doorbell, which covered also a pavement and a street.
As the mediation before the DPA was unsuccessful (the controller did not respond to official letter of DPA), the data subject decided to lodge a complaint with the DPA.
Holding
The DPA decided to close the case due to the expediency.
Firstly, the DPA noted the controller was obliged to answer data subject’s access request under Article 15, which they obviously failed to do. Hence, the controller violated Article 12(3) GDPR.
Secondly, the controller violated Article 31 GDPR, because they did not respond to any official mails sent by the DPA.
Nevertheless, the DPA found the case at hand was a broader dispute to be heard by a court. The complaint did not provide enough evidence to confirm the CCTV breached the GDPR. Also, there was a proceedings before the Police run in parallel, making a potential investigation of the DPA pointless.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
1/10 Litigation Chamber Decision 98/2024 of 24 July 2024 File number: DOS-2023-00957 Subject: Complaint regarding the installation of surveillance cameras in the context of a neighbourhood dispute The Litigation Chamber of the Data Protection Authority, consisting of Mr. Hielke Hijmans, President, sitting alone; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR; Having regard to the Law of 3 December 2017 establishing the Data Protection Authority (hereinafter LCA); Having regard to the Law of 30 July 2018 on the protection of individuals with regard to the processing of personal data (hereinafter LTD); Having regard to the Rules of Procedure as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Journal on 15 January 2019; 1 Having regard to the documents in the file; Has taken the following decision concerning: The complainants: X1 and X2, hereinafter "the complainants"; The defendant: Mr and Mrs Y, hereinafter "the defendant"; 1The new internal regulations of the APD, following the amendments made by the Law of 25 December 2023 amending the law of 3 December 2017 establishing the Data Protection Authority (LCA) came into force on 01/06/2024. In accordance with Article 56 of the law of 25 December 2023, it only applies to complaints, mediation files, requests, inspections and procedures before the Litigation Chamber initiated from this date: https://www.autoriteprotectiondonnees.be/publications/reglement-d-ordre-interieur-de-l-autorite-de-protection-des- donnees.pdf. Cases initiated before 01/06/2024 [as in this case] are subject to the provisions of the LCA as not amended by the Law of 25 December 2023 and the internal regulations as they existed before that date. Decision 98/2024 - 2/10 I. Facts and procedure 1. On 29 August 2023, the complainants filed a complaint with the Data Protection Authority (hereinafter “the DPA”) against the defendant, a neighbouring couple having installed a video surveillance system around their home. 2. The subject of the complaint concerns unlawful data processing and an intrusion into the complainants’ private lives caused by the installation of outdoor cameras by the defendant, which, according to the complainants, film their home. 3. During the month of July 2022, the defendant installed surveillance cameras: one at the front of the house, three at the back. Among these, two cameras were allegedly oriented towards the plaintiffs’ garden, leading them to ask the defendant to modify the installation of these cameras, so as to no longer film their garden, and to be able to check the images recorded by the cameras. 4. On 2 August 2022, the plaintiffs sent a registered letter to the defendant in which they stated that they had given their consent to the installation of surveillance cameras on the condition that they did not record any images of their property. They therefore asked them, once again, to modify the installation of the cameras and to be able to check the images filmed afterwards. 5. On 24 February 2023, the defendant installed, according to the plaintiffs, an additional camera, which would appear on the doorbell and would be directed towards their driveway and private entrance. 6. On 25 February 2023, the plaintiffs made a request for information to the APD to find out their levers of action. 7. On 27 February 2023, the Frontline Service (hereinafter the "SPL") responded to this request and suggested, on the basis of the law of 21 March 2007 regulating the installation and use of surveillance cameras (hereinafter "the camera law"), to contact the local police or, on the basis of the GDPR, to file an action with the APD, namely a complaint action or a request for mediation. 8. On March 2, 2023, police officers visited the defendant. They confirmed to the plaintiffs that their garden did not appear on the images filmed by the cameras. However, the installer of the cameras allegedly informed the plaintiffs that the cameras could have their settings and caches modified at any time by users. Also, the doorbell with the installed camera allegedly sends a notification each time the plaintiffs enter or leave their home. The latter allegedly complained about this to the defendant, to no avail. 9. On 25 March 2023, the complainants filed a request for mediation, seeking to obtain a change in the orientation of the cameras installed at the back of the house, so that they could no longer film the complainants' garden, as well as a change in the installation of the connected doorbell. 10. On 4 April 2023, the SPL declared the request for mediation admissible. 11. On 14 April 2023, the SPL sent a letter to the defendant. The letter called on the latter to comment on the registered letter that the complainants had sent them on 2 August 2022. 12. On 6 July 2023, the SPL sent a registered letter to the defendant, asking them to respond to the letter that had been sent to them on 14 April 2023. 13. On 19 July 2023, the complainants informed the APD of changes in the installation of the defendant's cameras. In fact, the latter had replaced two cameras with more efficient models since they were equipped with wide-angle lenses. In addition, the connected doorbell would have been moved to face the street, making it possible to film, in addition to the plaintiffs' driveway, their car, the sidewalk and the street from left to right over 180°. Furthermore, the plaintiffs and the defendant live in semi-detached houses, and whose gardens occupy an area of approximately 5.60 meters wide and 15 meters long. It being understood that there are three cameras at the back of the defendant's house, there would be, given the width of the garden area, 1 camera every 1.80 meters; according to the plaintiffs, it would therefore be impossible for these cameras not to film their garden, and therefore, the number of cameras installed would be disproportionate. 14. On 18 August 2023, the complainants sent an email to the APD to ask about the status of the situation. 15. On 21 August 2023, the APD informed them that the two letters they had sent to the defendants had still not been answered, declaring the mediation unsuccessful and therefore informing them of the possibility of transforming their mediation into a complaint, in accordance with Article 62, §2, 1° of the LCA. 16. On 29 August 2023, the complainants transformed their request for mediation into a complaint. 17. On 6 September 2023, the Front Line Service of the Data Protection Authority declares the complaint admissible on the basis of Articles 58 and 60 of the LCA, and forwards it to the Litigation Chamber in accordance with Article 62, § 1 of the LCA. 18. On 11 October 2023, the Litigation Chamber asks the complainants whether they have exercised their right of access again and whether they have obtained a response from the defendant. 19. On 12 October 2023, the complainants responded to the Litigation Chamber that they had not resubmitted a request for a right of access and that the defendant had followed up on their exercise of the right of access dated 2 August 2022. The complainants indicated that they were not satisfied with this. 20. On 19 November 2023, the complainants sent an email to the Litigation Chamber stating that they had again noticed on 16 November 2023 at around 8:30 p.m. that the camera placed at the front of the defendant’s house was triggered when they moved from their garden path to their entrance. Following this, the complainants rang the defendant’s doorbell, to no avail. Approximately 30 minutes later, the police allegedly showed up at the plaintiffs’ home following a call from the defendant. In an appendix to the email, the plaintiffs attach photos of the front facade of the defendant’s home. 21. On December 1, 2023, the plaintiffs attach a new element to the file: they noticed on Thursday, November 30 that the connected doorbell goes off as soon as they appear on their private driveway, this happening each time they enter and exit. The plaintiffs add that they have photos and videos. 22. On January 11, 2024, the plaintiffs add that the defendant modified the installation of its cameras by connecting them to the electrical network so that it is now fixed and permanent. One of the three cameras located at the rear of the defendant’s home was allegedly moved and reoriented more towards the orientation of the plaintiffs’ property. II. Motivation II.1. Warning 23. Article 4.7) of the GDPR defines the “controller” as “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing”. 24. The controller must comply with the request made under Articles 15 to 22 of the GDPR by the data subject, in compliance with the conditions set out in Article 12 of the GDPR. 25. The European Data Protection Board (hereinafter “EDPB”) has specified in its guidelines that the information – or the copy of the personal data – provided to the data subject within the scope of Article 15 of the GDPR must be in a permanent and thus durable form. 2 26. Under Article 12.1 of the GDPR, the controller is responsible for “taking appropriate measures to provide any information referred to in Articles 13 and 14 and 2EuropeanDataProtectionBoard,Guidelines01/2022ondatasubjectrights –Rightofaccess,point150,availableinEnglish at: https://www.edpb.europa.eu/system/files/2023-04/edpb guidelines 202201 data subject rights access v2 en.pdf. Decision 98/2024 - 5/10 to provide any communication under Articles 15 to 22 and Article 34 concerning the processing to the data subject in a concise, transparent, intelligible and easily accessible manner, in clear and plain language […].”. 27. The Disputes Chamber adds that it is the responsibility of the data controller to provide the data subject with information on the measures taken following a request made under Articles 15 to 22 of the GDPR, as soon as possible and in any event within one month of receipt of the request. Article 12.3 of the GDPR provides that this period may, if necessary, be extended by two months, taking into account the complexity and number of requests. In such a case, the data controller shall inform the data subject of this extension and the reasons for the postponement within one month of receipt of the request. 28. In this case, the complainants exercised their right of access on 2 August 2022 by means of a registered letter. However, the defendant party allegedly did not comply with this request for access before – at the very least – 2 March 2023. 29. The Litigation Chamber thus notes that the defendant party may have failed to comply with Article 12.3 of the GDPR. 30. In addition to this potential failure, it also appears that the SPL, as part of a mediation procedure, contacted the defendant party twice, including once by registered email (see points 11 and 12). However, these two contacts proved unsuccessful, given that they received no response, leading the SPL to conclude that the said procedure had failed on 21 August 2023. Furthermore, the Litigation Chamber notes that this decision is adopted precisely because the complainants decided to transform their request for mediation into a complaint in accordance with Article 62, §2, 1° of the LCA following this failure. 31. Article 31 of the GDPR provides that "The controller and the processor, as well as, where applicable, their representatives, shall cooperate with the supervisory authority, at the request of the latter, in the performance of its tasks.". 32. The GDPR, including its recitals, does not define what is meant by "cooperation". However, the Litigation Chamber has already had the opportunity to decide that the fact, among other things, of not "complying with the exercise of the complainant's rights and 3 informing the Litigation Chamber of the follow-up given to this decision", of not "putting forward arguments against the injunction given to her as permitted by Article 99 LCA" and of not reacting to an email from the Litigation Chamber informing it of the amount of the proposed administrative fine constitute an attitude reflecting "a 3Decision of the Litigation Chamber 32/2020 of 16 June 2020, point 24. 4Decision of the Litigation Chamber 32/2020 of 16 June 2020, point 25. Decision 98/2024 - 6/10 lack of consideration and cooperation that is manifestly contrary to what is expected of a data controller, in particular in the application of Article 31 of the GDPR. 33. Article 3 of the LCA establishes a supervisory authority within the meaning of Article 51 of the GDPR. 34. Article 4 of the LCA states that the Data Protection Authority (DPA) thus created ensures the monitoring of compliance with the fundamental principles of the protection of personal data. 35. This monitoring by an independent authority is an essential element of the fundamental right to data protection specifically enshrined in Article 8, §3 of the Charter of Fundamental Rights of the European Union. 36. Furthermore, it is clear from Article 22, §1, 2° of the LCA that the SPL “may launch a mediation procedure”, establishing this mechanism as a tool for carrying out its missions. 37. The Litigation Chamber is aware of the free nature of mediation, which can lead to an amicable agreement. Indeed, the Litigation Chamber does not consider under any circumstances that a party can be forced to conclude an amicable agreement. This is up to the strictest discretion of each party. Furthermore, expressing a refusal to engage in a mediation procedure could in no case be held against a data controller or its subcontractor. 38. However, the same is not true for exchanges with the bodies of the DPA. Within the meaning of Article 31 of the GDPR, a data controller must be expected to respond to one of the bodies of the DPA when he receives letters from one of them on two occasions – including once by registered letter – asking him to communicate his position on an invitation to a mediation procedure (the content of this response being in itself completely free). 39. Consequently, the Litigation Chamber notes that the defendant party may have failed to comply with Article 31 of the GDPR. 40. On the basis of the above facts, the Litigation Chamber considers that it is appropriate to conclude that the defendant may have committed a violation of the provisions of the GDPR, which justifies that in this case, a decision be taken in accordance with Article 95, §1, 4° of the LCA, more precisely the adoption of a warning decision. II.2. Discontinuation of proceedings 41. On the basis of the facts described in the complaint file as summarised above, and on the basis of the powers conferred on it by the legislator under Article 95, § 1 of the LCA, the Litigation Chamber decides on the further action to be taken in the case; in this case, 5Decision of the Litigation Chamber 32/2020 of 16 June 2020, point 27; In this regard, see also Decision of the Litigation Chamber 87/2024 of 3 June 2024, points 74 to 87. Decision 98/2024 - 7/10 the Litigation Chamber decides to proceed with the classification without further action of the complaint, in accordance with Article 95, § 1, 3° of the LCA, for the reasons set out below. 42. In matters of classification without further action, the Litigation Chamber is required to justify its decision in stages and to: - pronounce a classification without technical further action if the file does not contain or insufficient evidence likely to lead to a sanction or if it contains a technical obstacle preventing it from rendering a decision; - or pronounce a dismissal of opportunity, if despite the presence of elements likely to lead to a sanction, the continuation of the examination of the file does not seem appropriate to it taking into account the priorities of the Data Protection Authority as specified and illustrated in the Disputes Division's Dismissal Policy. 43. In the event of dismissal based on several grounds for dismissal, these grounds (respectively, dismissal of technical action and dismissal of opportunity) must be treated in order of importance. 44. In this case, the Disputes Division decides to dismiss the case on grounds of opportunity. The decision of the Disputes Division is based more specifically on three reasons why it considers that it is inappropriate to continue monitoring the file, and consequently decides not to proceed, among other things, with an examination of the case on the merits. 45. More specifically, the decision of the Litigation Chamber is based on the fact that the remainder of the complaint is incidental to a broader dispute that needs to be argued before the judicial and administrative courts and tribunals or another competent authority and that the complaint is not sufficiently supported by evidence that would allow the Litigation Chamber to rule on the existence or not of a violation of the GDPR and that it does not result in a high societal and/or personal impact (criteria B. 3 and B. 5 of the dismissal policy). 46. The Litigation Chamber recalls that the law of 21 March 2007 regulating the installation and use of surveillance cameras (hereinafter: the law on cameras) designates the police as the body primarily competent to monitor the provisions of the law on 6Market Court (Brussels Court of Appeal), 2 September 2020, judgment 2020/AR/329, p. 18. 7 In this regard, the Litigation Chamber refers to its policy on dismissal as developed and published on the website of the Data Protection Authority: https://www.autoriteprotectiondonnees.be/publications/politique-de- classement-sans-suite-de-la-chambre-contentieuse.pdf. 8Cf. Title 3 – In which cases is my complaint likely to be dismissed by the Litigation Chamber? of the policy on dismissal of the Litigation Chamber. 9Laloidu21march2007regulatingtheinstallationanduseofsurveillancecameras,M.B.31may2007,asamendedbythelawof21march2018,M.B.16april2018,andtheroyaldecreeof8may2018relatingtodeclarationsofinstallationanduseofsurveillancecamerasandtheregisterofsurveillancecameraimageactivities,M.B.23may2018.Decision98/2024 - 8/10 cameras. Indeed, the installation of a surveillance camera must be notified to the local police. The local police are also empowered to take decisions under penal provisions sanctioning non-compliance with the law on cameras. In this case, it was precisely for this reason that the complainants contacted their local police, who actually went to the defendant’s home on 2 March 2023 (see point 8). Consequently, the Litigation Chamber wishes to avoid a double investigation, during which the police and the Litigation Chamber would act on the basis of the same facts. 47. The Litigation Chamber also notes that the complainants claim to have accessed images filmed by the defendant’s cameras. However, the complainants indicate that they are not satisfied with the images they accessed, given that the technical parameters of the cameras had been modified so that they did not film the images usually recorded. However, given that the complainants acknowledge that they do not have proof of the access granted to them, the Litigation Chamber is not in a position to determine whether the follow-up granted to their exercise of the right of access is satisfactory. 48. Given that the complaint is not sufficiently supported by evidence that would allow the Litigation Chamber to rule on whether or not there has been a violation of the GDPR, it examines the criteria of high general or personal impact, as defined by the DPA in its note on the policy on dismissal of 18 June 2021. The Litigation Chamber first examines whether the criteria of high general or personal impact, as defined by the DPA in their policy on dismissal of 18 June 2021, apply to the present case. Finally, if the criteria of high general or personal impact do not apply, the Litigation Chamber weighs the personal impact of the circumstances of the complaint on the fundamental rights and freedoms of the person concerned, and the effectiveness of the Litigation Chamber’s intervention. 49. After assessing the criteria of high general or personal impact, the Litigation Chamber concludes that none of the criteria apply to the present case. Consequently, the Litigation Chamber weighs the personal impact of the circumstances of the complaint on the fundamental rights and freedoms of the complainant against the effectiveness of its intervention to decide whether to deal with the complaint in depth. Without wishing to minimise the facts alleged by the complainants, the Litigation Chamber notes that, in addition to the elements referred to in points 40 to 42 of this decision, the alleged facts mainly concern the complainants only. Consequently, the Contentious Chamber does not consider it appropriate to launch an investigation through the Inspection Service to corroborate the complainant's allegations, and consequently decides not to proceed, among other things, with an examination of the case on the merits. Decision 98/2024 - 10/10 1034quinquies of the Judicial Code, or via the e-Deposit information system of the Ministry of Justice (Article 32ter of the Judicial Code). (sé). Hielke HIJMANS President of the Contentious Chamber 11The application, accompanied by its annex, is sent, in as many copies as there are parties involved, by registered letter to the court clerk or filed with the registry.
