HDPA (Greece) - 31/2020

HDPA - 31/20
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 4(1) GDPR Article 4(2) GDPR Article 5 GDPR Article 6 GDPR HDPA Directive 1/2011 HDPA Directive 115/2001
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	04.09.2020
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	31/20
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	Panayotis Yannakas

An employee had submitted a complaint to the Greek Data Protection Authority about the video surveillance in the store in which she had worked. The Greek DPA held that a CCTV system shall be handled as subject to Article 4(1) and Article 4(2) of GDPR Regulation. That judgment does not mean that any CCTV surveillance in workplaces and under any circumstances is forbidden; the Data Protection Officer seems to make an obiter dictum legal comment and not a ratio decidendi of that decision.

The Greek Office before finishing his judgment, goes through the principle of proportionality and finds that in these facts the merchant had not violated employees' rights when he installed the surveillance system.

English Summary

Facts

The complainer was working in one of the merchant's stores, where a CCTV system was installed and active. The employer repeatedly had assured (to the employees) not only that the field of view of the cameras was the cash registers, but also that the CCTV does not capture sound at all.

After the complainer beginning to believe that more cameras exist in the store and that these cameras are recording sound as well, she submitted the following complaint to the Greek DPA. She brought a court action with which she was claiming damages, as well. She claimed that some of the cameras were scoped to the WC room and the changing rooms.

During the hearing, the employer declined any allegation relevant that the CCTV surveillance system recording sound too. Furthermore, he disclaimed various points. He also submitted a detailed list of all the cameras with recording samples for each one and clarified all the ways he used to inform visitors and staff for the existence of that CCTV system, including notices signs and brochures, as well as the entire company's policy of the personal data protection in written form.

Holding

The Greek Data Protection Officer laid down four points of the GDPR. Firstly, with Article 4(1) the Decision Board of the Greek DPA Office considers that visual and sound data may be characterized as personal data when identifiable information relating to natural persons are included. Secondly, the interpretation of the processing term under Article 4(2) should include any video surveillance in indoors and outdoors areas which persons are invited to visit.

Thirdly using the article 5th the Greek DPA concludes that a genuine adoption of the concept of proportionality on such circumstance shall also examine (a) the lawfulness, fairness and transparency of the contested data processing; without underestimating aspects as (b) how further the processed goes in a manner that is incompatible with announced, specified, explicit and legitimate purposes or (c) minimizing the amount of data to what is absolutely necessary with those purposes .

Fourth, the Decision Board concluded that the contested CCTV system is straightforward compatible with the requirement of Article 6(f). That article describes that a data processing is lawful when it is strictly necessary for the purposes of the legitimate interests pursued by the controller, except where fundamental rights of the data subject override such interests.

The Greek DPA found that merchant collects collects only the strictly necessary data in order to increase the security level of the store and protect it against thieves.

Comment

The word content of the decision seems modest; it is not clear if the decision board rejected the complainer allegations relative to the sound recording and the cameras' field of view for reasons concerning the burden of proof, or the rejection was grounded on other reasons.

Back to 2011 the Greek DPA issued a national directive for the CCTV to workplaces, and that national directive was also a reference to that decision. Relative highlights of the Greek DPA's Directive 1/2011 is that the CCTV (i) shall be used as a supervising tool only when it is absolute necessary in terms of employees' safety (i.e. factories) or in strictly critical workplaces, like banks and military buildings. A regulated exemption is when (ii) the purpose of the camera is to protect cash registrars or when the camera field of view is limited to the entrance of an area. Last and not least, under the National Directive 1/2011, (iii) data for a CCTV shall not be use to monitoring employees effectiveness and performance.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.