VG Mainz - 1 K 584/19.MZ

VG Mainz - 1 K 584/19.MZ
Court:	VG Mainz (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 9(1) GDPR Article 58(2) GDPR § 20(5) BDSG
Decided:	24.09.2020
Published:
Parties:
National Case Number/Name:	1 K 584/19.MZ
European Case Law Identifier:	ECLI:DE:VGMAINZ:2020:0924.1K584.19.00
Appeal from:
Appeal to:
Original Language(s):	German German
Original Source:	landesrecht.rlp.de (in German) openjur.de (in German)
Initial Contributor:	Philipp

Even if it is possible that a camera records special categories of personal data the requirements of Art. 9 GDPR do not apply if the processor does not seek to process that kind of data. The legality is thus determined by Art. 6 GDPR. On the basis of Art. 58(2)(f) GDPR, the DPA was not entitled to order the removal of a CCTV camera but only the shutdown.

English Summary

Facts

The plaintiff owns a LED billboard on his private property next to a shopping mall. The billboard is monitored by four CCTV cameras to protect it against vandalism. The DPA (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz) ordered to remove camera 1 that filmed a public street and to shut down camera 2 during opening hours of the shopping mall because it filmed the parking lot. Cameras 3 and 4 had to be repositioned so they do not capture the public street, the parking lot and adjacent residential building.

Holding

The correct defendant is the DPA itself according to § 20(5)(2) and § 20(4) BDSG.

The Court held that even if it is possible that a camera records personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership the requirements of Art. 9 GDPR do not apply because the plaintiff did not seek to process that kind of data. The legality is thus determined by Art. 6 GDPR. In the absence of consent under Art. 6(1)(a) GDPR, a balance of interests according to Art. 6(1)(f) GDPR is required.

The legitimate interests pursued by the plaintiff (protection of his property) are overridden by the fundamental rights and freedoms of the data subjects who are filmed by camera 1 on a public street. The DPA was allowed to issue a reprimand, Art. 58(2)(b) GDPR. On the basis of Art. 58(2)(f) GDPR, the DPA was not entitled to order the removal of camera 1 but only the shutdown.

According to Art. 58(2)(d) GDPR the DPA was entitled to order the shutdown camera 2 during the opening hours of the shopping mall and to reposition cameras 3 and 4.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Tenor

Paragraph 2 of the decision of 23 November 2018 concerning the order to dismantle Camera 1 and paragraphs 4 and 9 of the decision of 23 November 2018 are annulled. The remainder of the action is dismissed.

The applicant is ordered to pay the costs.

The judgment is provisionally enforceable as regards costs.

Facts

The plaintiff objects to a warning under data protection law and further orders of the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate - LfDI - requiring him to partially discontinue or modify the camera surveillance of his advertising board.

The applicant is the owner of the property A. in B. The property is located at the access road to the federal road XXX in an industrial estate outside the town of B. The property includes a shopping centre (...), a car park and a large double-sided advertising board with LED display. The billboard had a purchase value of approx. 200,000 €. To protect his billboard, the plaintiff installed two static video cameras on each side (see Annexes 1 to 5 to the plaintiff's statement of 19 December 2018). Two cameras each essentially capture the billboard (cameras 3 and 4); the other cameras are directed at the area in front of the billboard, so that one of the cameras captures the car park and the adjacent shopping centre (camera 2) and the other camera captures the area where road A. joins federal road XXX (camera 1). All four cameras are in operation around the clock and capture their respective fields of vision in a resolution that is accurate to the number of the car number and the number of persons. The recordings are stored for 48 hours in a recording device located between the two billboards and are then automatically deleted. Only the plaintiff has access to the locked recording device and the recordings. Video surveillance is indicated by a pictogram in the car park.

Following various communications between the parties concerned and after the plaintiff had been heard on the measures envisaged by the defendant, the defendant, by decision of 23 November 2018 (served on 26 November 2018), ordered measures on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (basic data protection regulation) - DSGVO. With regard to Camera 1, the defendant issued a warning (point 1 of the decision) and asked the applicant to cease data processing by that camera and to dismantle it (point 2 of the decision) and to prove that it had been dismantled by producing a photograph (point 4 of the decision). According to point 3 of the decision, camera 2 is to be set so that it does not take any pictures during the opening hours of the shopping centre. This is to be proved by submitting a printout or a photograph of the corresponding settings (clause 5). Cameras 3 and 4 are to be aligned in such a way that the street, the car park and an adjacent residential building previously visible on them no longer fall within the camera's angle of coverage (Figure 6). This must also be verified by a screen printout (Figure 7). A deadline of 15 December 2018 was set for the implementation of the orders (paragraph 8); this deadline was extended to 4 January 2019 at the request of the plaintiff. In addition, periodic penalty payments of €1,000, €2,500 and €5,000 were threatened in the event of non-compliance with the orders (paragraph 9).

The applicant brought an action on 26 June 2019. The decision of 23 November 2018 is unlawful because the video surveillance on his billboard is lawful. It serves to safeguard his domestic rights and to protect his legitimate interests, since he wishes to protect his billboard from damage. He has a legitimate interest in protecting his property and in preventing unauthorised persons from entering his premises and in preventing or in any event being able to prosecute offences against his property. In the past, crimes have repeatedly been committed on the site, as was reported several times and also in 2020 in the food discounter .... and the ... (shopping centre), graffiti and hit-and-run cases had been committed and waste oil had been disposed of on the premises. It was to be expected that crimes would continue to be committed there in the future. Video surveillance was also necessary as the objective of deterring and identifying troublemakers and criminals could be achieved by this measure. The monitoring of the LED advertising installation was successful, as the installation had not been attacked or damaged so far. There is no other equally effective means which is less restrictive of the fundamental right of informational self-determination of the persons concerned. In principle, shopping centres are a potentially endangered area which should be monitored by camera as a typical danger point. In particular, the use of security personnel is not reasonable. A fence was also unsuitable because stones could be thrown over the fence onto the billboard. The cameras would have to cover the area in front of the boards, as the LED boards could be damaged by stones being thrown or drones being used. The junction area on the federal road XXX would have to be monitored for licence plate recognition and thus identification of perpetrators. Only a complete, unrestricted surveillance without time restrictions would be effective, as cases of hit-and-run driving had already occurred during the day and crimes could be prepared during the day. At the same time, only the interaction of all four cameras could ensure effective protection of billboards. Finally, when weighing up the interests involved, it must also be taken into account that video surveillance is omnipresent today and that the recordings in question are only viewed when an incident has occurred; moreover, the recordings are automatically deleted if not viewed. The order to dismantle camera 1 is unlawful because even one switch-off is sufficient to prevent further data processing. It was not possible to take action against a camera which had been switched off on the basis of the Basic Data Protection Regulation. The warning with regard to camera 1 is unlawful because it was issued at the same time as the order to stop operation of the camera and to dismantle it. It is only when a warning has been disregarded that it can be followed up with a more severe remedy. Furthermore, there was no hearing in respect of the warning.

The applicant claims that the Court should

set aside the orders or measures prescribed in points 1 to 7 of the defendant's decision of 23 November 2018 and the threats of coercive measures prescribed in point 9 of that decision

The defendant claims that the Court should

dismiss the action.

The data processing carried out by the plaintiff infringes Article 6(1), first subparagraph, letter (f) of the DSGVO. The warning and the order to dismantle Camera 1 are lawful. The legal basis for the warning is Article 58(2)(b) of the DSGVO. The camera covers public traffic areas, namely Federal road XXX and road A., as well as the adjacent cycle and pedestrian path and a railway line. The surveillance of public road traffic is a task of the State and does not have to be carried out by the applicant. Furthermore, it affects the rights of road users to a considerable extent and is unlawful without reference to specific criminal conduct. Nor can the threat scenario drawn up by the applicant, which is not sufficiently substantiated, be effectively countered by video surveillance. In any event, the rights of the persons concerned prevail: A large number of passers-by are filmed, although they do not enter the car park and, moreover, behave in an unobjectionable manner. The warning had to be issued because Camera 1 was manifestly illegal and therefore had to be sanctioned in the interests of effective enforcement. Furthermore, since a significant number of unlawful processing operations took place, it was necessary to order the cessation and dismantling of video camera 1. Furthermore, it should be noted that if camera 1 were merely switched off, it would then generate an impermissible surveillance pressure as a de facto dummy. Furthermore, only by removing the camera could it be ensured that the impermissible video surveillance would not be resumed. As regards camera 2, the recording times had to be limited to the period outside the opening hours of the adjacent retail outlets. It is true that the criminal incidents reported by the plaintiff were not sufficiently serious, frequent and substantiated on the premises. However, surveillance of the car park outside opening hours could still be regarded as proportionate. In this respect, it must also be taken into account that a large number of people, including children, are present on the car park during opening hours and that their fundamental rights and freedoms outweigh the interests of the plaintiff as the person responsible. Cameras 3 and 4 would have to be positioned in such a way that they would only cover the billboard, since, according to the plaintiff, these cameras only served to monitor the LED billboard. In order to fulfil that purpose, it is not necessary to monitor parts of the public traffic area and an adjacent residential building and the car park. The requests for information on the fulfilment of the ordered measures were necessary, according to Article 58(1)(a) of the DSGVO, in order to ensure control of future data processing.

By order of 24 June 2019, the proceedings were transferred from the Administrative Court of Koblenz to the Administrative Court of Mainz.

For further details of the facts of the case and the dispute, reference is made to the defendant's court file (2 volumes) and administrative file (1 booklet), which were before the Chamber and were the subject of the hearing.

Reasons

The admissible (I.) action is successful on the merits only to the extent shown by the operative part (II.)

I. The action is admissible.

Pursuant to § 42 (1) Var. 1 of the Administrative Court Rules - VwGO - an action for rescission is admissible, since the contested warning is an administrative act - at least a declaratory one - within the meaning of § 35 sentence 1 of the Administrative Procedure Act - VwVfG - in conjunction with § 35 sentence 1 of the Administrative Procedure Act - VwVfG. § Paragraph 1 of the Landesverwaltungsverfahrensgesetz - LVwVfG. Finally, the warning states that the addressee has infringed Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (Basic Data Protection Regulation) - DSGVO. It is true that the warning does not create a specific, direct legal obligation. However, it does implicitly state that the addressee should act in conformity with data protection rules in the future. Furthermore, the warning is a remedial measure by the data protection authority, which punishes a - albeit regularly rather minor - breach of data protection (see Körffer, in: Paal/Pauly, DS-GVO/BDSG, 2nd edition 2018, Art. 58, marginal 18; Selmayr, in: Ehmann/Selmayr, 2nd edition 2018, Basic Data Protection Regulation, Art. 58, marginal 20). The other orders imposing certain duties on the plaintiff to act are also administrative acts.

The plaintiff is the addressee of incriminating administrative acts and is therefore entitled to bring an action within the meaning of Paragraph 42(2) of the VwGO.

Preliminary proceedings were dispensable under Section 68 (1) sentence 2 no. 1 VwGO and Section 20 (6) of the Federal Data Protection Act - BDSG.

The one-month deadline of § 74 (1) sentence 1 VwGO was complied with.

The correct defendant is, according to § 20 paragraph 5 No. 2 BDSG, the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate - LfDI -. Pursuant to § 20 (4) BDSG, the LfDI is entitled to participate in disputes between a natural person or legal entity and a federal or state supervisory authority concerning rights under Art. 78 (1) and (2) DSGVO and § 61 BDSG. Pursuant to Section 1 (1) sentence 2 of the BDSG, the Federal Data Protection Act is also applicable in this case, since the plaintiff processes the personal data of third parties and is a non-public body. Although the plaintiff had initially cited the Land of Rhineland-Palatinate as the defendant in the action, it was established beyond doubt by interpretation that the plaintiff intended to bring the action against the LfDI, which issued the contested decision. Applying mutatis mutandis the second half of Paragraph 78(1)(1) of the VwGO, it follows that the incorrect designation of the defendant is irrelevant if it is possible to identify against whom the action should correctly be directed. This is the case, for example, if - as here - the action is initially directed against the legal entity, even if (exceptionally) the authority is the defendant (cf. OVG NRW, judgment of 13 March 1991 - 22 A 871/90 -, juris, marginal nos. 5 et seq.; Kintz, in: BeckOK VwGO, 54th Ed. 1 July 2020, § 78, marginal no. 43). The Chamber has therefore amended the rubric ex officio to state that the defendant is the LfDI. The parties, who were informed of this at the hearing on 24 September 2020, did not object to the change of heading.

The Administrative Court of Mainz is, in accordance with § 20 (1) and (3) BDSG - in conjunction with Art. 78 para. 1 DSGVO, the Administrative Court of Mainz has local jurisdiction. In addition, the Administrative Court of Mainz is bound by the referral order of the Administrative Court of Koblenz dated 24 June 2019 pursuant to Article 83 sentence 1 VwGO in conjunction with § Section 17a (2) sentence 3 GVG.

II The action is only partially successful on the merits. The orders challenged by the plaintiff under items 1, 3, 5, 6 and 7 of the defendant's decision of 23 November 2018 are lawful and do not infringe the plaintiff's rights (§ 113.1 sentence 1 VwGO). However, the orders under items 4 and 9 and, in part, the order under item 2 of the defendant's decision are unlawful and infringe the plaintiff's rights, so that they had to be revoked.

1. the warning issued in respect of Camera 1 (point 1 of the decision of 23 November 2018) is lawful Camera 1 films the area where road "A." joins the federal road XXX as well as a bicycle path, a footpath and a railway line.

The basis for issuing a warning is Article 58 paragraph 2 letter b DSGVO. This allows the supervisory authority to issue a warning to a controller or a processor if he has infringed the basic data protection regulation by processing operations. The fact that the defendant cited Article 58 (1) (b) DSGVO as the legal basis in its ruling is obviously due to an editorial oversight. In the course of the proceedings, the defendant made it clear that the warning should be based on Article 58(2)(b) DSGVO.

The present warning is formally lawful; in particular, the defendant LfDI was responsible for issuing the order pursuant to Art. 51 (1), 55 (1) DSGVO, Art. 40 (1) BDSG, Art. 15 (2) LDSG. If a hearing error could be identified in the fact that the plaintiff was not made aware of the possible pronouncement of a warning at the hearing on 10 August 2018 - but only measures pursuant to Article 58 (2) (d) DSGVO were announced - this error would in any case have been remedied pursuant to Article 45 (1) no. 3 VwVfG by the fact that the hearing was made up for. Finally, in the course of the legal proceedings, the defendant dealt intensively with the plaintiff's arguments and, in particular, commented on the content of the plaintiff's submissions regarding the warning.

Whether a data processing infringes the basic data protection regulation depends on Art. 5 ff. DSGVO. Under Article 5(1)(a) DSGVO, personal data must be processed in a lawful manner. The warning is also materially lawful, as the surveillance by camera 1 was carried out unlawfully in this case. Video surveillance constitutes data processing (a), in which personal data are also processed (b). Even though the Chamber is of the opinion that the processed data is not particularly sensitive data and thus there is no processing prohibition under Art. 9 DSGVO in the present case (c), video surveillance by camera 1 violates the Basic Data Protection Regulation, as it is not justified under Art. 6 DSGVO (d).

(a) The plaintiff is a data processor by using his camera to make video recordings of third parties. Camera surveillance is the processing of data within the meaning of Article 4 No. 2 of the DSGVO. Accordingly, data processing is any operation carried out with or without the aid of automated procedures in connection with personal data. The term processing covers all handling of personal data (see BVerwG, judgement of 27 March 2019 - 6 C 2/18 -, juris, marginal 43; SaarlOVG, judgement of 14 December 2017 - 2 A 662/17 - juris, marginal 38; Schild, in: BeckOK Datenschutzrecht, 33 Ed. 1 August 2020, DS-GVO, Art. 4, marginal 34).

b) Personal data are also processed in the case of camera surveillance. The image of a person recorded by a camera falls under the term "personal data" if it enables the identification of the person concerned (cf. BVerwG, judgement of 27 March 2019 loc. cit, juris, marginal 43; SaarlOVG, judgement of 14 December 2017 loc. cit., juris, marginal 38; OVG Nds, judgement of 29 September 2014 - 11 LC 114/13 - juris, marginal 28 f.; Schild, in: BeckOK Datenschutzrecht, 33 Ed. 1 August 2020, DS-GVO, Art. 4, marginal 14b). The camera used here captures persons and vehicles in licence plate and person-specific resolution.

c) The increased requirements imposed by Art. 9 DSGVO on the processing of special categories of personal data did not have to be complied with in the present case. According to Art. 9 para. 1 DSGVO, the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data uniquely identifying a natural person, health data or data concerning the sexual life or sexual orientation of a natural person is in principle prohibited.

It is true that it is generally possible that special categories of personal data may be recorded if the camera shots are person-specific. After all, the external appearance of the persons filmed may possibly reveal their racial and ethnic origin (skin colour, hair), their political opinion (e.g. "Palestinian scarf"), their religious or ideological conviction (e.g. religious items of clothing such as headscarves or kippas), health data (e.g. glasses, wheelchair) or sexual orientation (e.g. homosexual couple).

However, the plaintiff is not interested in collecting precisely these personal data of special categories. The plaintiff's intention with video surveillance is to prevent and prosecute crimes. During surveillance, he receives a mixed data set of particularly sensitive and non-sensitive data, whereby he has no intention of evaluating the sensitive data. In the absence of such an evaluation intention, there are no particular risks for the data subjects, so that the scope of application of Art. 9(1) DSGVO is not opened up (cf. Schulz, in: Gola, DS-GVO, 2nd ed. 2018, DS-GVO, Art. 9, marginal no. 13; Schneider/Schindler, Video surveillance as processing of special categories of personal data, ZD 2018, 463, beck-online).

d) However, video surveillance by camera 1 is illegal under Art. 6 DSGVO. According to this provision, data processing is only lawful if at least one of the conditions set out in Art. 6 (1), first subparagraph, letters a to f DSGVO is fulfilled. In this case, however, there is neither consent of the data subjects within the meaning of Article 6 (1), first subparagraph, letter a, DSGVO (aa) nor was video surveillance carried out in accordance with Article 6 (1), first subparagraph, letter f, DSGVO in the overriding interest of the plaintiff or a third party (bb).

(aa) A data processing operation is lawful under Article 6(1), first subparagraph, first sentence, point (a), of the DPA if the data subject has given his consent to the processing of personal data relating to him for one or more specific purposes. According to the legal definition in Art. 4 No. 11 FADP, consent is any freely given, informed and unequivocal expression of will in the specific case, in the form of a declaration or any other unequivocal affirmative act by which the data subject indicates his or her consent to the processing of personal data relating to him or her.

The persons concerned by video surveillance have not given their consent, either in writing or orally, to the processing of their data, if they have even taken note of the fact that camera surveillance is taking place. An (implied) declaration of intent is also not recognisable by reading the sign (pictogram) on the advertising board. Even in the case of clearly visible signs, it cannot be assumed that the persons concerned have consented to surveillance when they enter the monitored area (see BVerwG, judgment of 27 March 2019 loc. cit., juris, marginal no. 23; BVerfG, Statutory Chamber Order of 23 February 2007 - 1 BvR 2368/06 -, juris, marginal no. 40). In addition, those affected may lack the necessary ability to consent, for example children up to the age of 14 (cf. OVG Nds, judgment of 29 September 2014, loc. cit., juris, marginal no. 33).

(bb) Nor is video surveillance justified under Article 6(1), first subparagraph, point (f) of the DSGVO. According to that provision, data processing is lawful if it is necessary in order to safeguard the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh those of the controller, in particular where the data subject is a child. In a two-stage examination programme, the necessity of the data processing must first be established (1) and then the interests of the data controller or of a third party must be weighed against the data subject's right to informational self-determination (2).

(1) The camera surveillance arranged here by the plaintiff is already not necessary if it is in operation and takes pictures during the opening hours of the shopping centre.

Data processing is necessary if the person responsible needs it in order to safeguard legitimate interests, i.e. interests that are worthy of protection and objectively justifiable. According to Recital 47 to the Basic Data Protection Regulation, one of the relevant factors here is whether data processing is absolutely necessary for the prevention of criminal offences, whether it is foreseeable, i.e. customary in the industry, or whether the data subjects must reasonably expect their data to be processed in the specific situation (cf. BVerwG, judgment of 27 March 2019 loc. cit.)

It is up to the person responsible to explain the reasons for which he considers video surveillance of his rooms to be necessary. On the basis of this information, it must be assessed whether and to what extent the measure is necessary. The authorities and courts must, in the context of their duty to clarify the facts, endeavour to ensure that the person responsible explains or supplements the reasons given. According to the generally accepted understanding of the term, necessity is to be assumed if a reason, such as a hazardous situation, is sufficiently substantiated by facts or general life experience and cannot be taken into account just as well by another equally effective but more gentle measure. More gentle than video surveillance are in particular measures that do not affect the informational self-determination rights of visitors to publicly accessible rooms (cf. BVerwG, judgement of 27 March 2019 loc. cit., juris, marginal 26; SaarlOVG, judgement of 14 December 2017 loc. cit., juris, marginal 46).

It is therefore in principle a legitimate interest of the person responsible to use camera surveillance for the prevention and investigation of criminal offences. However, such a surveillance measure is only necessary if there is a risk situation that goes beyond the general life risk. Such a threat can only arise from actual findings; subjective fears or a feeling of insecurity are not sufficient (cf. BVerwG, judgement of 27 March 2019 loc. cit., juris, marginal no. 28; SaarlOVG, judgement of 14 December 2017 loc. cit;)

Applying the legal standard described above, a particular risk situation for the billboard, the protection of which the plaintiff seeks to protect by means of video surveillance, is to be recognised in the present case only outside the opening hours of the shopping centre. Moreover, there is no evidence of a particular risk situation which must relate to the object to be protected - in this case: the billboards - in order to justify its video surveillance.

When assessing whether there is a particular risk situation for the advertising installation, it must first be taken into account that the installation has not been damaged by third parties to date. The advertising installation at issue is protected against vandalism to an above-average extent by its height and the closed access to the operating space between the two advertising boards, since neither the boards nor the operating space are accessible to third parties. The plaintiff himself therefore assumes that damage to the advertising installation could occur solely from the outside or from the ground - for example, by throwing objects or using drones. Nor has the plaintiff convincingly argued that advertising installations are generally exposed to an increased risk of damage to property. To the extent that he states that he has become aware of incidents in which advertising installations were fired upon, no generally increased risk of damage to advertising installations can be inferred from these incidents - which, incidentally, have not been further substantiated or substantiated. It cannot be assumed with sufficient certainty whether the surveillance cameras installed by the plaintiff on the advertising installation have such a deterrent effect that potential perpetrators refrain from causing damage to property and that this is the only reason why the particular risk of danger has not materialised to date. Finally, the adjacent shopping centre is also monitored by camera 2 and - as the plaintiff stated in the oral hearing - other cameras at the shopping centre and burglary offences have nevertheless been committed.

If the plaintiff further submits - albeit unsubstantiated and without corresponding evidence - that there have already been several cases of hit and run on the car park, this does not constitute a circumstance that would justify a particular risk situation either, but rather a general risk to life. Also his fear that trucks could graze and damage the advertising panel only constitutes a general risk, but not a special danger situation justifying video surveillance. Moreover, the photograph submitted by the plaintiff in Annex 2 to his pleadings of 19 December 2018 shows that there are large stones underneath the advertising installation at the edge of or at the transition to road "A.", which should prevent trucks from driving over the kerbstone and grazing the advertising panel. In so far as no corresponding "bollards" have yet been installed at the edge of Federal Highway XXX, there is no apparent reason why such protection could not be used here as well, protecting the advertising board and at the same time making video surveillance unnecessary.

However, the Board recognises that, in view of the particular circumstances of the present individual case, the threat to the environment has at least a partial effect on the vulnerability of the advertising installation. It is open to question whether shopping centres - possibly also in their vicinity - can generally be assumed to be particularly vulnerable, as the plaintiff apparently believes. Finally, in the present case, criminal offences have actually been committed in the area of the shopping centre. The plaintiff has reported various criminal incidents in the vicinity of the advertising complex: There had been break-ins, graffiti and offensive graffiti in the area of the shopping centre and at a neighbouring warehouse, which he partly proved by submitting relevant photographs, but which, moreover, was not substantiated by the defendant. Although it can be assumed in principle that theft offences promise a certain direct benefit from the perspective of the perpetrator (stolen goods) and that wall graffiti with spray paints is, on the one hand, associated with an expression of opinion and, on the other hand, can in principle be committed very easily and quickly and without a particularly high risk of discovery, it cannot simply be assumed that the same groups of perpetrators would also damage the plaintiff's advertising plant. However, the plaintiff has explained in a credible and comprehensible manner that he is a well-known businessman in B. and that the offences committed are at least partly connected with an attack on his person. In that regard, he refers in particular to graffiti on a neighbouring warehouse, with which he was personally insulted and threatened, and of which he submitted photographs to the file. He therefore had to fear that he might be harmed, with the result that his property was endangered and he was justified in protecting it. On account of the various offences committed in the vicinity of the advertising installation on the plaintiff's property, some of which constituted a direct attack on the plaintiff's person, the plaintiff's understandable concern about damage, even to his high-priced advertising installation, is in principle not only a subjective fear, but a particular risk situation can be inferred from actual findings.

However, the Chamber considers that the applicant's advertising installation is particularly vulnerable only outside the opening hours of the shopping centre. In this respect, it must be taken into account to a large extent that the installation is located in an exposed position on the - as the parties concerned have stated - busy Bundesstrasse XXX and on the access road to the industrial estate directly next to the car park of the shopping centre. It must therefore be assumed that damage to the advertising board - the protection of which the plaintiff is concerned about with the video surveillance - is not likely during the opening hours of the shopping centre, because during this time some through traffic and customers of the shopping centre parking and packing goods can be expected. Possible perpetrators who wanted to damage the advertising installation would run a high risk of detection during the opening hours.

Video surveillance is also fundamentally suitable for fulfilling the purpose of surveillance - here: the protection of the plaintiff's property. After all, it is general life experience that the higher the risk of being discovered and held responsible, the lower the probability of such acts being committed. However, this risk has become greater after the installation of video cameras from the perspective of potential perpetrators, as they cannot know when they are detected by the camera and cannot rule out being observed on screen by an employee of the plaintiff when committing possible infringements (cf. SaarlOVG, judgement of 14 December 2017 loc. cit., juris, para. 46). It is also possible for the camera to take pictures of a possible offence so that the offender in particular can be identified and criminal prosecution can be facilitated. The Chamber is convinced, however, that video surveillance is not suitable for possible threats to the cameras by drones, as these can easily be controlled from areas that lie outside the camera's angle of detection.

In the Board's view, the applicant cannot be referred to milder means, that is to say, measures which are equally effective in protecting billboards but which affect fewer rights of third parties. The plaintiff has stated that the insurance of the advertising installation at issue would cost € 10,000 per annum, which, in the opinion of the Board, is not economically reasonable for the plaintiff. The use of security guards would also be associated with high, unreasonable costs (cf. SaarlOVG, judgment of 14 December 2017 loc. cit., juris, para. 47; OVG Nds, judgment of 29 September 2014 loc. cit., juris, para. 57). As the billboard is located directly at the road, an enclosure of the site would not promise sufficient protection either, as objects could also be thrown onto the site from outside the fence. Physical protection, such as a Plexiglas panel in front of the billboard, is also out of the question, since according to the - comprehensible - information provided by the plaintiff, the billboard heats up during operation and the heat must be dissipated. In addition, drivers could be dazzled by sun reflections or the display of the advertisement could be disturbed.

(2) However, the interests worthy of protection of the persons affected by video surveillance with camera 1 outweigh the interests of the plaintiff in protecting his property.

The balancing of interests is carried out according to the situation and context. The intensity of the encroachment on fundamental rights resulting from the monitoring must not be disproportionate to the weight of the reasons justifying it. The weight of the interference is determined to a large extent by the nature and scope of the information collected, the reason and circumstances of the collection, the group of persons concerned, the existence of possibilities for evasion and the nature and scope of the use of the data collected. When weighing up the matter, all the (basic) legal positions in question must be taken into account and a balance must be struck that is as gentle as possible. These are those defined by Article 2 (1) of the Basic Law in conjunction with These are the right of the persons recorded by the cameras to informational self-determination and protection of their personal data, which is protected by Article 1 (1) of the Basic Law, while the plaintiff can primarily invoke his right of ownership under Article 14 (1) of the Basic Law, which would be impaired by damage to his advertising installation and which he would like to protect preventively by the surveillance measure and, in the event of damage to property, to reveal the person responsible (cf. SaarlOVG, judgement of 14 December 2017 loc. cit, juris, marginal 48 et seq.; OVG Nds, judgement of 29 September 2014 loc. cit., juris, marginal 63).

In the present case, the fact that the cameras record statically and do not have a zoom or panning option must be taken into account in the weighing of interests in favour of the plaintiff. Moreover, according to the plaintiff, the video recordings are viewed solely in the event of damage and only by the plaintiff and are automatically deleted after 48 hours. Furthermore, the traffic areas monitored by camera 1 are not intended to be used for longer periods of time and, in particular, there is no insight into highly personal areas of intimacy or privacy.

However, the interests of the persons concerned by the surveillance outweigh these. Finally, the targeted, clandestine surveillance of persons who are on public roads, paths or squares is in principle not permitted. It is the public task of the road traffic authorities and the police to ensure road traffic in conformity with the law and to prosecute administrative offences and criminal offences (cf. VG Göttingen, judgement of 31 May 2017 - 1 A 170/16 -, juris, marginal nos. 46 f.; LG München I, judgement of 21 October 2011 - 20 O 19879/10 -, juris, marginal no. 26). In this case, the surveillance of the traffic areas by camera 1, which is accurate with regard to persons and number plates, is carried out regularly and without any reason and is not easily recognisable for the persons concerned - mainly motorists - when driving past. The surveillance thus affects a large number of predominantly uninvolved persons who obviously do not want to impair the plaintiff's property (cf. Federal Supreme Court, ruling of 15 May 2018 - VI ZR 233/17 -, juris, marginal no. 26). In particular, the pictogram referring to the video surveillance cannot be perceived by passers-by. However, clandestine surveillance measures interfere with the rights of the persons concerned in a particularly serious way (cf. OVG Nds, judgement of 29 September 2014 loc. cit., juris, marginal no. 64). This is also an important difference to camera 2 (see below), which essentially films the car park: On the one hand, the video surveillance is more easily recognisable for people who are in the car park than for passing motorists. On the other hand, people who are on the car park area outside the opening hours of the shopping centre - and only during this time, according to the Chamber's conviction, is there any particular danger situation at all which makes video surveillance necessary - are more likely to be "suspected" of committing a criminal offence than people who are driving on the main road or access road and pass the billboard by chance.

(e) The warning therefore does not raise any serious concerns on the legal consequences side either. The defendant has issued the warning in a manner free of discretionary errors. Pursuant to Art. 58 para. 2 DSGVO, the supervisory authority has a discretionary power of decision and selection with regard to the exercise of its supervisory powers.

The defendant took the view, in an unobjectionable manner, that he was entitled to issue a warning on account of the infringement of the basic regulation on data protection which he had established. The supervisory authority may, pursuant to Art. 58 para. 2 DSGVO, make use of a remedial power if it has established a violation of data protection provisions or at least expects such a violation. If such a case exists, the authority is granted discretionary powers on the legal consequences side. In exercising this discretion, it must in particular observe the principle of proportionality (cf. VGH BW, decision of 22 January 2020 - VGH 1 S 3001/19 -, BA p. 18 with further references). If violations are identified, the supervisory authority is generally required to take action to remedy the violation (cf. Federal Constitutional Court of BW, decision of 22 January 2020 loc. cit., BA p. 15 m.w.n.). With regard to the scope of the resolution, an intentional discretion must therefore be assumed if the supervisory authority - as in this case - has established a violation of law (cf. Mundil, in: BeckOK Datenschutzrecht, 33 Ed. 1 February 2020, DSGVO Art. 77, marginal no. 15; assuming a reduction of discretion to zero, VG Ansbach, judgement of 8 August 2019 - AN 14 K 19.00272 -, juris, marginal no. 46).

There is also no evidence of any error in the exercise of the discretionary power of selection. When selecting the appropriate remedial measure under Article 58 para. 2 DSGVO, the supervisory authority must observe the principle of proportionality and in this respect also take the intensity of intervention into account (cf. VGH BW, decision of 22 January 2020 - VGH 1 S 3001/19 - BA p. 18 with further details). The warning issued by the defendant here is a rather "mild" remedy and can be applied even in the event of a first data protection breach (cf. Selmayr, in: Ehmann/Selmayr, DSGVO, 2nd ed. 2018, DS-GVO Art. 58, marginal no. 18; 20).

The warning could also be issued in addition to another order. In the present case, the defendant not only warned the plaintiff pursuant to Article 58(2)(b) of the DSGVO, but also ordered, pursuant to Article 58(2)(d) of the DSGVO, that the operation of camera 1 be stopped and the camera dismantled (point 2 of the decision). Contrary to the opinion of the plaintiff, it cannot be assumed that there is a graduated system of - differently far-reaching - remedial powers in the sense that after a warning, it would first have to be waited to see whether the person responsible would act in conformity with data protection in future in order to order further measures - for example on the basis of Article 58 (2) (d) DSGVO. Rather, the warning constitutes a sanction by means of which unlawful conduct in the past is subsequently established. As the "little sister of the fine", a warning is generally considered to be appropriate if the infringement of data protection regulations is rather simple and the threshold for the imposition of a fine has not yet been exceeded (cf. Selmayr, in: Ehmann/Selmayr, DSGVO, 2nd ed. 2018, DS-GVO Art. 58, marginal no. 20). Accordingly, recital 148 explains that in the case of a minor infringement or if a fine to be imposed would impose a disproportionate burden, a warning may be issued instead of a fine. It follows from this that a warning and a fine may be imposed only as alternatives. A warning may therefore be a preliminary step to a fine. However, since measures under Article 58(2)(d) of the DSGVO, such as the adjustment and dismantling of the camera ordered here, are intended to eliminate an existing unlawful situation for the future and thus serve the purpose of security, they may also be ordered cumulatively to form a warning.

2) The order under point 2 of the decision of 23 November 2018 is partly unlawful (a)). Therefore, the order in paragraph 4 of the decision is also unlawful (b)).

(a) The cessation of data processing by camera 1 ordered under point 2 of the decision is lawful (aa)). By contrast, the order to dismantle Camera 1 is unlawful and infringes the rights of the plaintiff (§ 113 (1) sentence 1 of the German Rules of the Administrative Courts (VwGO) (bb)).

Article 58 paragraph 2 letter f of the DSGVO is to be used as the basis for authorising these orders. In so far as the defendant referred to Article 58(1)(f) of the DPA as the legal basis in the notice, this was clearly an editorial error which the defendant corrected in the course of the proceedings (see above with regard to the legal basis for the warning). Under Article 58(2)(f) of the DPA, the supervisory authority may impose a temporary or definitive restriction on processing, including a ban.

aa) Since video surveillance by camera 1 constitutes unlawful data processing (see above), the defendant was able to order the cessation of data processing by camera 1 on the basis of Article 58(2)(f) DSGVO. This will ensure that no more illegal data processing is carried out in future. In this respect, no error of discretion is apparent; in particular, this order could be ordered in addition to a warning (see above). There is also no milder, equally effective measure apparent, since even a realignment of camera 1 at its current position is hardly possible without continuing to monitor a large number of uninvolved drivers.

bb) However, the defendant's instruction that camera 1 must be removed is unlawful. In this respect, there is already a lack of a basis for authorisation. Article 58 paragraph 2 letter f) DSGVO allows the supervisory authority to restrict or even prohibit data processing temporarily or permanently. However, this legal basis does not include the order to dismantle the processing plant. The prohibition of data processing relates to a specific act, but not to the presence of a - switched off - data processing system (cf. also on the earlier legal situation, VG Oldenburg, judgement of 12 March 2013 - 1 A 3850/12 -, juris, marginal no. 21 f.; Selmayr, in: Ehmann/Selmayr, DSGVO, 2nd ed. 2018, Art. 58, marginal no. 20).

Admittedly, it is understandable to the Board that without dismantling camera 1, the defendant can only check to a limited extent whether the camera is actually switched off, which may cause difficulties for effective enforcement. In this respect, however, it is the task of the (German) legislator to endow the supervisory authority with additional powers under Article 58 (6) sentence 1 DSGVO by means of legislation (cf. Selmayr, in: Ehmann/Selmayr, DSGVO, 2nd ed. 2018, Article 58, marginal no. 20).

Irrespective of this, no personal data are processed by a switched-off camera, so that the scope of application of the basic data protection regulation is not opened up and no complaints can be made about violations of data protection law. If an existing but switched off camera causes surveillance pressure on third parties, they must be referred to civil law to protect their personal rights (cf. VG Oldenburg, judgement of 12 March 2013 - 1 A 3850/12 -, juris, marginal no. 24 f.).

b) Thus, the order under item 4 of the decision of 23 November 2018, by which the plaintiff is to prove the dismantling of camera 1, is also unlawful.

The basis for this instruction is Article 58 (1) (a) DSGVO. According to this provision, each supervisory authority has all investigative powers enabling it to instruct the person responsible, the processor and, if applicable, the representative of the person responsible or the processor to provide all information required for the performance of its duties. However, since the order for dismantling (point 2 of the decision) is unlawful, the - in addition ancillary - order to provide proof of dismantling is also unlawful.

3) The order of the defendant in paragraph 3 of the decision of 23 November 2018, according to which the plaintiff must limit data processing by camera 2 to the period outside the opening hours of the adjacent retail establishments, is lawful (a)). The Board also considers that there are no concerns (b)) regarding the order in paragraph 5 of the decision of 23 November 2018, which is intended to prove the limited recording times to the defendant. Camera 2 captures a part of the car park and the exterior façade of ....

a) The order that camera 2 be operated only outside the opening hours of the adjacent shopping centre (point 3 of the decision) is lawful.

The order may be assigned to the power to take remedial action under Art. 58 para. 2 letter d DSGVO. Accordingly, the supervisory authority may instruct the controller to bring processing operations into conformity with the Ordinance in a specific manner and within a specific period of time. This power should in principle cover any breach of the basic data protection regulation, i.e. any processing of personal data contrary to EU law (cf. BVerwG, judgement of 27 March 2019 loc.cit., juris, marginal no. 42 with further references).

Video surveillance by camera 2 constitutes unlawful data processing insofar as it takes pictures during the opening hours of the adjacent retail businesses. To that extent, it does not constitute lawful data processing within the meaning of Article 6(1), first subparagraph, letter (f) of the DSGVO. Video surveillance by camera 2 is not required during the opening hours of these shops. During that period, there is no need to recognise a particular risk to the billboard which the applicant seeks to protect by means of video surveillance. In this respect, the above comments on camera 1 regarding the risk situation for the advertising boards apply accordingly. Moreover, during the opening hours of the shopping centre, the interests worthy of protection of the persons affected by the video surveillance with camera 2 outweigh the plaintiff's interest in the protection of his property. In this respect, it must be noted that a large number of very predominantly uninvolved persons who do not wish to impair the plaintiff's property are affected.

Insofar as a special danger situation for the advertising boards outside the opening hours is to be recognised, however, the interests of the plaintiff in protecting his property outweigh this, so that camera surveillance is then to be regarded as lawful. In the case of persons who are on the car park premises outside the opening hours of the shopping centre, legitimate interests, such as the completion of purchases, are not obviously recognisable. There are therefore no compelling reasons, which outweigh the protection of the plaintiff's property, to stay on the plaintiff's premises during this time. At the same time, someone who is on the car park outside business hours - and thus mainly during night hours - is more likely to commit crimes than someone who uses the car park during opening hours.

Discretionary errors are not evident. In particular, the defendant has complied with the principle of proportionality by limiting the time of camera surveillance to take account of the fact that a particular risk situation can only be recognised here outside the opening hours of retail establishments.

b) The order under point 5 of the decision of 23 November 2018, according to which the applicant must provide evidence of the limited periods of admission, is lawful.

On the basis of Art. 58 (1) (a) DSGVO, the supervisory authority may, in order to effectively control its - lawful (see above) - basic decision (item 3 of the notice), demand that the plaintiff provide evidence of the limited operating and recording times of camera 2.

4. the orders relating to cameras 3 and 4 to realign them (point 6 of the decision of 23 November 2018) (a)) and to prove this to the defendant (point 7 of the decision) (b)) are lawful Camera 3 essentially captures the billboard and a small section of Federal Highway XXX, the railway line and a residential building. Camera 4 mainly films the other side of the billboard and a small section of the car park.

(a) The order under point 6, according to which cameras 3 and 4 are to be aligned in such a way that the road, the car park and the residential building, which were previously partially filmed, no longer fall within the angle of coverage of the video cameras, is lawful.

The order to align the camera in such a way that it no longer covers the street, the car park and the residential building can be assigned to the power of remedy under Article 58(2)(d) DSGVO (cf. BVerwG, judgement of 27 March 2019 loc. cit., juris, marginal no. 42).

Illegal data processing exists if the angle of coverage of cameras 3 and 4 does not only cover the billboard. If only the billboard is filmed, no personal data is processed, so that data processing is unproblematic in terms of data protection. If, however, the street, the car park and the residential building are captured at the edge of the image section of the two cameras, personal data can be processed. This data processing is not justified under Art. 6 (1) subparagraph 1 letter f DSGVO.

In this respect too, the need for video surveillance to protect the plaintiff's ownership of the billboard is already lacking. A special situation of danger can also be assumed here, at best outside the opening hours of the shopping centre. Furthermore, in view of the only very small picture section with which personal data can be recorded, it is doubtful to what extent the camera recordings are at all suitable to serve the protection of the plaintiff's advertising installation as intended by the plaintiff. Above all, however, the plaintiff himself declared at the hearing that he did not wish to record these peripheral areas with his camera surveillance at all. It was only for technical reasons that the two cameras could not be directed solely at the advertising boards. The plaintiff therefore does not intend to use cameras 3 and 4 either to process personal data or to protect his advertising installation. He therefore does not himself consider video surveillance by cameras 3 and 4 to be necessary to protect his advertising installations.

Discretionary errors are not evident. In particular, the defendant exercised its discretionary power in accordance with the principle of proportionality. With regard to camera 3, a time limitation of the recording times to the opening hours of the retail outlets - in accordance with the order under no. 3 with regard to camera 2, which also films the car park - would also not be regarded as a milder means, since the plaintiff with camera 3 is primarily concerned with recording the advertising installation - for an unlimited period of time.

b) The order under point 7 of the decision of 23 November 2018, according to which the plaintiff must prove the reorientation of camera 3 and camera 4, is lawful.

On the basis of Article 58(1)(a) of the DSGVO, the supervisory authority may, in order to effectively control its - lawful (see above) - basic decision (point 6 of the decision), require the applicant to provide evidence of the reorientation of the two cameras.

5) The threat of penalty payments in the event that the plaintiff does not implement the various orders by 15 December 2018 (item 9 of the decision of 23 November 2018) is unlawful and infringes the plaintiff's rights (§ 113 (1) sentence 1 VwGO).

Pursuant to § 66 (1) sentence 3 of the Landesverwaltungsvollstreckungsgesetz - LVwVG - the threat of enforcement must specify a reasonable period of time to fulfil the obligation. Since the basic administrative acts under points 1 to 7 of the notice have not been declared immediately enforceable, an action has suspensive effect. Nor does the suspensive effect cease to apply for other (legal) reasons. In this case, the setting of a time limit must be linked to the date on which the basic ruling becomes final or enforceable; it is not permissible, however, to base the setting of a time limit on fixed dates determined by calendar (cf. OVG Berlin-Brandenburg, judgement of 22 April 2010 - OVG 11 B 9.09 -, juris, marginal no. 16 f.).

The threat of coercive measures in this case is unlawful because the decision of 23 November 2018, in paragraph 8, set the plaintiff a deadline of 15 December 2018 to implement the various measures ordered. This deadline, which is fixed by calendar, is not based on the date on which the company's viability is established. Moreover, on 15 December 2018 the period for appeal had not even expired. Even the extension of the time-limit to 4 January 2019 by the defendant does not remedy that error. The setting of that time-limit was not based on the date on which it became definitive either.

The decision on costs follows from § 155 (1) sentence 3 VwGO.

The ruling on the provisional enforceability of the judgment on account of costs is based on § 167 VwGO in conjunction with §§ Sections 708 et seq. Code of Civil Procedure - ZPO -.

B e s c h l u s s i o n

the 1st Chamber of the Administrative Court of Mainz

of 24 September 2020

The value of the subject matter of the dispute is set at € 25,000.00 (§ 52 (1) and (2) of the Gerichtskostengesetz - GKG -).

Reasons

For the warning (item 1 of the decision of 23 November 2018) and the order of cessation and dismantling (item 2) with regard to camera 1, a sum in dispute of € 5,000 each (total € 10,000) was to be assessed. With regard to the orders under item 2, the Chamber assumed that € 3,750 (i.e. ¾ of the amount in dispute of € 5,000 for item 2) was to be set for the cessation of camera operation and € 1,250 (i.e. ¼ of € 5,000) for dismantling. For cameras 2, 3 and 4 and the associated further injunctions, an amount in dispute of € 5,000 (i.e. € 15,000 in total) was to be assessed for each camera. The threat of coercive measures did not increase the amount in dispute (cf. item 1.7.2 of the catalogue of amounts in dispute for administrative jurisdiction).