CNPD (Luxembourg) - Délibération n° 47FR/2021: Difference between revisions
(Created page with "{{DPAdecisionBOX |Jurisdiction=Luxembourg |DPA-BG-Color= |DPAlogo=LogoLU.png |DPA_Abbrevation=CNPD (Luxembourg) |DPA_With_Country=CNPD (Luxembourg) |Case_Number_Name=Délib...") |
No edit summary |
||
| Line 64: | Line 64: | ||
The DPA nonetheless held that three cameras did not comply with the requirements under [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]]: | The DPA nonetheless held that three cameras did not comply with the requirements under [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]]: | ||
# The camera aimed at the reception, which was unlawful because workers have a right to not be constantly monitored | |||
# The camera aimed at the "smoker's corner", which was unlawful because it monitored a space reserved to employees' leisure time | |||
# The camera aimed at the public road outside the office and neighbouring land, which was unlawful because it was disproportionate when assessed against the purposes of the processing. | |||
Second, the DPA assessed whether the company complied with its information obligations under [[Article 13 GDPR|Article 13 GDPR]]. It found that although the employees were notified of the existence of the video surveillance systems, visitors of the company's facilities had no access to this information. | Second, the DPA assessed whether the company complied with its information obligations under [[Article 13 GDPR|Article 13 GDPR]]. It found that although the employees were notified of the existence of the video surveillance systems, visitors of the company's facilities had no access to this information. | ||
Revision as of 11:27, 18 January 2022
| CNPD (Luxembourg) - Délibération n° 47FR/2021 | |
|---|---|
 | |
| Authority: | CNPD (Luxembourg) |
| Jurisdiction: | Luxembourg |
| Relevant Law: | Article 5(1)(c) GDPR Article 13 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 01.12.2021 |
| Published: | 17.01.2022 |
| Fine: | 6800 EUR |
| Parties: | n/a |
| National Case Number/Name: | Délibération n° 47FR/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | French |
| Original Source: | CNPD (in FR) |
| Initial Contributor: | Frederick Antonovics |
The Luxembourg DPA fined a company €6800 for failing to comply with the principle of data minimisation by not limiting the field of vision of its video surveillance systems as well as inadequately informing both its employees and third parties of their existence.
English Summary
Facts
The processor is a transport company that installed video surveillance systems at its office. In February 2019, the Luxembourg DPA (CNPD) launched an investigation into the company's use of these video surveillance systems to assess its compliance with the GDPR.
Holding
First, the Luxembourg DPA assessed whether the company complied with the principle of data minimisation per Article 5(1)(c) GDPR. It started by affirming that only what is strictly necessary to achieve the pursued aims can be filmed, and that the processing operations cannot be disproportionate when assessed against their purpose. Companies seeking to lawfully install such systems are therefore required to set out the exact purposes of the processing prior to their installation.
During the investigation, the company argued the systems were installed to protect its goods and access to facilities, as well as to safeguard users and prevent accidents.
The DPA nonetheless held that three cameras did not comply with the requirements under Article 5(1)(c) GDPR:
- The camera aimed at the reception, which was unlawful because workers have a right to not be constantly monitored
- The camera aimed at the "smoker's corner", which was unlawful because it monitored a space reserved to employees' leisure time
- The camera aimed at the public road outside the office and neighbouring land, which was unlawful because it was disproportionate when assessed against the purposes of the processing.
Second, the DPA assessed whether the company complied with its information obligations under Article 13 GDPR. It found that although the employees were notified of the existence of the video surveillance systems, visitors of the company's facilities had no access to this information.
Thus, the Luxembourg DPA held that the company (1) failed to comply with the principle of data minimisation by not limiting the field of vision of its video surveillance systems, and (2) failed to adequately inform its employees and third parties of their existence.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
