IP - 07121-1/2020/428

IP (Slovenia) - 07121-1/2020/428
Authority:	IP (Slovenia)
Jurisdiction:	Slovenia
Relevant Law:	Article 6 GDPR Article 58 GDPR Article 49(1)(7) ZVOP-1 Article 43(2) ZInfP Article 113 ZNPPol
Type:	Advisory Opinion
Outcome:	n/a
Started:
Decided:	29.03.2020
Published:
Fine:	None
Parties:	anonymous
National Case Number/Name:	07121-1/2020/428
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Slovenian
Original Source:	Informacijski Pooblascenec (in SL)
Initial Contributor:	n/a

The IP issued the opinion that the police, when performing their tasks, may lawfully access video footage without the participants' consent, while any third party, such as an insurance company, should have an adequate legal basis under Article 6 GDPR to lawfully do so.

English Summary

Facts

An individual notified the IP about a car accident in a parking lot, where he was involved. The police inspected video footage which was recording the parking lot. He claimed that the police should have asked the participants' consent and he asked the IP whether the insurance company dealing with the claim may inspect the footage upon his request.

Holding

The IP distinguished among the three following possibilities: - the data subject concerned has the right to access the footage regardless of the consent of other participants in the footage; - a third party such as the insurance company may have lawful access to the footage only if it has an adequate legal basis under Article 6(1) GDPR; - when performing police tasks, the police may access the recordings without the consent of the participants pursuant to Article 113 ZNPPol.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the Slovenian original for more details.

The Information Commissioner (hereinafter referred to as IP) received an e-mail informing you that you were involved in a loss event by car in the parking lot. The participant claimed that it was your fault, which prompted the competent police station to inspect the security camera footage and secure it until the case was clarified. The police station should have given you and the co-signer a consent form to review the security camera footage, but the co-conspirator did not consent to the review. You ask us whether the insurance company dealing with the claim has any authority to review the security camera footage at your request.
 
On the basis of the information you have provided, hereinafter referred to as Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and Directive 95/46 / EC (hereinafter: the General Decree), point 7 of the first paragraph of Article 49 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 94/07, officially consolidated text, hereinafter ZVOP-1), and 2 Article 43 of the Information Commissioner Act (Official Gazette RS, No. 113/05, hereinafter ZInfP), we provide our non-binding opinion on your question. In addition, the IP emphasizes that it cannot judge the actual processing of personal data outside the inspection process.

Insight into videos is one possible way of processing personal information. A video collection manager who performs video surveillance can only review videos for the primary purpose of collecting them, for example, to ensure the safety of people or property, or possibly in the event of an extraordinary, deviant event where the video would serve as additional evidence in legal proceedings. Subject to the principle of the minimum amount of personal data, video surveillance images may only be accessed when there is an "event" described by the conditions for the introduction of video surveillance.
When transmitting video surveillance cameras, we separate the communication to the individual in order to exercise the right to know their personal data and to pass it on to third parties on an appropriate legal basis.
(i) Access to recordings for the exercise of the right to be informed of personal data
Article 15 (1) of the General Regulation provides that the data subject is entitled to obtain from the controller an acknowledgment of the processing of personal data and, where applicable, access to personal data and certain listed information , such as information about the purpose of the processing, types of personal data, users of personal data, etc. Accordingly, each individual has the right to contact the video surveillance contractor and request a video recording of the video surveillance. In order to protect the rights of other individuals, it is possible and probably also necessary for the controller of personal data to cover or obscure personal data (that is, primarily the image and other identifiable features of other individuals) in the recording. The advantage of having this option as an individual on the recording is that the ability to access the recording is available to you regardless of the consent of other participants.
(ii) Access to recordings by third parties
Video recordings may only be transmitted by the video surveillance contractor to third parties, provided that they provide the appropriate legal basis.
The legal bases are governed by Article 6 (1) of the General Regulation, which provides that processing is lawful only to the extent that at least one of the following conditions is fulfilled:

a. the data subject has consented to the processing of his or her personal data for one or more specific purposes;
b. processing is necessary for the performance of a contract to which the data subject is a contracting party or for the implementation of measures at the request of such individual before the conclusion of the contract;
c. processing is necessary to fulfill the legal obligation applicable to the controller;
d. processing is necessary to protect the data subject or other natural person;
e. processing is necessary for the performance of tasks in the public interest or in the exercise of public authority conferred on the controller;
f. processing is necessary for the legitimate interests pursued by the controller or a third party, except where such interests outweigh the interests or fundamental rights and freedoms of the data subject requesting the protection of personal data, in particular where the data subject is refer to personal information, child.
Insofar as there is a proper legal basis in this case, third party video access is permissible. Otherwise, such processing of personal data could be illegal.
When performing police tasks, the police may access the recordings without the consent of the participants pursuant to Article 113 of the Police Tasks and Powers Act (Official Gazette RS, No. 15/13, as amended and hereinafter referred to as ZNPPol). Therefore, if the conditions for viewing the clip from Article 113 are fulfilled, therefore, the police do not need to obtain any consent, so it is not entirely clear why, according to you, the said police station should ask you and the other participant for consent.
The insurer is also considered to have access to the recording only on condition that one of the legal bases mentioned above is fulfilled. In the absence of the consent of the individual (notably the other participant), the potential grounds in Article 6 (1) (b) - performance of the contract and Article 6 (1) (f) - are the legitimate interests of the operator or third party. In this optional opinion, IP cannot determine whether any of the aforementioned grounds should be given, since it does not have all the relevant information for this purpose, nor can it be determined outside the inspection procedure in the specific case up to the (un) legality of certain processing of personal data.
Hoping to receive your answer, we welcome you.