Datatilsynet (Denmark) - 2020-832-0028

Datatilsynet - 2020-832-0028
Authority:	Datatilsynet (Denmark)
Jurisdiction:	Denmark
Relevant Law:	Article 5 GDPR Article 15 GDPR § 22, 1 and 2 Databeskyttelsesloven
Type:	Other
Outcome:	n/a
Started:
Decided:
Published:	22.06.2022
Fine:	n/a
Parties:	DBU Divisionsforeningen
National Case Number/Name:	2020-832-0028
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Danish
Original Source:	Afslag på indsigt i tv-overvågningsoptagelser fra stadion var berettiget (in DA)
Initial Contributor:	lou_schda

The Danish DPA held that the Danish Football Association and Danish League could deny an access request seeking CCTV evidence in a suit against the police, but it reprimanded the two for conflicting statements on their joint controllership.

English Summary

Facts

In July 2020, the data subject watched a Cup final at Blue Water Arena in Esbjerg. During the match, a riot broke out and the data subject was subsequently detained by the police. He claimed to have not participated in the riot and needed a CCTV footage to prove his innocence in making a civil claim for damages against the police. Therefore, he requested that the DBU (Danish Football Association) and the Divisionsforeningen (Danish League) provide him with access to the footage.

In August 2020, the Divisionsforeningen replied to the data subject that his access request was denied. Divisionsforeningen considered that providing access to the CCTV footage would render video surveillance counterproductive and compromise the safety of the security officers and the spectators. That is because it would reveal the location of surveillance equipment and blind spots.

The Divisionsforeningen also asserted in its reply that it shares controllership with DBU and EfB Elite A/S, an owner of a football club. Later, the DBU stated on behalf of Divisionsforeningen and EfB Elite A/S that the joint controllership was shared solely between the DBU and the Divisionsforeningen.

Holding

First, the Danish DPA held that the DBU and the Divisionsforeningen were justified in refusing to facilitate the data subject's access request with regard to the CCTV footage. There are exceptions to the right of access. According to Article 22 of the Danish Data Protection Act, an access request under Article 15 GDPR may be denied if the data subject's right is overridden by a vital public interest, particularly that of state security and public safety. The Danish DPA found that the data subject’s right in this particular case was indeed overridden by the overriding considerations of public safety. However, the DPA also emphasized that restrictions on the right of access should only be made on the basis of a specific assessment of the information available at the time of receipt of an access request. This applies in particular in cases where the data subject provides a specific (and legitimate) justification for the access request.

Second, the DPA however held that DBU and the Divisionsforeningen’s processing of personal data violated Article 5(1)(a) GDPR and therefore issued a reprimand against them. This was because throughout the communication with the data subject and the DPA, the DBU and the Divisionsforeningen gave different, contradictory information about who the controller was.

Comment

Article 22 of the Danish Data Protection Act serves as a restriction of Article 15 GDPR based on Article 23 GDPR. However, Article 22 of the Danish Data Protection Act does not explicitly refer to the principle of proportionality and necessity the way that Article 23 GDPR does.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.

Refusal of access to television surveillance footage from the stadium was justified

Date: 22-06-2022

Decision Private companies Criticism Complaint Clarification of data liability Basic principles The right to insight Television surveillance

The Danish Data Protection Agency has made a decision in a case where DBU and the Divisional Association refused to provide a registered insight into TV surveillance recordings made in connection with a match at Blue Water Arena in Esbjerg.

Journal number: 2020-832-0028

Summary

The Danish Data Protection Agency has made a decision in a case where DBU and the Divisional Association refused to provide a registered insight into TV surveillance recordings made in connection with a match at Blue Water Arena in Esbjerg.

Decision

After a review of the case, the Danish Data Protection Agency finds that there are grounds for expressing criticism that DBU and the Divisional Association's processing of personal data has not taken place in accordance with the rules in Article 5 of the Data Protection Regulation [1].

The Danish Data Protection Agency finds no basis for ascertaining that DBU's and the Divisional Association's handling of the complainants' request for insight has taken place in violation of Article 15 of the Data Protection Regulation and section 22 (1) of the Data Protection Act [2]. 1 and 2.

However, the Danish Data Protection Agency has recommended that DBU and the Divisional Association make a specific assessment of received requests for insight in the future, including the data subject's specific interest in receiving all or part of the information.

Below is a more detailed review of the case and a justification for the Danish Data Protection Agency's decision.

2. Case presentation

It appears from the case that complainants watched the cup final between Aab and Sønderjyske in July 2020 at Blue Water Arena in Esbjerg. In connection with this, complaints were reportedly confiscated by the police when riots broke out at Blue Water Arena.

As a result, on 7 July 2020, complainants EfB Elite A / S requested insight into information about him that may appear from the arena's TV surveillance images.

On 9 July 2020, EfB Elite A / S responded to his inquiry and stated that complainants should address the request to the Divisional Association, which was data responsible for the event in question and thus also for the television surveillance that had been carried out in connection with this.

Complainants then contacted the Divisional Association on 9 July 2020 and requested insight. The request for insight stated, among other things, following:


"I have asked for admission that shows me on the day when I have to use them in a compensation case regarding unjustified deprivation of liberty. I'm not trying to focus on you or Blue Water Arena, but just want to know if there have been video recordings on the day that can be used in this case. For this I have called Jan and met very little willingness to cooperate. Therefore, I have been forced to exercise my right to have them extradited in accordance with GDPR legislation. I have tried to be pedagogical and referred Jan directly to the articles of the Danish Data Protection Agency and current legislation, which give me the right to request and have these recordings handed over in connection with private considerations. I have done this without success, until today he has replied that you as organizers of the cup final were responsible for the event on the day.

(…)

I do not want to hang anyone out, but simply to have the data handed out, and it is therefore important for me to know who has been the data manager for the event and who has been the data processor. Based on what Jan has said and written, they are the data processors, and the responsibility for the use and storage of the data, including monitoring, lies with you, and therefore it is you I must contact to get it handed out.

The data I want handed out is described in the first email and is as follows:

I will contact you today 7 / 7-2020 in connection with ongoing post-evaluation and preparation of legal material for the episodes that took place at the entrance to section B10 at Blue Water Arena, I would ask you to hand over surveillance material from video surveillance in the lobby, which is aimed at the entrance area, as well as video surveillance outside the stadium which is aimed at the entrance area. The episodes took place in the period 20: 10-22: 00, and therefore recording is desired at this time. Please hand over all video recordings or still images directed outside the stadium to the flock of AaB fans, both before and after they are detained and handcuffed, also outside the above stated time period. I ask you to hand it over in accordance with the applicable GDPR rules, which require that these be handed over as I know I am on the recordings during this period, and must apply for a legal purpose. I have attached a copy of one of my tickets so you can confirm I was present at the Blue Water Arena that day. If you do not provide these, the Danish Data Protection Agency will be notified and a case will be initiated against you for breach of applicable legislation in the area in accordance with ACT no. 506 of 23/05/2018 §3.b, as well as the Data Protection Regulation Articles 13, 14 and 15.

In addition, I would like to ask you if you have filmed section B10, the entrance hall to section B10, and the area outside the stadium at entrance B10, who you have shared or shared these surveillance images with, how long you have kept the recordings, which cameras you have or has aimed at the entrance to section B10 outside and inside the stadium, as well as section B10 at the stadium. If you do not provide these either, the Danish Data Protection Agency will be notified and a case will be initiated against you for breach of applicable legislation in the area in accordance with ACT no. 506 of 23/05/2018 §3.b and §4.c and Data Protection Regulation Article 13 and 14.

Finally, I would like to ask you to hand out video recordings aimed at section B10 in the period 19: 30-20: 30. If you do not provide these, the Danish Data Protection Agency will be notified and a case will be initiated against you for breach of applicable legislation in the area in accordance with ACT no. 506 of 23/05/2018 §3.b, as well as the Data Protection Regulation Articles 13, 14 and 15. ”

The Divisional Association requested additional identification information, which complaints emerged on 10 July 2020 in the form of driving licenses.

On 5 August 2020, the Divisional Association replied to the complainant's request for insight. The following appeared i.a. of the answer:

"It can be stated that Blue Water Arena is owned by Esbjerg Municipality, but monitoring equipment is owned by EfB and has been used during the cup final by agreement between EfB and DBU / Divisionsforeningen, which was the match organizer. There is a shared data responsibility.

As a subject of rights, you are not entitled to know which agreements, including data processor agreements, may have been made with EfB. However, we can inform you that the necessary and appropriate technical and organizational security measures have been taken to handle the processing of personal data in connection with the settlement of the cup final.

(…)

We believe that insight into video surveillance footage inside and outside the stadium is suitable for compromising the safety of the stadium for inspectors and others, as it i.a. will reveal the location of surveillance equipment and blind spots and make video surveillance counterproductive, just as the provision of surveillance material hampers the ability of inspectors to perform their security duties. Among other things, we have have been in dialogue with the National Police about this, and they agree with our considerations.

Therefore, we unfortunately have to reject your request to hand over the image sequences in question, just as we can neither confirm nor deny that video surveillance was carried out outside the stadium facing the entrance area, in the foyer facing the entrance area, in section B10 and outside the stadium facing the group of AaB fans who came into police custody. ”

On 17 August 2020, the Danish Data Protection Agency sent the complainant's complaint for consultation and asked the Divisional Association for an opinion on the matter.

Dansk Boldspil-Union A / S (DBU) appeared on 14 September 2020 on behalf of DBU and Divisionsforeningen with a statement on the matter. The following was stated about the data responsibility:

The video recordings in question took place in connection with the settlement of the cup final in football on 1 July 2020. The cup final was arranged by DBU, DBU Bredde and Divisionsforeningen jointly, and it is therefore our assessment that Divisionsforeningen is jointly responsible for data. with DBU. ”

The opinion was sent to complainants on 21 September 2020. Complainants appeared on the same day with comments on the opinion, after which his comments were sent to the Divisional Association on 6 October 2020.

DBU submitted comments on 23 October 2020 on behalf of DBU, Divisionsforeningen and EfB. The following appeared in relation to the data responsibility:

"However, we would like to regret that in our rejection of 5 August 2020 we came to state that EfB was jointly responsible for data with DBU and the Divisional Association, as this was an internal misunderstanding, which was corrected when we dived closer. down in the case in connection with our joint response to the Danish Data Protection Agency.

However, it has never been stated that we shared data responsibility with DBU Bredde. DBU Bredde is the official co-organizer of the cup final, but had no practical functions in connection with the preparation or settlement of the cup final, so the joint data responsibility was solely between DBU and the Divisional Association, as stated in the response to the Danish Data Protection Agency of 14 September.

It can also be stated that it is internally described how data responsibilities and data processors are to be handled in different situations, which is why we can confirm that there is control over current procedures. However, we would like to admit that it could have been more clearly stated to the data subjects who was responsible for the data in the given situation, and this will be rectified in the future.

We can also refer again to our response to the Danish Data Protection Agency of 14 September 2020, which stated that the Divisional Association is the elite football clubs 'industry organization, and that EfB as a member referred to the Divisional Association, which responded to the complainants' inquiries on behalf of DBU and EfB.

Complainants were sent the comments on 10 November 2020, to which he appeared by telephone with comments on the same day.

2.1. Complainant's remarks

Ad data responsibility

Complainants have stated that in connection with his request for insight, it has generally been challenging to obtain information about who was responsible for the television surveillance in connection with the cup final - and thus responsible for answering his request for insight.

Ad insight into TV surveillance footage

Complainants have generally stated that DBU and Divisionsforeningen are obliged to provide information about him in the form of the TV surveillance footage, and that DBU and Divisionsforeningen, by refusing to provide the TV surveillance footage, have acted in violation of Article 15 of the Data Protection Regulation.

Complainants have stated that the television surveillance recordings must be used in connection with a compensation case concerning the police's unjustified deprivation of liberty of him. Complainants have stated in this connection that he was not part of the unrest, and that he, among several others, during the unrest of the cup final had left the stadium to tell people who were outside the stadium that they should calm down, find their ticket and seats, and go in and sit on the seats during the match.

The complainant is of the opinion that the disclosure of the TV surveillance material in question will not identify the location of the camcorders and thus reveal blind spots and compromise security. This is justified i.a. in that several of the cameras in that stadium are already fully visible. In addition, complaints claim that these concerns can be resolved by, for example, using simple photo editing software.

In conclusion, the complainants have stated that the present case is not comparable with the Danish Data Protection Agency's decision in the case with j. No. 2018-832-0009, stating in that case that the complainant had not stated a particular reason for the interest in gaining insight into the television surveillance footage.

In the present case, the complainants have given a special statement of reasons, and in this connection reference is made, inter alia, to to the Danish Data Protection Agency's decision in the case of j. No. 2018-832-0004, in which TV surveillance material was handed out in connection with a compensation case.

2.2. DBU and the Divisional Association's remarks

Ad data responsibility

In relation to data responsibility, DBU and Divisionsforeningen have stated that it is DBU and Divisionsforeningen that are responsible for the processing of personal data, including in connection with TV surveillance, which was carried out in connection with the settlement of the cup match between Aab and SønderjyskE at Blue Water. Arena.

In this connection, DBU and the Divisional Association have regretted that other information was provided to complainants and to the Danish Data Protection Agency, which was due to an internal misunderstanding.

Ad insight into TV surveillance footage

DBU and Divisionsforeningen have stated that video surveillance is carried out in connection with the settlement of matches in the 3F Super League and in the cup final. Information about this was with regard to the cup final between Aab and SønderjyskE printed on the tickets with reference to the Superligaen's Fælles Ordensreglement, which applies to the match in question.

DBU and Divisionsforeningen have also stated that during the match there were a number of spectators who - despite repeated requests from the stadium speaker - did not follow the current guidelines; especially in relation to Covid-19. As a result, the match - in accordance with the safety protocols - was interrupted and only resumed after 14 minutes, when the spectators in question left the stadium after, among other things, threatening and chasing the stadium controllers who handled the situation out of the stadium. Subsequently, a number of these spectators were arrested by the police outside the stadium.

The monitoring material is usually deleted after 14 days. However, the monitoring material which is the subject of the present case is kept for a longer period of time due to the complainant's request for insight. The material is destroyed when the case is completed.

There are three main essential considerations for the use of video surveillance in football stadiums:

Monitoring of equipment, ie. protection of stadium facilities Monitoring of spectator behavior in order to ensure compliance with football's own laws and rules, eg prohibition of pyrotechnics as regulated in the Circular on safety and order in the stadium, and for use by the police in cases of violence in the stadium Protection of individuals and groups at the stadium, i.a. the security guards and spectators

In order to fulfill the purpose of the video surveillance, it is sought as far as possible to place surveillance equipment concealed or discreetly.

On the basis of i.a. In cases where spectators who have violated the rules of conduct at the stadium have been quarantined, the DBU, the Divisional Association and the clubs have experience that riots at football matches are most often caused by a limited group of people who are not affected by sanctions, and who are willing to go even very far, partly to gain access to the stadium, and to engage in the unwanted and irregular behavior.

It is therefore DBU and the Divisional Association's assessment that it will lead to a compromise of security if the persons in question - through insight into precisely recordings from the surveillance cameras - will be able to determine the cameras' location, as in DBU and the Divisional Association's view there is an imminent risk that this will lead to the use of camera blind angles or other measures to prevent shooting, such as placing banners or other large objects, thereby creating areas that will not be visible on the shots. As a result, stadium inspectors as well as other spectators will be exposed to significant danger.

In this connection, the DBU and the Divisional Association have noted that the considerations, as described above, have been the subject of discussion with the National Police, which has agreed with the DBU and the Divisional Association's considerations.

DBU and Divisionsforeningen have also stated that DBU and Divisionsforeningen are in continuous dialogue with FIFA, and DBU and Divisionsforeningen follow their guidelines for security, etc., which is why the security protocols are directly consistent with this. FIFA's Data Protection Network also recommends, and for the reasons set out above, not to provide surveillance material to anyone other than local authorities. In addition, it can be stated that according to the DBU and the Divisional Association's information, there is a definite ban on handing over surveillance material to others than the authorities in countries such as Portugal and Germany, and that a similar practice is followed in e.g. Spain and France.

On the basis of the above, DBU and Divisionsforeningen have stated that the monitoring system at Blue Water Arena was activated during the cup final between Aab and SønderjyskE, and that DBU and Divisionsforeningen have therefore processed personal information about the participants, including probably also complaints, as DBU and Divisionsforeningen , that complainants have participated as spectators at the cup final.

DBU and Divisionsforeningen have stated in this connection that it is their opinion that it is justified to reject the complainant's request for insight into the video surveillance recordings from the cup final with reference to the Data Protection Act, section 22, subsection. 1, and the Data Protection Act § 22, para. 2, Nos. 3 and 4.

In support of this, DBU and the Divisional Association have referred to the Danish Data Protection Agency's decision in the case with j. No. 2018-832-0009.

The video surveillance at stadiums is i.a. established to support the police investigation and processing of cases concerning e.g. violence, as well as to create security for football spectators in general and enable parents and children to have a good experience together by watching football matches, whether it is under the auspices of the club or national team.

It is DBU and Divisionsforeningen's assessment that the consideration of these purposes must take precedence over the data subjects ', including complainants', interest in gaining insight into the information, as disclosure of insight will entail a risk that the video surveillance will not be able to fulfill the stated purposes.

In addition, DBU and Divisionsforeningen have added that the provision of video surveillance material in the present case will create an inappropriate precedent at events in general, and that video surveillance material has been handed over to the police in connection with their investigation of the circumstances of the cup final. will be entitled to have case material handed over by the police, cf. the rules of the Administration of Justice Act.

Justification for the Danish Data Protection Agency's decision

3.1. Data responsibility

3.1.1. The general principles for the processing of personal data, as set out in Article 5 of the Data Protection Regulation, must in all cases be respected when processing personal data. This means, among other things, that personal data must be processed legally, fairly and in a transparent manner in relation to the data subject, in accordance with Article 5 (1). 1, letter a.

3.1.2. Following a review of the case, the Danish Data Protection Agency finds that DBU and the Divisional Association's processing of personal data has not taken place in accordance with Article 5 (1) of the Data Protection Regulation. 1, letter a.

It is hereby emphasized that different, conflicting information about the data responsibility has been given to the complainants and to the Danish Data Protection Agency during the processing of the case.

On this basis, the Danish Data Protection Agency finds reason to express criticism of DBU and the Divisional Association's processing of personal data.

The Danish Data Protection Agency has noted that this was an internal misunderstanding, which has now been rectified.

3.2. Request for insight

3.2.1. It is clear from Article 15 (1) of the Data Protection Regulation 1, that the data subject has the right to receive the data controller's confirmation of whether personal data concerning the person in question is processed, and if applicable access to the personal data and the information that appears in letters a-h.

Furthermore, it follows from Article 15 (1) 3, that the data controller must hand over a copy of the personal data that is processed.

However, there are certain exceptions to the right of access. It appears i.a. of the Data Protection Act, section 22, subsection 1, that i.a. Article 15 of the Data Protection Regulation does not apply if the data subject's interest in the information is found to give way to overriding reasons relating to private interests.

Furthermore, it appears from section 22, subsection 2, that exemption from i.a. Article 15 of the Data Protection Regulation may also be made if the data subject's interest in obtaining the information is found to give way to overriding reasons relating to the public interest, in particular to:

1) state security,

2) the defense,

3) public security,

4) prevention, investigation, detection or prosecution of criminal offenses or enforcement of criminal sanctions, including protection against and prevention of threats to public security;

5) other important objectives relating to the protection of the general public interest of the European Union or a Member State, in particular the essential economic or financial interests of the European Union or a Member State, including monetary, budgetary and fiscal matters, public health and social security;

6) protection of the independence of the judiciary and legal proceedings;

7) prevention, investigation, detection and prosecution in connection with breaches of ethical rules for regulated professions,

8) control, supervisory or regulatory functions, including tasks of a temporary nature related to the exercise of official authority in the cases referred to in points 1-5 and 7;

The protection of the data subject's rights or freedoms of the data subject or of others; and

10) enforcement of civil law claims.

3.2.2. The Danish Data Protection Agency bases its decision on the case that the television surveillance footage that the complainant wanted handed over should be used in connection with a possible compensation case, where the complainant believes that he has been unjustifiably deprived of his liberty.

A data subject is in principle entitled to access information about the person concerned, in accordance with Article 15 of the Data Protection Regulation. Restrictions on the right of access should therefore only be made on the basis of a specific assessment of the information available at the time of receipt of a request for access. . This is especially true in cases where the data subject provides a special (and legitimate) justification for the request for access.

DBU and Divisionsforeningen have generally referred to the fact that insight into the TV surveillance material could lead to compromise of the safety of the stadium for spectators, inspectors and others, as e.g. the location and blind spots of the cameras can be revealed, and that the data subject's right to access can therefore be limited due to crucial considerations for public security, cf. section 22 (1) of the Data Protection Act. 1 and 2.

The Danish Data Protection Agency finds no basis for overriding DBU's and the Divisional Association's assessment that the above considerations - after a specific assessment - could justify restrictions on the data subjects' right of access.

The Danish Data Protection Agency also finds that DBU and the Divisional Association were entitled to reject the complainant's request for insight.

The Danish Data Protection Agency has emphasized that the complainant's interest in gaining insight into television surveillance footage - for the purpose of a compensation case against the police for unjustified deprivation of liberty - in the specific case should give way to decisive considerations of public safety, as this is a larger stadium, where many people will be gathered in a limited space, and where unrest can typically occur, whereby i.a. spectators may be exposed to significant danger.

The Danish Data Protection Agency also notes that complaints in connection with the bringing of a possible compensation case regarding unjustified deprivation of liberty before the courts may apply for access to the recordings via the rules of the Administration of Justice Act.

However, the Danish Data Protection Agency must emphasize that DBU and the Divisional Association, in accordance with section 22 of the Data Protection Act, upon receipt of a request for insight are obliged to make a concrete assessment of the data subject's interest in receiving the information against the crucial considerations. be accommodated.

The Danish Data Protection Agency recommends that DBU and the Divisional Association make such a specific assessment of received requests for insight in the future, including the data subject's specific interest in receiving the information in whole or in part.



[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General data protection regulation).

[2] Act No. 502 of 23 May 2018 on supplementary provisions to the Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the Data Protection Act).