HDPA (Greece) - 51/2022

HDPA - 51/2022
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 4(1) GDPR Article 9 GDPR Article 12(4) GDPR Article 14(4) GDPR Art. 4 of Art. 7 of the General Regulation (EU) 2016/679 The European Data Protection Board Guideline No 3/2019
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	3,000 EUR
Parties:	n/a
National Case Number/Name:	51/2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	Hellenic Data Protection Authority (in EL)
Initial Contributor:	Iman Coric

The Greek DPA fined a gas station owner €3,000 for failing to inform the data subject that a surveillance camera recording of their minor child was further sent to the police authorities in relation to an ongoing investigation.

English Summary

Facts

The data subject exercised their right of access to a file with personal data concerning their minor child, specifically a recorded image from a video surveillance system installed at a gas station of the controller. The image, recorded and kept by the controller, was also forwarded to the police authorities at their request. It concerned an incident where the child was depicted picking up an object from the ground, which had been lost by a customer of the gas station. The material in question, as reported, was shown to the customer who was alleged to be the victim of the act.

The data subject requested the surveillance footage by telephone, personal visits and through their lawyer. Despite the efforts, the surveillance video was used in court. The DPA contacted the controller who claimed, on one hand, not to know that the child of the data subject was behaving as a perpetrator of a criminal act, and on the other hand, to not have the technical knowledge to cut third parties out of the recording.

The data subject submitted a complaint to the DPA connected to the exercise of the right of access as well as regarding the legality of the controller's video surveillance system as such.

Holding

The Greek DPA noted that the installation and operation of surveillance camera systems is governed by national law, Directive 01/2011 and Law 4624/2019, as well as the GDPR. According to Article 9(4) of Directive 01/2011, the transmission to third parties of data originating from a video surveillance system is only permitted with prior consent of the data subject unless the controller is obliged to share the data with competent police authorities upon their request. Accordingly, the controller is allowed to transmit data that may constitute evidence of an offense against the person portrayed as victim or perpetrator of a criminal act.

However, the DPA noted that Article 12(4) GDPR obliges the data controller to inform the data subject without delay that it will not take any action on a request. Moreover, in line with Article 14(4) GDPR, the controller should have informed the data subject that personal data was further processed for purposes other than the initial collection. In the present case, the controller failed to take reasonable steps to inform the data subject that a recording of their minor child was sent to the police. Additionally, the controller did not attend to the access request made by the data subject.

In conclusion, the DPA imposed a €3,000 fine on the controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

DECISION 51/2022 The Personal Data Protection Authority met as a Department on Monday 14-09-2022 at the invitation of its President, in order to examine the case referred to in the present history. Georgios Batzalexis, Deputy President, in the absence of the President of the Authority, Constantinos Menoudakos, and the alternate members Demosthenes Vougioukas, as rapporteur, and Maria Psalla, in place of the regular members Konstantinos Lambrinoudakis and Grigorios Tsolia, who, despite being legally summoned in writing, did not attend due to obstruction. The meeting was attended by Leonidas Roussos, as assistant rapporteur and by order of the President, Irini Papageorgopoulou as Secretary, an employee of the Authority's administrative affairs department. The Authority took into account the following: With the complaint No. C/EIS/7280/09-09-2018, A complained about the non-satisfaction of his right of access to a file with personal data concerning his minor child and specifically in a recorded image of a video surveillance system installed in the individual business (gas station) of the complainant, B. The image, which was recorded and kept by the business, but also forwarded to the police authorities at their request, concerns an incident where his minor child complainant is depicted picking up an object from the ground, which had been lost by C, earlier in the same area of the gas station, during the work he was performing under his vehicle (truck). The material in question, as reported, was shown to the person who is alleged to be the victim of the act. As he states, the complainant has exercised his right, since ..., by telephone as well as by personal visits, but also by telephone through his lawyer. In the context of examining the above related complaint and in order for the Authority to be able to exercise its powers, it asked the complainant to express her views on it in writing. Subsequently, the Authority with 1-3 Kifisias St., 11523 Athens, Tel.: 210-6475600, Fax: 210-6475628, contact@dpa.gr, www.dpa.gr -1- Athens, 22-09- 2022 Prot. No.: 2337 Prot. No. C/EX/7280-1/02-10-2018 document called the complainant to provide explanations regarding the complaint. With the under no. prot. C/EIS/8285/18-10-2018 in her response the complainant claimed that on the one hand she did not know that the son of the complainant was behaving as a perpetrator of a criminal act, as the complainant never told her that he had been accused of something and on the other hand she did not have the technical knowledge to cut third parties out of the picture. With no. prot. C/EIS/6614/03-05-2022 his supplementary document, the complainant asks the Authority what its actions are, complains about the showing of the material to the party, alleged as a victim, the transmission of the material with certain scenes cut out in court , as well as asking whether an autopsy was performed by the Authority on the general legality of the video surveillance system in question, which complains that it receives images beyond its "jurisdiction", according to the disputed material, while also attaching the court decision that acquits the son of the categories. With the summons number C/EXE/1792/12-07-2022, the Authority invited the complainant to appear before it at its meeting on Wednesday 20-07-2022, in order to provide further clarifications and to present the views in detail her. The complainant appeared, through her lawyer, Sofia D. Mila (AM ...) and supported what she had previously stated in writing, arguing that on the one hand she did not have the technical knowledge to cut out and transmit only the part of the material that depicted the minor child of the complainant, on the one hand, that he did not know that the latter was accused as the perpetrator of a criminal act. The complainant was given a deadline to submit a memorandum, especially regarding the installation of the video surveillance system in question. With the e-mail message number C/EIS/9202/28-07-2022, the complainant sent the Authority photos from the installed video surveillance system, as well as the area being observed, from which no violation of the principle of proportionality. CONSIDERED ACCORDING TO THE LAW 1. According to art. 4 pc. 7 of the General Regulation (EU) 2016/679 for the protection of natural persons against the processing of personal data and for the free movement of such data (hereinafter, the Regulation), which is in force since May 25, 2018, as controller is defined as "the natural or legal person, public authority, agency or other entity that, alone or jointly with others, determines the purposes and manner of processing personal data -2-". 2. Regarding the issue of the use of video surveillance systems for the purpose of protecting persons and property, Directive 1/2011 applies, the provisions of which must be applied in conjunction with the new provisions of the GDPR and Law 4624/2019. This applies in particular to the obligations of the controller included in chapter C' thereof (articles 10 to 13 of Directive 1/2011). For example, controllers no longer have an obligation to notify the Authority of the processing, but must ensure that the enhanced rights provided for by the GDPR are met. 3. The European Data Protection Board has issued guidelines No. 3/2019, regarding the processing of personal data through video capture devices. This text provides detailed guidance on how the GDPR applies in relation to the use of cameras for various purposes. 4. According to Article 9 of the above Directive, "Transmission of data to third parties": 1. The transmission to third parties of data originating from a video surveillance system is permitted with the prior consent of the data subject. Exceptionally, such a transfer is permitted without consent only under the conditions of paragraphs 2 and 3 of this article. 2. The data controller is obliged to transmit to the competent judicial, prosecutorial and police authorities data that the latter legally request in the exercise of their duties. 3. The data controller, in addition to his more specific obligations and rights provided for by the Code of Criminal Procedure, may transmit to the competent judicial, prosecutorial and police authorities data that may constitute evidence of a criminal act (e.g. theft, beating) that took place in the area that it has a legal interest or legal obligation to protect as defined in article 2 of this Directive and that can contribute to the investigation of the facts or the identification of the perpetrators. -3- 4. The controller is allowed to transmit data that may constitute evidence of a criminal act to the person portrayed as the victim or perpetrator of the act. 5. According to par. 4 of no. 12 of the GDPR, if the controller does not act on the data subject's request, the controller shall inform the data subject, without delay and at the latest within one month of receipt of the request, of the reasons for not acting and the possibility of submitting a complaint to a supervisory authority and taking legal action. 6. According to par. 4 of no. 14 of the GDPR, when the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller should provide the data subject, before said further processing, information for this purpose and any other necessary information, as mentioned in paragraph 2. 7. In this particular case, the data controller did not act on the subject's request for access to his data, while also not justifying/documenting to the subject the reasons for which he did not act on. Furthermore, the controller did not inform the subject that his data was further processed and transmitted to the police authorities. Based on the above, the Authority unanimously considers that the administrative sanction referred to in the decree should be imposed on the complained enterprise, as the controller, which is considered proportional to the gravity of the violation. FOR THESE REASONS, THE AUTHORITY Imposes on the complained enterprise the effective, proportional and dissuasive administrative monetary fine that is appropriate in this particular case, according to its special circumstances, in the amount of three thousand (3,000.00) euros, for the violations established above. The Deputy President George Batzalexis Secretary Irini Papageorgopoulou