Persónuvernd (Iceland) - 2021091678

Persónuvernd - 2021091678
Authority:	Persónuvernd (Iceland)
Jurisdiction:	Iceland
Relevant Law:	Article 6 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	28.03.2023
Published:
Fine:	n/a
Parties:	n/a
National Case Number/Name:	2021091678
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Icelandic
Original Source:	Persónuvernd (in IS)
Initial Contributor:	ls

The Icelandic DPA found that a person who installed a surveillance camera to prove their neighbors wrong in a dispute about traffic congestion could not rely on legitimate interest since the monitoring was not necessary.

English Summary

Facts

In this case, a person (controller) installed a surveillance camera whose field of view included the property and building of their neighbors without any signs informing them. Two of the neighbors (data subjects) contacted the controller to request the removal of the camera and the deletion of the recorded material but the controller did not respond.

This led the data subjects to file a complaint with the Icelandic DPA. They argued that the controller never requested their consent for the installation of the camera and that they were not informed on the monitoring, the responsible or on the purposes.

In their defense, the controller explained that they never included the data subjects' property in the field of view of the camera. The controller stated that there was a dispute between him and the data subjects about traffic congestion in their street and that he installed the camera to prove them that contrary to their belief, there was only little traffic. The controller therefore considered that he had an interest in the monitoring. Later, the street was closed and the controller stated to have deactivated the camera since then.

Holding

The DPA started by reminding that originally the object of the complaint was that the camera monitored the property and building of the data subjects. Since the camera was deactivated, the controller could not provide the DPA with a screen shot of it. Therefore, the DPA considered that it could not further investigate on that matter. However, the DPA relied on the statement of the controller that they carried out street monitoring and decided to assess the compliance of that monitoring.

The DPA then explained that the monitoring of public areas (in this case the street) by private parties is generally prohibited unless there are special considerations that justify it. This monitoring should rely on a legal basis under Article 6 GDPR. In this case, the DPA assessed whether the legitimate interest could constitute such legal basis.

The DPA recalled that when assessing if the legitimate interest is a valid legal basis, three conditions must be met : (1) the processing must be carried out in the interest pursued by the controller or a third party, (2) the processing should be necessary and (3) the interests or fundamental rights of the data subject must not outweigh the legitimate interest of the controller.

The DPA considered that the controller did not demonstrate that the monitoring was necessary to pursue his interest and therefore, did not fulfill the conditions to rely on its legitimate interest. Due to this lack of legal basis, this monitoring was not compliant with the GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Solutions

Electronic monitoring by neighbors

Case no. 2021091678

28.3.2023

Individuals are generally allowed to patrol their grounds to ensure safety and property. Care must be taken, however, to warn of surveillance cameras with signs and education to those who pass through the area. You also have to take care of the field of view of cameras and that they do not go beyond the territory of the individual, such as e.g. into other people's plots. In this case, there was a complaint that the field of view of the camera went beyond the field of view of the operator and that training was lacking.

----

Personal protection has ruled in a case where complaints were made about electronic monitoring by neighbors. More specifically, it was complained that a neighbor had installed a surveillance camera so that the field of view of the camera was focused on the complainant's land and apartment building. There was also a complaint that there were no signs about the monitoring.

The conclusion of the Personal Protection Agency was that the monitoring did not comply with the law on personal protection and processing of personal information and did not comply with the rules on electronic monitoring and handling of personal information generated during electronic monitoring.

Ruling

about a complaint about the electronic monitoring of a road in the country [...] by a neighbor in case no. 2021091678:

i
Procedure

On September 23, 2021, Personal Protection received a complaint from [A] lawyer f.h. [B] and [C] (hereinafter the complainants), residing at [...], over the electronic monitoring of [D], residing at [...].

More specifically, it is complained that [D], who is a neighbor of the complainants, has installed a surveillance camera so that the field of view of the camera is focused on the land and the apartment building of the complainants. There is also a complaint that there are no signs about the monitoring.

Personal protection invited [D] to comment on the complaint by letter, dated 23 June 2022, and his answers were received by email on 15 July s.á. Personal protection requested by e-mail to [D] on 17 August s.á. for more information regarding the monitoring. Responses to the organization's request were received on 1 September s.á. On the 25th of October s.á. Personal Protection contacted [D] by phone and requested further information about the case. The complainants were then given the opportunity to submit comments to [D]'s answers by letter on the same day and received by e-mail on 14 November s.á. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling.

1.
Complainant's point of view

The complainants rely on the fact that [D] installed a surveillance camera that covered an area that does not fall within his territory, and that the camera is directed at the complainants' land, road and residential building. Their consent was not obtained for the installation, and there are no markings on the monitoring or information on who is responsible for it or its purpose. The complainants requested that [D] remove the camera and delete all recorded material, but he did not comply with that request.

2.
point of view [D]

[D] has denied that he conducts electronic monitoring with the complainants, but revealed that due to a dispute about traffic congestion on the disputed road, he has, for several days, installed a surveillance camera on his own land. The purpose of the monitoring was to show the complainants, contrary to their belief, that there is little traffic on the road in question. However, the road was closed by the complainants in the spring of 2021 and then there was no longer any purpose for the monitoring. Since then, no surveillance camera has been active and no monitoring has been carried out. For that reason, it was not possible to deliver a screenshot from the camera to Personal Protection and there is no footage that can be deleted.

II.
Conclusion
1.
Lawfulness of processing

This case concerns electronic surveillance with a surveillance camera. It concerns the processing of personal data that falls under the authority of the Personal Protection Agency. [D] is considered to be the party responsible for said processing according to Act no. 90/2018, on personal protection and processing of personal data, and Regulation (EU) 2016/679.

The issue between the parties regarding the definition of the road in question and the right of way on it is to be resolved in court, but there is a dispute as to whether it belongs to [...], i.e. land of the complainants, or is a public road.

For electronic monitoring to be permitted, the conditions of Article 14 must be met. Act no. 90/2018. In paragraph 1 of the provision stipulates that electronic monitoring is always subject to the condition that it is carried out for objective purposes. The electronic monitoring of an area, where a limited group of people usually move around, is also subject to the condition that it is specifically needed due to the nature of the activities that take place there. Care must also be taken to ensure that the monitoring and who is responsible for it are clearly notified with a sign or in another prominent way, cf. Paragraph 4 the same articles. Monitoring of areas in public by private parties is generally not permitted unless there are special considerations that justify such monitoring.

As mentioned, this is about electronic monitoring that leads to the processing of personal information. In order for the processing of such information to be permitted, one of the conditions stipulated in Article 9 must be met. Act no. 90/2018 and Article 6 of regulation (EU) 2016/679, to be satisfied. As is the case here, section 6 is mainly to be examined. Article 9 of the law, cf. point f, paragraph 1 Article 6 of the regulation, to the effect that personal data may be processed if it is necessary for the legitimate interests of the responsible party or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh. When assessing whether the authority in question can apply, three conditions must be met. First, the processing must be carried out in the interests of the legitimate interests of the responsible party or a third party. Secondly, it is required that the processing is necessary for their interests, but when evaluating it, it is necessary to examine whether the same goal can be achieved with other and less severe means. Thirdly, the interests or fundamental rights and freedoms of the data subject that require the protection of personal data must not outweigh the legitimate interests referred to.

You should also consider rules no. 837/2006, on electronic monitoring and the processing of personal data generated during electronic monitoring, which were in force when the incident occurred. According to Article 4 of the rules, electronic monitoring had to be carried out for a declared, clear and objective purpose, such as for the sake of security or asset protection. According to Article 5 of the rules, care should be taken with all electronic monitoring that no more was done than was absolutely necessary based on the purpose of the monitoring. The privacy rights of those subject to surveillance should be respected and any unnecessary interference in their private life should be avoided. When deciding whether electronic monitoring should be carried out, it should therefore always be ascertained whether the goal of monitoring could be achieved with other, less realistic means.

2.
Conclusion

In general, it must be considered that the responsible party is allowed to monitor his private territory, for example within his own land. However, monitoring in public places is generally only in the hands of the police, unless there are special considerations that justify such monitoring by a private party.

In the case under consideration, there is a complaint that surveillance is directed both to the complainant's land and residential building. The responsible party has denied having patrolled the complainant's residential building and land, and because the surveillance camera was inactive, he could not, as explained above, provide the Personal Protection Authority with a screenshot from it. According to the above, word for word stands as to whether the processing of personal data complained about has taken place, i.e. whether the responsible party directed the field of view of the surveillance camera to the complainant's residential building and to land owned by them outside the road in question, and it will not be considered that this can be resolved by further investigation or the application of the powers that the Personal Protection Authority has according to law. In this ruling, the Data Protection Authority therefore bases the responsible party's own statement that it carried out electronic monitoring of the road in question before it was closed in the spring of 2021.

In the case, it is known that the litigant has been arguing about the right of way on the road in question for some time. It is also known that in the spring of 2021 the complainants closed the road in question. Although there is currently no conclusion on the right of way, it is indisputable that the road lies outside the private territory of the responsible party. When this happens, it is always necessary to assess whether there are interests that justify monitoring outside one's own territory.

The responsible party's answers state that he believes he has an interest in enjoying the right to use the road and that with electronic monitoring he wanted to demonstrate, contrary to the complainants' statement, that there was little traffic on the road. However, it has not been specifically substantiated how this information can be relevant to the resolution of the road dispute.

It is therefore the opinion of the Data Protection Authority that the responsible party has not demonstrated that the monitoring was necessary in the interests of its legitimate interests, which outweigh the interests or fundamental rights and freedoms of the data subjects that require the protection of personal data, cf. Number 6. Article 9 Act no. 90/2018, cf. point f, paragraph 1 Article 6 of regulation (EU) 2016/679. It is then also taken into account that according to paragraph 2. Article 8 of the Act, the responsible party is responsible for ensuring that the processing of personal information always complies with the provisions of paragraph 1. of the provision and must be able to demonstrate it, but among them is the provision of item 1. Paragraph 1 Article 8 that when processing personal data, care must be taken to ensure that it is processed in a lawful manner vis-à-vis the data subject. Then the processing will not be supported by other authorization provisions of the law and regulation.

In view of all the above, the conclusion of the Personal Protection Agency is that electronic monitoring [D] did not comply with Act no. 90/2018 on personal protection and processing of personal data, regulation (EU) 2016/679 and rules no. 837/2016 on electronic monitoring and processing of personal data generated during electronic monitoring.

Ruling:

Electronic monitoring [D] did not comply with the provisions of Act no. 90/2018, regulation (EU) 2016/679 and rules no. 837/2016 on electronic monitoring and processing of personal data generated during electronic monitoring.

Privacy March 28, 2023

Helga Sigríður Þórhallsdóttir                           Rebekka Rán Samper