HDPA (Greece) - 31/2020: Difference between revisions

Latest revision as of 15:36, 6 December 2023

HDPA - 31/20

Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 4(1) GDPR Article 4(2) GDPR Article 5 GDPR Article 6 GDPR HDPA Directive 1/2011 HDPA Directive 115/2001
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	04.09.2020
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	31/20
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	Panayotis Yannakas

An employee had submitted a complaint to the Greek Data Protection Authority about the video surveillance in the store in which she had worked. The Greek DPA held that a CCTV system shall be handled as subject to Article 4(1) and Article 4(2) of GDPR Regulation. That judgment does not mean that any CCTV surveillance in workplaces and under any circumstances is forbidden; the Data Protection Officer seems to make an obiter dictum legal comment and not a ratio decidendi of that decision.

The Greek Office, before finishing, its his judgment, goes through the principle of proportionality and finds, that in these facts, the merchant had not violated employees' rights when he installed the surveillance system.

English Summary

Facts

The Complainant was working in one of the merchant's stores where a CCTV system was installed and active. The employer repeatedly had assured the employees that not only was that the field of view of the cameras the cash registers, but also that the CCTV did not capture any sound at all.

The Complainant began to believe that more cameras had been installed in the store and that they were recording sound as well. Therefore, she submitted the following complaint to the Greek DPA. She also brought a court action with which she claimed damages for the unlawful processing. She claimed that some of the cameras were scoped to the WC room and the changing rooms.

During the hearing, the employer declined any allegation regarding the sound recording. He also submitted a detailed list of all the cameras with recording samples for each one and clarified all the ways he used to inform visitors and staff of the existence of that CCTV system, including notices, signs and brochures, as well as the entire Company's policy of the personal data protection in written form.

Dispute

The Greek DPA deals with certain requirements of lawfulness of CCTV systems.

Holding

The Greek Data Protection Officer argued four points:

First, under Article 4(1), the Greek DPA Office confirms that visual and sound data may be considered personal data when identifiable information relating to natural persons is included.

Second, indoor and outdoor video surveillance in areas which persons are invited to visit fulfils the definition of processing as per Article 4(2) of the GDPR.

Third, the Greek DPA concludes that a genuine adoption of the concept of proportionality in such circumstance shall also examine (a) the lawfulness, fairness, and transparency of the processing without underestimating aspects as (b) how much further the process goes in a manner that is incompatible with announced, specified, explicit and legitimate purposes or (c) minimising the amount of data to what is absolutely necessary within those purposes.

Fourth, the Board concluded that the contested CCTV system was compatible with the requirement of Article 6(1)(f) GDPR according to which, a data processing is lawful when it is strictly necessary for the purposes of the legitimate interests pursued by the Controller, except where fundamental rights of the data subject override such interests.

The Greek DPA found that the merchant collected only the strictly necessary data in order to increase the security level of the store and protect it against thieves.

Comment

The content of the decision seems modest. In particular, it is not clear which reasons the Authority has considered to reject the Complainant's allegations concerning the sound recording and the cameras' field of view.

Back as far as 2011, the Greek DPA issued a national directive for the CCTV at workplaces, and that national directive was also a reference to that decision. Relative highlights of the Greek DPA's Directive 1/2011 is that the CCTV (i) shall be used as a supervising tool only when it is absolutely necessary in terms of employees' safety (i.e., factories) or in strictly critical workplaces, such as like banks and military buildings. A regulated exemption is when (ii) the purpose of the camera is to protect cash registers or when the camera’s field of view is limited to the entrance of an area. Last but not least, under the National Directive 1/2011, (iii) data for a CCTV shall not be used to monitor employees' effectiveness and performance.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

@@ Line 60: / Line 60: @@
 An employee had submitted a complaint to the Greek Data Protection Authority about the video surveillance in the store in which she had worked. The Greek DPA held that a CCTV system shall be handled as subject to Article 4(1) and Article 4(2) of GDPR Regulation. That judgment does not mean that any CCTV surveillance in workplaces and under any circumstances is forbidden; the Data Protection Officer seems to make an obiter dictum legal comment and not a ratio decidendi of that decision.
-The Greek Office before finishing his judgment, goes through the principle of proportionality and finds that in these facts the merchant had not violated employees' rights when he installed the surveillance system.
+The Greek Office, before finishing, its his judgment, goes through the principle of proportionality and finds, that in these facts, the merchant had not violated employees' rights when he installed the surveillance system.
-== English Summary ==
+==English Summary==
-=== Facts ===
+===Facts===
-The complainer was working in one of the merchant's stores, where a CCTV system was installed and active. The employer repeatedly had assured (to the employees) not only that the field of view of the cameras was the cash registers, but also that the CCTV does not capture sound at all.
+The Complainant was working in one of the merchant's stores where a CCTV system was installed and active. The employer repeatedly had assured the employees that not only was that the field of view of the cameras the cash registers, but also that the CCTV did not capture any sound at all.
-After the complainer beginning to believe that more cameras exist in the store and that these cameras are recording sound as well, she submitted the following complaint to the Greek DPA. She brought a court action with which she was claiming damages, as well. She claimed that some of the cameras were scoped to the WC room and the changing rooms.
+The Complainant began to believe that more cameras had been installed in the store and that they were recording sound as well. Therefore, she submitted the following complaint to the Greek DPA. She also brought a court action with which she claimed damages for the unlawful processing. She claimed that some of the cameras were scoped to the WC room and the changing rooms.
-During the hearing, the employer declined any allegation relevant that the CCTV surveillance system recording sound too. Furthermore, he disclaimed various points. He also submitted a detailed list of all the cameras with recording samples for each one and clarified all the ways he used to inform visitors and staff for the existence of that CCTV system, including notices signs and brochures, as well as the entire company's policy of the personal data protection in written form.
+During the hearing, the employer declined any allegation regarding the sound recording. He also submitted a detailed list of all the cameras with recording samples for each one and clarified all the ways he used to inform visitors and staff of the existence of that CCTV system, including notices, signs and brochures, as well as the entire Company's policy of the personal data protection in written form.
-=== Dispute ===
+===Dispute===
+The Greek DPA deals with certain requirements of lawfulness of CCTV systems.
+===Holding===
+The Greek Data Protection Officer argued four points:
-=== Holding ===
+First, under Article 4(1), the Greek DPA Office confirms that visual and sound data may be considered personal data when identifiable information relating to natural persons is included.
-The Greek Data Protection Officer laid down four points of the GDPR. Firstly, with Article 4(1) the Decision Board of the Greek DPA Office considers that visual and sound data may be characterized as personal data when identifiable information relating to natural persons are included. Secondly, the interpretation of the processing term under Article 4(2) should include any video surveillance in indoors and outdoors areas which persons are invited to visit.
-Thirdly using the article 5th the Greek DPA concludes that a genuine adoption of the concept of proportionality on such circumstance shall also examine  (a) the lawfulness, fairness and transparency of the contested data processing; without underestimating aspects as (b) how further the processed goes in a manner that is incompatible with announced, specified, explicit and legitimate purposes or (c) minimizing the amount of data to what is absolutely necessary with those purposes .
+Second, indoor and outdoor video surveillance in areas which persons are invited to visit fulfils the definition of processing as per Article 4(2) of the GDPR.
-Fourth, the Decision Board concluded that the contested CCTV system is straightforward compatible with the requirement of Article 6(f). That article describes that a data processing is lawful when it is strictly necessary for the purposes of the legitimate interests pursued by the controller, except where fundamental rights of the data subject override such interests.
+Third, the Greek DPA concludes that a genuine adoption of the concept of proportionality in such circumstance shall also examine (a) the lawfulness, fairness, and transparency of the processing without underestimating aspects as (b) how much further the process goes in a manner that is incompatible with announced, specified, explicit and legitimate purposes or (c) minimising the amount of data to what is absolutely necessary within those purposes.
-The Greek DPA found that merchant collects collects only the strictly necessary data in order to increase the security level of the store and protect it against thieves.
+Fourth, the Board concluded that the contested CCTV system was compatible with the requirement of Article 6(1)(f) GDPR according to which, a data processing is lawful when it is strictly necessary for the purposes of the legitimate interests pursued by the Controller, except where fundamental rights of the data subject override such interests.
-== Comment ==
+The Greek DPA found that the merchant collected only the strictly necessary data in order to increase the security level of the store and protect it against thieves.
-The word content of the decision seems modest; it is not clear if the decision board rejected the complainer allegations relative to the sound recording and the cameras' field of view for reasons concerning the burden of proof, or the rejection was grounded on other reasons.
-Back to 2011 the Greek DPA issued a national directive for the CCTV to workplaces, and that national directive was also a reference to that decision. Relative highlights of the Greek DPA's Directive 1/2011 is that the CCTV (i) shall be used as a supervising tool only when it is absolute necessary in terms of employees' safety (i.e. factories) or in strictly critical workplaces, like banks and military buildings. A regulated exemption is when (ii) the purpose of the camera is to protect cash registrars or when the camera field of view is limited to the entrance of an area. Last and not least, under the National Directive 1/2011, (iii) data for a CCTV shall not be use to monitoring employees effectiveness and performance.
+==Comment==
+The content of the decision seems modest. In particular, it is not clear which reasons the Authority has considered to reject the Complainant's allegations concerning the sound recording and the cameras' field of view.
-== Further Resources ==
+Back as far as 2011, the Greek DPA issued a national directive for the CCTV at workplaces, and that national directive was also a reference to that decision. Relative highlights of the Greek DPA's Directive 1/2011 is that the CCTV (i) shall be used as a supervising tool only when it is absolutely necessary in terms of employees' safety (i.e., factories) or in strictly critical workplaces, such as like banks and military buildings. A regulated exemption is when (ii) the purpose of the camera is to protect cash registers or when the camera’s field of view is limited to the entrance of an area. Last but not least, under the National Directive 1/2011, (iii) data for a CCTV shall not be used to monitor employees' effectiveness and performance.
+==Further Resources==
 ''Share blogs or news articles here!''
-== English Machine Translation of the Decision ==
+==English Machine Translation of the Decision==
 The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.