CNPD (Luxembourg) - Délibération n° 2FR/2024

CNPD - Délibération n° 2FR/2024
Authority:	CNPD (Luxembourg)
Jurisdiction:	Luxembourg
Relevant Law:	Article 5(1)(b) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	21.05.2024
Published:	13.06.2024
Fine:	n/a
Parties:	n/a
National Case Number/Name:	Délibération n° 2FR/2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	CNPD (in FR)
Initial Contributor:	nzm

The DPA held that the use of video surveillance system, initially installed to ensure the safety of employees, to justify the dismissal of an employee is contrary to the purpose limitation principle.

English Summary

Facts

In 2013, a controller installed a video surveillance system located outside all the municipal buildings. The Luxemburgish DPA (‘CNPD’) authorised this installation. In March 2020, a data subject lodged a complaint with the CNPD regarding her dismissal by the controller who had consulted the video surveillance footage in order to qualify the serious misconduct of the data subject as accurately as possible.

In November 2020, the CNPD drew the attention of the controller to the disproportionate nature of the surveillance of employees in their workplace by means of video surveillance and to the purposes of the video surveillance allowed under the authorisation issued by the DPA.

In March 2021, during its investigation, the CNPD confirmed that the video surveillance system had been installed to guarantee the safety of the employees and users of the infrastructure.

The controller argued that independently of data protection legislation, Luxemburgish employment law requires that the letter of dismissal states precisely the misconduct of which the employee is accused, in order to avoid the dismissal being declared unfair by the competent court.

Holding

Article 5(1)(b) GDPR states that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. The CNPD added that in a video surveillance context, the EDPB specified that before using a video device, the purposes of processing have to be specified in detail under Article 5(1)(b) GDPR and that the monitoring purposes should be documented in writing (Guidelines 3/2019 on processing of personal data through video devices, §15).

The CNPD also referenced noted that the EDPB indicated that if any processing is to take place, the controller must first make sure that this processing had purposes compatible with the original ones and design such processing accordingly. Whether a new purpose is compatible or not is assessed according to Article 6(4) GDPR (Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, §71).

In the present case, the CNPD pointed out that the purpose of the video surveillance system was to guarantee a certain level of safety for both the employees and users of the infrastructure. The CNPD held that the personal data collected was processed for a different purpose, namely to justify the data subject’s dismissal with immediate effect.

The CNPD added that the controller could have been authorised to further process these images but only if it was based on the consent of the data subject or if the further processing was compatible with the initial purposes, in accordance with Articles 5(1)(b) and 6(4) GDPR.

Therefore, the CNPD issued a reminder to the controller for breaching Article 5(1)(b) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.