RvS - 201903691/1/A3: Difference between revisions

Latest revision as of 14:51, 2 March 2020

RvS - 201903691/1/A3

Court:	RvS (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:
Decided:	26. 2. 2020
Published:	26. 2. 2020
Parties:	Anonymous The AP
National Case Number/Name:	201903691/1/A3
European Case Law Identifier:	ECLI:NL:RVS:2020:594
Appeal from:
Appeal to:
Original Language(s):	Dutch
Original Source:	de Rechtspraak (in Dutch)
Initial Contributor:	n/a

The Council of State issued a judgement on the processing of personal data by the means of two surveillance cameras, installed at a business' entrance gate for security purposes. The Court ruled that the surveillance cameras' use was lawful as there was a proper balance of interests between controllers passers-by.

English Summary

Facts

The Data protection authority (AP) dismissed the complainant’s request to issue a sanction against a business for the alleged unlawful recording of personal data with surveillance camera. Indeed, after having carried out on-site investigations, the surveillance camera position has been adjusted to be less visible for the public road. Thereafter, the area monitored corresponded to the plot boundary with the entrance gate and a section of the public road. In this regard, the AP found that the surveillance camera’s owners had legitimate interests in installing the camera, as it was used for security purposes and that one incident already took place. For that purpose, the AP found that a limited part of the public road must be filmed and that it cannot be achieved by another less restrictive mean. In addition, the AP pointed out that the data controllers had implemented sufficient safeguards to inform the passers-by about the installation of the aforementioned camera. The AP concluded that the complainant’s privacy interests did not outweigh those of the data controller.

The complainant challenged the AP’s decision before the District Court, which dismissed the appellant’s claims as well. As a consequence, the appellant lodged an appeal against the District Court's decision before the Council of State.

Dispute

The appellant argued that the District Court disregarded that a large part of the public road was monitored by the camera and that the incident which took place did not justify surveillance camera as it only happened once and was not directed against the data controller. In addition, it argued that the AP infriged Dutch administrative law as the authority did not send its report on its on-site investigations.

Therefore, the Council of State had to judge whether the District Court properly balanced the appellant's and the data controller's interests, and thus if the personal data were lawfully recorded by the camera. In addition, the Council of State had to rule on the violation of Dutch administrative law.

Holding

The Council of State ruled that the surveillance camera is filming the company’s entrance gate and a section of the public road. However, only the people who are close to the plot boundary are fully captured. In addition, the Court confirmed that the data controllers implemented sufficient safeguards, such as the deletion of the images after two weeks. Finally, the Council of State confirmed that the passers-by were properly informed of the use of the surveillance camera.

However, as the AP failed to send the appellant its report on its on-site investigations, the District court should have issued its decision with an order to pay the costs of the proceedings and a order compensation from the court registry. Thus, the district Court issued its judgement contrary to Section 6:22 of the General Administrative Law Act.

As a conclusion, the Council of State ruled that the appeal was well-founded and annulled the District Court judgement insofar there is no order for costs.

Comment

Add your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.


Ruling

201903691/1/A3.

Date of judgment: 26 February 2020

SECTION

ADMINISTRATIVE LAW

Ruling on the appeal of:

[appellant] and others, residing in Zegveld, Municipality of Woerden,

appellants,

against the judgment of the District Court of Midden-Nederland of 12 March 2019 in Case No 18/2879 in the proceedings between:

[appellant]

and

the Personal Data Authority (hereinafter AP).

Process flow

By decision of 15 November 2017, the AP rejected a request by [the Appellant] to take enforcement action in connection with two security cameras at Meije 300 in Zegveld.

By decision of 20 June 2018, the AP dismissed [the Appellant's] objection to this.

By decision of 12 March 2019, the court dismissed [the appellant's] appeal against the decision. This ruling is attached.

The [appellant] has lodged an appeal against this decision.

The AP gave a written explanation.

Interested party A] and [appellant] submitted further documents.

The Division considered the case at the session on 30 January 2020, at which [the appellant], assisted by [agent A], and the AP, represented by O.S. Nijveld and W. Steenbergen, appeared. In addition, [Interested party A] and [Interested party B], assisted by [Agent B], were heard at the hearing.

Recitals

1.    The relevant provisions of the General Data Protection Regulation (hereinafter: AVG) and the General Administrative Law Act (hereinafter: Awb) are included in the appendix that forms part of this ruling.

2.    [Appellant] requested the AP to take enforcement action in connection with two security cameras at the address Meije 300 in Zegveld that are directed towards the public road.

    On 10 April 2018, the AP conducted an on-site investigation. As a result of this investigation, the position of the cameras was adjusted so that they are less visible from the public road. In its request, the AP did not see any reason to proceed with enforcement. According to the AP, [interested party A] and [interested party B], as owners of Buitenplaats De Blauwe Meije at the address Meije 300 in Zegveld, have a justified interest in installing the cameras, as they can use them to secure their property and the goods and persons entrusted to their care. If necessary, they can also report incidents substantiated with camera images. In this context, the AP considered it important that at least one incident took place at the business premises of [interested party A] and [interested party B]. On the basis of the on-site investigation, the AP took the view that the invasion of [the appellant's] privacy when passing through the company residence and business premises of [Interested party A] and [Interested party B] was not disproportionate in relation to the purposes to be served by camera surveillance. It is necessary that the properties and persons that are located on the premises just in front of the fence are shown. For that purpose, at least the plot boundary and a limited part of the public road must be filmed. This cannot be achieved in any other less detrimental way. Passersby shall be screened as little as possible. The impact on privacy is limited to what is necessary to achieve the objectives. Stakeholder A] and [Stakeholder B] have put in place sufficient safeguards to prevent and limit undesirable consequences for data subjects. Passers-by on public roads are informed about camera surveillance by means of stickers and a sign. On this basis, the AP took the position that the privacy interests of [the appellant] did not outweigh those of [Interested party A] and [Interested party B].

3.    [the Appellant] argued that the court had misunderstood the fact that the failure to send him the report of the AP's on-site investigation was a defect that should have led to the annulment of the decision of 20 June 2018. This is contrary to Section 7:9 of the Awb. The District Court has wrongfully disregarded this defect pursuant to Section 6:22 of the General Administrative Law Act. Although he was able to respond to the report in appeal, he was obliged to lodge an appeal with the associated costs in order to be able to respond. According to [the appellant], his reaction could not be included in the decision on the objection.

3.1.    Failure to send the report of the on-site investigation is a defect as referred to in Article 7:9 of the General Administrative Law Act (Awb). The Court was allowed to pass over this defect pursuant to Section 6:22 of the General Administrative Law Act, because [the appellant] was not disadvantaged by it. He was still able to respond to the report on appeal. However, in the event that such defects are passed, it is reasonable to order an order to pay the costs of the proceedings and to order compensation from the court registry, unless there are special circumstances to waive this. The court has failed to do so, while no special circumstances have emerged to waive it.

    The argument succeeds to that extent.

4.    [Appellant] argued that the District Court had wrongly come to the conclusion that the AP did not need to proceed with enforcement. To this end, he argues that the fact that a large part of the public road is monitored by the cameras has been disregarded. The one incident that took place that was not reported does not justify camera surveillance. This was an incident that was directed against [Interested A] and [Interested B] personally and not against the company. There are no other incidents. The camera surveillance as it exists now is not necessary. It would have sufficed to film the company's own land and as small a part of the public road as possible, for example only the verge. This is also sufficient to substantiate a possible declaration. Now, when using the public road, which gives access to his home, he is always identified. Furthermore, the District Court wrongly concluded that there are safeguards that minimize the violation of privacy as much as possible. At the time of the on-site investigation, the AP identified a number of cases that were in conflict with the AVG. This means that there was a breach at the time of the enforcement request. The AP then made recommendations to remedy those inconsistencies, assuming that they had been followed up without any certainty, according to [the appellant].

4.1.    Stakeholder A] and [Stakeholder B] placed the cameras to protect their property and the property and persons entrusted to their care. In the event of an incident, they can make a substantiated declaration with the camera images. It is not disputed that this is in itself a legitimate interest as referred to in Article 6, first paragraph, opening words and under f of the AVG. The fact that this interest is actually present is evident from the egg incident. The fact that this incident has not been reported and that it would not have been directed against the company is irrelevant in that context.

    In response to the enforcement request, the AP investigated the actual situation on the spot. The documents contain prints of immobilised camera images dated 10 April 2018, the day on which the AP was at the scene. These photographs show the plot boundary with the entrance gate and a section of the public road. There is no reason not to assume the situation at the site as established by the AP on that day. The District Court has rightly considered that no more persons on the road are being portrayed than is necessary to achieve the purpose of camera surveillance. Damage may also be caused from outside the plot, which makes it necessary to also record a section outside the plot boundary on camera. Only people who are close to the plot boundary will be fully captured. If only the verge is captured, persons are not directly identifiable. As the District Court rightly considered, the AP was allowed to put the weighty interests of [interested party A] and [interested party B] in protecting their property outweigh the interests of passers-by on the public road, since they are captured as little as possible. In addition, [Stakeholder A] and [Stakeholder B] have taken measures to minimise the undesirable consequences of camera surveillance, such as deleting the images after two weeks, protecting the VCR with a password and keeping log files of log-in attempts on the app providing access to the images. Passers-by will also be informed about camera surveillance, as considered below under 5.1. The fact that the AP made further recommendations as a result of the on-site investigation does not mean that the AVG was breached. These recommendations were made in order to further optimise the protection of personal data. Interested party A] subsequently undertook by e-mail to implement the recommendations made.

    The argument fails.

5.    [appellant] argued that the court had failed to recognise that passers-by were not properly informed about camera surveillance. To this end, he argues that the stickers are not very conspicuous because several stickers and other things have been affixed to the window near the entrance door. Moreover, one of the stickers is only visible when the company is open, because the glass entrance doors to which the sticker is affixed are closed behind wooden doors outside opening hours. The other sticker is not visible when the weather is fine, because the doors are then open. Furthermore, the public parking spaces in front of the company location are filmed. There is no mention of camera surveillance here. People who park their cars there but do not visit Buitenplaats De Blauwe Meije are not warned about camera surveillance, according to [appellant].

5.1.    The Court rightly considered that passers-by are informed about the camera surveillance by means of applied stickers. Stickers with an image of a camera have been stuck on the door of the company and on the door of the company residence. The fact that some stickers are still stuck on the door of the company premises does not mean that the sticker warning about camera surveillance is not visible. If the claim made by [appellant] is correct that one of the stickers is not visible in good weather and the other sticker is not visible outside opening hours, at least one sticker will still be visible. The AP has determined that the stickers are in themselves clearly visible from the public road. There is no reason not to assume that the AP has established this fact.

    The fact that the parking spaces are not warned for camera surveillance cannot be addressed in this procedure. As the District Court rightly considered, this concerns a third camera that falls outside the scope of the enforcement request.

    The argument fails.

6.    The appeal is well-founded. The judgment under appeal should be set aside to the extent that the District Court has failed to issue a court order to pay the costs of the proceedings and a court clerk's ruling.

7.    The AP must be ordered to pay the costs of the proceedings in the manner stated below.

Decision

The Administrative Jurisdiction Division of the Council of State:

I. declares the appeal well-founded;

II. annuls the judgment of the District Court of Central Netherlands of 12 March 2019 in case no. 18/2879 in so far as no order for costs and court clerk's fees was pronounced;

III. orders the Personal Data Authority to reimburse the costs of the proceedings incurred by [the appellant] and others in connection with the handling of the appeal and the appeal up to an amount of € 2,100.00 (in words: two thousand and one hundred euros), attributable in full to legal assistance provided by a third party on a professional basis, on the understanding that payment to one of them the Personal Data Authority has fulfilled its payment obligation;

IV. order that the Authority Personal Data shall reimburse to [the appellant] and others the court fee paid by them in the amount of € 429.00 (in words: four hundred and twenty-nine euros) for the handling of the appeal and the appeal, on the understanding that payment to one of them the Authority Personal Data has fulfilled its payment obligation.

Thus determined by J. Hoekstra, chairman, and F.C.M.A. Michiels and E.J. Daalder, members, in the presence of S. Niane-van de Put, Registrar.

w.g. Hoekstra w.g. Niane-van de Put

chairman of the court clerk

Pronounced in public on 26 February 2020

805.

 

ANNEX

 

AVG

Article 5

Principles governing the processing of personal data

1. Personal data must be:

[…]

(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; further processing for archiving in the public interest, scientific or historical research or statistical purposes shall not be considered incompatible with the original purposes pursuant to Article 89(1) ('purpose limitation');

(c) adequate, relevant and limited to what is necessary for the purposes for which they are processed ('minimal data processing');

[…]

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods in so far as the personal data are processed solely for archiving purposes in the public interest or for scientific or historical research or statistical purposes in accordance with Article 89(1), provided that the appropriate technical and organisational measures are taken to safeguard the rights and freedoms of the data subject as required by this Regulation ('storage restrictions');

[…]

Article 6

Lawfulness of processing

1. Processing is lawful only if and insofar as at least one of the following conditions is met:

[…]

(f) processing is necessary for the purposes of pursuing the legitimate interests of the controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

[…]

Article 14

Information to be provided where the personal data have not been obtained from the data subject

1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

(a) the identity and contact details of the controller and, where appropriate, of the controller's representative;

(b) where appropriate, the contact details of the data protection officer;

(c) the purposes of the processing for which the personal data are intended and the legal basis for the processing;

(d) the categories of personal data concerned;

(e) where applicable, the recipients or categories of recipients of the personal data;

(f) where applicable, that the controller intends to transfer the personal data to a recipient in a third country or to an international organisation; whether or not an adequacy decision of the Commission exists; or, in the case of transfers referred to in Article 46, Article 47 or the second subparagraph of Article 49(1), what are the appropriate or appropriate safeguards, how a copy can be obtained or where it can be accessed.

[…]

Awb

Article 6:22

A decision against which an objection or appeal has been lodged may, notwithstanding any violation of a written or unwritten rule of law or general principle of law, be upheld by the body deciding on the objection or appeal if it is plausible that the interested parties have not been adversely affected thereby.

Article 7:9

If, after the administrative body has been heard, facts or circumstances come to light which could be of substantial importance for the decision to be taken on the objection or appeal, this shall be communicated to the interested parties and they shall be given the opportunity to be heard on the matter.

@@ Line 174: / Line 174: @@
 <!--Here the main article starts-->
-The District Court of First Instance of the Northern Netherlands rejected plaintiff's request to Google for the removal of search results which linked to pages about his criminal history when searching for his name. The Court ruled that in this case the interference with the plaintiff's right to privacy was justified by the overriding public interest in accessing that information.
+The Council of State issued a judgement on the processing of personal data by the means of two surveillance cameras, installed at a business' entrance gate for security purposes. The Court ruled that the surveillance cameras' use was lawful as there was a proper balance of interests between controllers passers-by.
 ==English Summary==
 ===Facts===
-On 1 December 2006 plaintiff was arrested and charged of murdering an 8-year old boy. The first conviction was on 6 September 2007 and after multiple appeals on 22 may 2012 the final verdict was 11 years and 7 month prison followed by an involuntary commitment. The European Court of Human Rights rejected the application he made there. During the whole time, there was a lot of media coverage about this case and all proceedings. On 24 May 2015 the involuntary commitment started, and it has been extended with two years twice on  2 June 2017 and 29 May 2019. There was also media coverage about these extensions.
+The Data protection authority (AP) dismissed the complainant’s request to issue a sanction against a business for the alleged unlawful recording of personal data with surveillance camera. Indeed, after having carried out on-site investigations, the surveillance camera position has been adjusted to be less visible for the public road. Thereafter, the area monitored corresponded to the plot boundary with the entrance gate and a section of the public road. In this regard, the AP found that the surveillance camera’s owners had legitimate interests in installing the camera, as it was used for security purposes and that one incident already took place. For that purpose, the AP found that a limited part of the public road must be filmed and that it cannot be achieved by another less restrictive mean. In addition, the AP pointed out that the data controllers had implemented sufficient safeguards to inform the passers-by about the installation of the aforementioned camera. The AP concluded that the complainant’s privacy interests did not outweigh those of the data controller.
-When searching using Google search for the name of plaintiff, a lot of search results are found with publications about the crime he committed and the legal proceedings afterwards.
+The complainant challenged the AP’s decision before the District Court, which dismissed the appellant’s claims as well. As a consequence, the appellant lodged an appeal against the District Court's decision before the Council of State.
-After a request, Google removed 100 search results, but denied to remove 82 other results. It explained that with: "It is Google's understanding that the information about your client on these URL's - with regard to all the circumstances of the case we are aware of - is still relevant in relation to the purposes of data processing, and therefore the reference to this document in our search results is justified by the public interest."
 ===Dispute===
-====Plaintiff====
+The appellant argued that the District Court disregarded that a large part of the public road was monitored by the camera and that the incident which took place did not justify surveillance camera as it only happened once and was not directed against the data controller. In addition, it argued that the AP infriged Dutch administrative law as the authority did not send its report on its on-site investigations.
-The search results include information about criminal convictions and background of the crime.
-Based on [[Article 10 GDPR]] data processing about criminal convictions is only allowed under the control of an official authority. Data processing would also be allowed if processing is authorised by Union or Member State law, but this does not apply. Based on this, Google may not process this data. [[Article 32 GDPR]] and [[Article 33 GDPR]] also cannot justify the processing.
-Based on [[CJEU - C-131/12 - Costeja]], [[Hoge Raad - 15/03380]] and [[Article 17 GDPR]] a weighing of the interests should take place as defined in the Costeja ruling.
+Therefore, the Council of State had to judge whether the District Court properly balanced the appellant's and the data controller's interests, and thus if the personal data were lawfully recorded by the camera. In addition, the Council of State had to rule on the violation of Dutch administrative law.
-Applicant's right to privacy shall normally outweigh Google's economical interests.
-In this case applicant's right to privacy shall prevail because information about a crime committed 12 years ago is not relevant any more. Every month, there are just 110 searches made about this case. Applicant is released from prison, and want to start a new life. This becomes impossible because of these search results. Applicant is not a public figure, but even if he is, the public does not need this particular information any more. There is no longer a discussion about the conviction of applicant.
-The search results make it difficult for applicant to find a job. Employers use Google to find information about applicants. This causes him to limit the jobs he can find. The only relevant information could be the extension of the involuntary commitment, but the public discussion about problems related to involuntary commitment should not hurt him.
-Not only the current list of URL's should be considered, but Google must also be forced to remove all future search results.
-====Defendant====
-Based on [[Article 17 GDPR]] and [[Article 21 GDPR]] it is only possible to request to delete specific search results, because a weighing of the interests must be made for every search result.
-The right to be forgotten can only be based on [[Article 17 GDPR]] and/or [[Article 21 GDPR]]. In this case this does not apply.
-Applicant bases his request on [[Article 10 GDPR]]. The goal of article 10 was never forbid search engines to process any special categories of personal data. Based on [[CJEU - C-136/17 - GC et al v. CNIL]], a weighing of the interests must also be made for special categories of personal data. [[Article 17 GDPR#3a|Article 17(3)(a) GDPR]] contains an exception to protect the freedom of expression and information which also applies to personal data relating to criminal convictions and offences. The balancing of interests is to his disadvantage.
-Applicant does not point to any wrong information found on the pages linked to in the search results. So the data processing by Google is correct. Because of the seriousness of the crime for which he was convicted, the extent to which that crime shocked society, the fact that his criminal trial has been subject of public debate in several instances and the fact that the criminal case has been reported by many media, it is logical and balanced that a large proportion of the search results relate to the crime committed.
-There is a public interest in finding information about the crime committed by the applicant. The seriousness and severity of the crime committed by the applicant, as well as the subsequent investigations, indictments and convictions have resulted in almost all Dutch media and also some foreign media reporting about him. The murder of the victim has become an act of history. As opposed to "right to be forgotten" there is also a "right to remember". Applicant is a public figure. His fame is a direct and inevitable consequence of his own actions. Applicant wrongly claims that the public no longer has an interest in the contested information because there is no longer a public debate about his conviction and because the crime took place 12 years ago. However, the public has an interest in information about current and recent criminal cases, but also in information about known criminal cases that lie further in the past. Moreover, in 2017 and 2019, many more news items were published about the extension of the term of applicant's involuntary commitment. Applicant is still in a forensic position. In 2021, a new assessment will be made as to whether the term of applicant's involuntary commitment will be extended once again or whether applicant will be released. The developments in the criminal case of applicant are therefore still relevant and topical at this time. At the present state of affairs, it is difficult to see that applicant should be indemnified against any association on the internet with the criminal offence he has committed in the event of an unaccompanied leave of absence or an attempt to apply for a job. Against this background, the request by applicant to have the search results in his name removed is premature.
 ===Holding===
-The data processing of Google is based on [[Article 6 GDPR#1f|Article 6(1)(f)]]. The content of the page linked to also has to be taken in account. [[Article 10 GDPR]] states that processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out in principle only under the control of official authority. When a trade-off has to be made, based on [[Article 17 GDPR|Article 17]] and [[Article 21 GDPR|21]], plaintiff's right to privacy shall normally outweigh Google's economical interests. In this case, it is relevant what the CJEU has determined in [[CJEU - C-136/17 - GC et al v. CNIL]] paragraphs 46, 47, 66, 67, 68, 76, 77, 78 and 79.
+The Council of State ruled that the surveillance camera is filming the company’s entrance gate and a section of the public road. However, only the people who are close to the plot boundary are fully captured. In addition, the Court confirmed that the data controllers implemented sufficient safeguards, such as the deletion of the images after two weeks. Finally, the Council of State confirmed that the passers-by were properly informed of the use of the surveillance camera.
-Plaintiff has been convicted for murderer committed in 2006. While the jail time has ended, the involuntary commitment had not been ended yet. Publicity which involved naming the full name of plaintiff are caused by his own actions. Plaintiff did not explain why the search results cause harm at this moment, considering the involuntary commitment is not finished yet. The search results do not point to wrong information in any way. The information, even from 2006 is still relevant.
+However, as the AP failed to send the appellant its report on its on-site investigations, the District court should have issued its decision with an order to pay the costs of the proceedings and a order compensation from the court registry. Thus, the district Court issued its judgement contrary to Section 6:22 of the General Administrative Law Act.
-The request will be rejected, because the conditions from [[Article 17 GDPR#1|Article 17(1) GDPR]] are not met. Listing of the search results shown after searching for the name of the plaintiff are required to protect the freedom of expression and information as defined in Article 11 Charter of Fundamental Rights of the European Union. This means the situation as described in [[Article 17 GDPR#3a|Article 17(3)(a) GDPR]] applies.
+As a conclusion, the Council of State ruled that the appeal was well-founded and annulled the District Court judgement insofar there is no order for costs.
 ==Comment==