NAIH (Hungary) - NAIH-3748-1/2021: Difference between revisions

Latest revision as of 11:56, 27 July 2021

NAIH (Hungary) - NAIH-3748-1/2021

Authority:	NAIH (Hungary)
Jurisdiction:	Hungary
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 5(1)(b) GDPR Article 5(2) GDPR Article 6 GDPR Article 13(1) GDPR Article 13(2) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	25.03.2021
Published:
Fine:	500000 HUF
Parties:	n/a
National Case Number/Name:	NAIH-3748-1/2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Hungarian
Original Source:	NAIH's webpage (in HU)
Initial Contributor:	n/a

The Hungarian DPA (NAIH) held that CCTV monitoring is only necessary when less intrusive measures are not available. Further, the relevant data protection documentation (especially the privacy notice) must detail how the CCTV monitoring takes place and how the related recordings are processed by the controller.

English Summary

Facts

A complaint was lodged against a retirement home operating a CCTV system in its premises. In the following procedure, the operator of the retirement home presented that the cameras are necessary for protecting property, maintaining work order and house rules, protecting the physical integrity and freedom of the occupants, as well as trade secrets of the operator. The operator also highlighted that the legal basis for data processing was its legitimate interest with regard to its employees and consent with regard to other persons.

In the procedure, the operator also argued that the recordings are necessary to settle disputes among occupants (e.g. theft in the kitchen, minor fights) and to protect the interests of the operator and its employees (e.g. if payments are disputed or if an employee is accused of malpractice) and the physical integrity of the occupants (e.g. in case an occupant needs urgent medical help). The operator also argued that the head of the retirement home consented to the monitoring of their office to prove that no bribery or other misuse takes place.

Holding

The holding of the Hungarian DPA (NAIH) in this case was that the above reasons generally do not necessitate the operation of a CCTV system and that the operator monitored the performance of employees and the life of the occupants unlawfully. Disputes among occupants and concerning personnel could be settled with measures less invasive of the privacy and private life of data subjects. NAIH also highlighted in this respect that payments could also be proven by written declaration instead of a CCTV recording and that in case of an accident or injury necessitating immediate assistance, analyzing the recordings before acting would be unreasonable. NAIH further suggested that the anti-corruption cause for monitoring the office of the head of the retirement home was too evasive (especially considering that the CCTV system did not record sound).

In addition to the above, consent as a legal basis was not applicable, since the data subjects were not in a position to effectively give and withdraw consent. The data protection documentation concerning the CCTV system was also contradictory or missed certain details (i.e. the privacy notice did not specify the persons having the right to access the recordings or the exact data protection rights of the data subjects).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.

@@ Line 60: / Line 60: @@
 }}
-The Hungarian DPA highlighted that  CCTV monitoring will only be necessary where no other less intrusive measures are available. Further, the relevant data protection documentation (especially the privacy notice) must detail how the monitoring takes place and how the related recordings are processed by the operator.
+The Hungarian DPA (NAIH) held that CCTV monitoring is only necessary when less intrusive measures are not available. Further, the relevant data protection documentation (especially the privacy notice) must detail how the CCTV monitoring takes place and how the related recordings are processed by the controller.
 == English Summary ==
 === Facts ===
-A complaint was lodged against a retirement home operating CCTV system in its premises. In the following procedure, the operator of the retirement home presented that the cameras are necessary for protecting  property, maintaining work order and house rules, protecting the physical integrity and freedom of the occupants, as well as trade secrets of the operator. The operator also highlighted that the legal basis for data processing was its legitimate interest with regard to its employees and consent with regard to other persons.
+A complaint was lodged against a retirement home operating a CCTV system in its premises. In the following procedure, the operator of the retirement home presented that the cameras are necessary for protecting property, maintaining work order and house rules, protecting the physical integrity and freedom of the occupants, as well as trade secrets of the operator. The operator also highlighted that the legal basis for data processing was its legitimate interest with regard to its employees and consent with regard to other persons.
-=== Dispute ===
+In the procedure, the operator also argued that the recordings are necessary to settle disputes among occupants (e.g. theft in the kitchen, minor fights) and to protect the interests of the operator and its employees (e.g. if payments are disputed or if an employee is accused of malpractice) and the physical integrity of the occupants (e.g. in case an occupant needs urgent medical help). The operator also argued that the head of the retirement home consented to the monitoring of their office to prove that no bribery or other misuse takes place.
-In the given procedure, the operator also argued that the recordings are necessary to settle disputes among occupants (e.g. theft in the kitchen, minor fights) and to protect the interests of the operator and its employees (e.g. if payments are disputed or an employee is accused of malpractice) and the physical integrity of the occupants (e.g. in case an occupant needs urgent medical help). The operator also argued that the head of the retirement home consented to the monitoring of its office to prove that no bribery or other misuse takes place.
 === Holding ===
-The holding of NAIH in this case was that the above reasons generally do not necessitate the operation of a CCTV system and that the operator thoroughly monitored the performance of work of its employees and the life of the occupants unlawfully. Disputes among ocuppants and concerning personnel could be settled with measures less affecting the privacy and private life of data subjects. NAIH also highlighted in this respect that payments could also be proven by written declaration instead of a CCTV recording and in case of an accident or injury necessitating immediate assistance, analyzing the recordings before acting would be unreasonable. NAIH further underpinned that the anticorruption cause for monitoring the office of the head of the retirement home was too evasive (also bearing in mind that the CCTV system did not record sound).
+The holding of the Hungarian DPA (NAIH) in this case was that the above reasons generally do not necessitate the operation of a CCTV system and that the operator monitored the performance of employees and the life of the occupants unlawfully. Disputes among occupants and concerning personnel could be settled with measures less invasive of the privacy and private life of data subjects. NAIH also highlighted in this respect that payments could also be proven by written declaration instead of a CCTV recording and that in case of an accident or injury necessitating immediate assistance, analyzing the recordings before acting would be unreasonable. NAIH further suggested that the anti-corruption cause for monitoring the office of the head of the retirement home was too evasive (especially considering that the CCTV system did not record sound).
 In addition to the above, consent as a legal basis was not applicable, since the data subjects were not in a position to effectively give and withdraw consent. The data protection documentation concerning the CCTV system was also contradictory or missed certain details (i.e. the privacy notice did not specify the persons having the right to access the recordings or the exact data protection rights of the data subjects).