AZOP (Croatia) - Decision 04-07-2022

AZOP - Decision 04-07-2022
Authority:	AZOP (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 6(1) GDPR Article 57(1) GDPR Article 58(1) GDPR Article 26 Act on the Implementation of the General Data Protection Regulation Article 32(1) Act on the Implementation of the General Data Protection Regulation
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	04.07.2022
Published:	30.12.2022
Fine:	n/a
Parties:	n/a
National Case Number/Name:	Decision 04-07-2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Croatian
Original Source:	AZOP (in HR)
Initial Contributor:	n/a

The Croatian DPA held that a controller installed a video surveillance system monitoring the public space without a legal basis under Article 6(1) GDPR and ordered the controller to adjust the angle of the cameras.

English Summary

Facts

The tenants (the controller) of a residential building in Zagreb installed surveillance cameras that captured the co-owned space as well as the public surface. A data subject complained about this fact to the Croatian DPA which in turn started an investigation and asked the controller for submissions. The controller argued that the CCTV system had been bought online, installed and maintained by the controller. The owner also added that only two persons had access to the cameras and no video recording or storage had ever taken place. During the investigation, the DPA determined that the cameras indeed partially monitored the public space of the city of Zagreb.

Holding

The Croatian DPA noted that video surveillance constitutes processing of personal data and, as such, requires a legal basis under Article 6(1) GDPR.

In this case, the controller had no legal basis to monitor the public space next to the residential building. This was confirmed by Article 26 of the Croatian Act on the Implemendation of the General Data Protection Regulation which only allows video surveillance for a purpose that is necessary and justified for the protection of persons and property. It further noted that Article 32(1) of the Act on the Implemendation of the General Data Protection Regulation prohibits private parties from monitoring public space.

The DPA found a violation of Article 6(1) GDPR and ordered the controller, pursuant to Article 58(2)(d) GDPR, to adjust the location of the cameras within 15 days so that they do not monitor public space and to provide footage confirming that the infringement was rectified.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

1
REPUBLIC OF CROATIA
PROTECTION AGENCY
PERSONAL DATA
CLASS:
NUMBER:
Zagreb, July 4, 2022.
Personal Data Protection Agency (OIB: 28454963989) on the basis of Article 57 paragraph
1 and 58 paragraph 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on
the protection of individuals in connection with the processing of personal data and the free movement of such data
and repealing Directive 95/46/EC (General Data Protection Regulation) SLEU L119
(hereinafter: General Regulation), Article 34 of the Act on the Implementation of the General Regulation on Data Protection
("Official Gazette", number: 42/2018), and Article 42 paragraph 1 and Article 96 of the Law on General
administrative procedure ("Official Gazette", number: 47/09, 110/21), ex officio makes
the following
SOLUTION
1. It is established that the video surveillance camera installed by x on the facade of the apartment
of the building at the address .. at k.č... k.o.., with its encroachment excessively affects the public
area/ street ... at c. no. .. k.o.... classified as "City of Zagreb - public good in general
use", contrary to Article 32 of the Act on the Implementation of the General Regulation on Data Protection, and
premises owned by other persons, k.č..., k.č..., k.č..., k.č... k.o..., i.e. that they
the video surveillance system processed personal data of respondents without the existence of a valid one
legal basis, and thus acted contrary to the provisions of Article 6 of the General Regulation on Protection
data
2. It is prohibited to use a video surveillance camera/video surveillance system installed
on the residential building at the address ... records a public area, which is against the provisions
Article 32, paragraph 1 of the Law on the Implementation of the General Regulation on Data Protection, and space in
owned by other persons listed in point 1. without a valid legal basis (e.g.
co-owner's consent)
3. It is ordered that x capture the video surveillance cameras described in point 1 of this sentence (that is, i
of the entire installed video surveillance system) should be limited in such a way that it does not affect it
space outside the boundaries of the k.č... k.o..., i.e. that it does not cover the public area
area/street at k.č... k.o... classified as "City of Zagreb - public good in general
use", and that it does not occupy premises owned by other persons specified in point 1 of this
2
sayings in an excessive scope that is not necessary for the protection of property x, without a legal basis
and in a way; by rotating the angle of the camera or by placing physical privacy masks
(barriers) that will simultaneously provide for all persons, including the applicant
objective possibilities of visual support that the video surveillance camera/s do not process
personal data outside the permitted scope/scope, and will not disable video surveillance in
permitted scope/scope.
4. A deadline of 15 days is set for action according to point 3 of the sentence, and x is ordered to o
done, notify this Agency by attaching evidence in the form of photos of the surveillance
monitors/screens from which the recording of the subject cameras and photos of the position can be seen
subject cameras on the object.
Form layout
The Agency for the Protection of Personal Data (hereinafter: the Agency) received the submission in
to which it is stated that the tenants of the same building installed two on the residential building at the address .
video surveillance cameras that capture the public surface and owned space from the recording angle
/co-owned by other persons.
Acting on the matter, the Agency, by letter CLASS: REG. NUMBER: dated March 25, 2022.
requested from x a written statement about the installed video surveillance system, delivery of the relevant ones
information related to the same, and the delivery of photos of the surveillance screen with camera captures.
The agency was notified on April 19, 2022, as requested by letter dated March 25, 2022.
received a statement from x submitting the Extract from the land registers for k.č... k.o...,
zk.., and photos captured by two video surveillance cameras installed on the residential building. Any
she further states that she bought the cameras in question through Internet sales and installed them herself, that she does not have them
contract for installation and maintenance, that the cameras are connected to her cell phone and to her cell phone
wife and that only the two of them have access to the cameras and that they are activated through applications
"i-Cam+" and YCC365 Plus", so that records are not recorded, processed and saved.
By inspecting the capture of the video surveillance cameras of the video surveillance system in question
it was determined that the first camera was placed on the eastern facade of the residential building at ... i
the coverage of the recording covers the courtyard area and the residential building at the address ... which was built
on the same unit .. owned by x, that the second camera was placed on the north facade of the apartment
of the building at the address ... and the coverage of the recording covers the public area/street at c. no. .. k.o...,
classified as "City of Zagreb - public good in general use and covers owned premises
other persons.
Following on from the above, we point out that as of May 25, 2018, in all member states
Regulation (EU) 2016/679 is directly applied by the European Union, including in the Republic of Croatia
of the European Parliament and the Council of April 27, 2016 on the protection of individuals in connection with processing
personal data and on the free movement of such data and on repealing the Directive
95/46/EC (General Data Protection Regulation) SL EU L119.
3
Article 6 of the General Data Protection Regulation stipulates that processing is lawful only if and in that
to the extent that at least one of the following is met: the subject has given consent for processing
of your personal data for one or more special purposes, the processing is necessary for the execution of the contract
in which the respondent is a party or in order to take action at the request of the respondent before entering into
of the contract, processing is necessary to comply with the legal obligations of the controller, processing is necessary
in order to protect the key interests of the data subject or other natural person, the processing is necessary for
performing a task of public interest or when performing the official authority of the data controller,
processing is necessary for the purposes of the legitimate interests of the controller or a third party, except when they are from
of these interests, stronger interests or fundamental rights and freedoms of respondents that require personal protection
data, especially if the respondent is a child.
The Act on the Implementation of the General Regulation on Data Protection ("Official Gazette", number 42/18) governs
personal data is processed through video surveillance, and Article 25 prescribes how
video surveillance in terms of the provisions of the Act in question refers to collection and further processing
personal data that includes the creation of a recording that forms or is intended to form a part
storage system. Unless otherwise specified by another law, to the processing of personal data
through the video surveillance system, the provisions of the Act on the Implementation of the General Act are applied
regulations on data protection.
Article 26 of the aforementioned Act prescribes how personal data is processed via video
may conduct surveillance only for the purpose that is necessary and justified for the protection of persons and property, if
the interests of the data subjects that conflict with the processing of data via video do not prevail
supervision. Video surveillance can include rooms, parts of rooms, exteriors
the surface of the building, as well as the interior space in the means of public transport, the supervision of which is necessary
in order to achieve the purpose from paragraph 1 of this article.
Article. Paragraph 32, paragraph 1 of the said Act prescribes the monitoring of public areas
via video surveillance allowed only to public authorities, legal entities with public
authorities and legal entities performing public service, only if prescribed by law,
if it is necessary for the execution of tasks and tasks of public authorities or for the protection of life and health
people of that property.
Following the above, and based on the collected support and determination of the factual situation in this
in the administrative matter, it was established that x on the residential building at the address ..., established
video surveillance system consisting of two video surveillance cameras to which the same has access i
her husband through the mobile application "i-Cam+" and YCC365 Plus", that it is the first camera
placed on the eastern facade of the residential building at the address ... and covers the scope of the recording
yard area and residential building at the address ... which was built on the same block no. owned by x, yes
is the second camera installed on the northern facade of the residential building at the address .. and coverage
recording covers a public area/street, classified as "City of Zagreb - public good in general
uses which is contrary to Article 32 of the Act on the Implementation of the General Regulation on Data Protection. Also
it was determined that the second camera captures spaces owned by other persons
at c. no. .., k.č. .., k.č. ..., k.č. .. k.o. .., that is, that they were processed with a video surveillance system
4
personal data of the respondent without the existence of a valid legal basis, and by which she acted contrary
provisions of Article 6 of the General Data Protection Regulation
Based on the above, it was necessary to act as in the sentence of the decision.
LEGAL REMEDY
No appeal is allowed against this decision, but an administrative dispute can be initiated before
by the Administrative Court in Zagreb within 30 days from the date of delivery of the decision.
DEPUTY DIRECTOR
Igor Vulje