CNPD (Luxembourg) - Délibération n° 44FR/2021: Difference between revisions
(Created page with "{{DPAdecisionBOX |Jurisdiction=Luxembourg |DPA-BG-Color= |DPAlogo=LogoLU.png |DPA_Abbrevation=CNPD (Luxembourg) |DPA_With_Country=CNPD (Luxembourg) |Case_Number_Name=Délib...") |
|||
| Line 57: | Line 57: | ||
The controller in this case is a car dealership that installed video surveillance cameras in its garage. | The controller in this case is a car dealership that installed video surveillance cameras in its garage. | ||
In the context of a broader investigation into video surveillance practices in the country (see very similar case here), the Luxembourg DPA inspected whether the car dealership had installed such cameras in its garage. Prior to this inspection, the company declared it did not use such cameras. However, the DPA visited the garage and found evidence of the contrary. | In the context of a broader investigation into video surveillance practices in the country ([[CNPD (Luxembourg) - Délibération n° 47FR/2021|see very similar case here]]), the Luxembourg DPA inspected whether the car dealership had installed such cameras in its garage. Prior to this inspection, the company declared it did not use such cameras. However, the DPA visited the garage and found evidence of the contrary. | ||
It therefore opened an investigation to determine whether these were lawfully installed. | It therefore opened an investigation to determine whether these were lawfully installed. | ||
=== Holding === | === Holding === | ||
First, the Luxembourg DPA assessed whether the company complied with its information obligations under [[Article 13 GDPR|Article 13 GDPR]]. It started by affirming that only what is strictly necessary to achieve the pursued aims can be filmed, and that the processing operations cannot be disproportionate when assessed against their purpose. Companies seeking to lawfully install such systems are therefore required to set out the exact purposes of the processing prior to their installation. | First, the Luxembourg DPA assessed whether the company complied with its information obligations under [[Article 13 GDPR|Article 13 GDPR]]. It started by affirming that only what is strictly necessary to achieve the pursued aims can be filmed, and that the processing operations cannot be disproportionate when assessed against their purpose. Companies seeking to lawfully install such systems are therefore required to set out the exact purposes of the processing prior to their installation. | ||
Latest revision as of 15:34, 24 January 2022
| CNPD (Luxembourg) - Délibération n° 44FR/2021 | |
|---|---|
 | |
| Authority: | CNPD (Luxembourg) |
| Jurisdiction: | Luxembourg |
| Relevant Law: | Article 5(1)(c) GDPR Article 13 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 09.11.2021 |
| Published: | 31.12.2021 |
| Fine: | 1500 EUR |
| Parties: | n/a |
| National Case Number/Name: | Délibération n° 44FR/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | French |
| Original Source: | CNPD (in FR) |
| Initial Contributor: | FA |
The Luxembourg DPA fined a car dealership €1500 for failing to comply with the principle of data minimisation by not limiting the field of vision of its video surveillance systems as well as inadequately informing both its employees and third parties of their existence.
English Summary
Facts
The controller in this case is a car dealership that installed video surveillance cameras in its garage.
In the context of a broader investigation into video surveillance practices in the country (see very similar case here), the Luxembourg DPA inspected whether the car dealership had installed such cameras in its garage. Prior to this inspection, the company declared it did not use such cameras. However, the DPA visited the garage and found evidence of the contrary.
It therefore opened an investigation to determine whether these were lawfully installed.
Holding
First, the Luxembourg DPA assessed whether the company complied with its information obligations under Article 13 GDPR. It started by affirming that only what is strictly necessary to achieve the pursued aims can be filmed, and that the processing operations cannot be disproportionate when assessed against their purpose. Companies seeking to lawfully install such systems are therefore required to set out the exact purposes of the processing prior to their installation.
During the investigation, the DPA found no information as to the existence of the video surveillance system had been provided by the car dealership. Additionally, the the employees were never notified of the existence of the video surveillance systems. The owner of the dealership argued they were not aware of the obligation to provide such information, and had only installed these to ensure customers would not have to wait if one of the receptionists were ever missing. The DPA nonetheless held the car dealership breached Article 13 GDPR by failing to provide information on the existence of the video surveillance systems.
Second, the DPA assessed whether the car dealership complied the principle of data minimisation per Article 5(1)(c) GDPR. The dealership stated the images captured by the camera were not recorded, but simply transmitted onto a screen for the owner to check whether customers were dealt with in time when the reception was not occupied. The DPA's inspector found that the field of vision of the cameras essentially allowed the constant surveillance of employees working at the reception, which they held to be disproportionate as said employees could feel constantly observed. As such, the Luxembourg DPA held the car dealership contravened Article 5(1)(c) GDPR because the cameras could be replaced with less invasive means to achieve the purpose pursued, such as a counter which welcomes customers.
Thus, the Luxembourg DPA held that the company (1) failed to comply with the principle of data minimisation by not limiting the field of vision of its video surveillance systems, and (2) failed to adequately inform its employees and third parties of their existence. It fined the dealership €1500 for these violations of the GDPR.
Comment
This decision is the only pdf available for the n°44-46 Luxembourg DPA decisions. It is unclear whether this is intentional or due to a technical error.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Go to home
Decisions
Deliberation No. 44FR/2021 of November 9, 2021 – fine
31/12/2021
Video surveillance – Non-compliance with the principle of data minimization (disproportionate field of vision) – Insufficient information of the persons concerned.
To know more
Deliberation No. 44FR/2021 of November 9, 2021 – fine
(PDF - 619 KB)
Last update 01/18/2022
Deliberation No. 44FR/2021 of November 9, 2021 – fine
31/12/2021
Video surveillance – Non-compliance with the principle of data minimization (disproportionate field of vision) – Insufficient information of the persons concerned.
To know more
Deliberation No. 44FR/2021 of November 9, 2021 – fine
(PDF - 619 KB)
Last update 01/18/2022
31/12/2021
Video surveillance – Non-compliance with the principle of data minimization (disproportionate field of vision) – Insufficient information of the persons concerned.
