CPDP (Bulgaria) - PPN-01-462/15.06.2021

CPDP - PPN-01-462/15.06.2021
Authority:	CPDP (Bulgaria)
Jurisdiction:	Bulgaria
Relevant Law:	Article 6(1)(f) GDPR Article 32 Law on Property
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	26.01.2023
Published:
Fine:	n/a
Parties:	T.P. P.A.
National Case Number/Name:	PPN-01-462/15.06.2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Bulgarian
Original Source:	CPDP (in BG)
Initial Contributor:	wp

The CPDP found the protection of family and property of property’s owner to form legitimate interest justifying CCTV-related data processing.

English Summary

Facts

A data subject (P.A.) filed a compliant within the CPDP, claiming his brother (T.P.) unlawfully processed personal data of him and his family via video surveillance installed on a property co-owned by P.A. and T.P.

The property consisted of three-level building and yard. T.P. owned first and second floor of the building and 2/3 of the yard. Mother of T.P. and data subject had a right to usufruct the second floor and lived there. The third floor belonged to the data subject but it was his daughter who mostly lived there that time.

Three cameras were installed on property, covering only the image of the property, i.e.:

• access to the entrance of the house from inside,
• a staircase leading to the first floor,
• the entrance to T.P.’s apartment,
• a part of the yard and patio,
• a corridor which gave access to three rooms in the basement.

No camera covered the second and third floor of the building.

The cameras were connected with a recorder and a router. The recorded videos were stored locally for 2-3 days period and were automatically deleted. T.P. and his wife were using a mobile app to monitor the area and preview recordings. Within the property, there were signs (stickers) warning about the CCTV.

During CPDP inspection, another camera located on the outer fence was discovered. According to T.P. It was installed by P.A. It was confirmed that camera was not working, since it was disconnected from electricity.

The proceedings confirmed T.P. and data subject were in conflict. T.P. explained he installed the video surveillance because of aggressive behavior and committed acts of vandalism by data subject and his ex-wife. Hence, the data processing was based on Article 6(1)(f) GDPR.

Holding

The CPDP rejected the compliant.

At the beginning, the CPDP confirmed CCTV video footage was a personal data within the meaning of Article 4(2) GDPR; found T.P. was a data controller and excluded the application of exception of purely personal or household activity of Article 2(2)(c) GDPR.

The CPDP held T.P. was entitled to install the CCTV within the property. He did not need a consent of the data subject. According to Article 32 of the Law on Property, if a co-owner owned more than a half of the property, they did not need the consent of other co-owners for installing the CCTV.

Regarding the legality of data processing, the CPDP found Article 6(1)(f) GDPR to be a proper legal basis for CCTV-related data processing. In case at hand, T.P. had a legitimate interest of protecting his family and property from data subject improper conduct. However, the CCTV served to protect not only the legitimate interest of T.P. but also his child, who could be affected by unlawful actions of data subject. Still, aforementioned legitimate interest fulfilled the prerequisites of Article 6(1)(f) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.

Decision on appeal with reg. No. PPN-01-462/15.06.2021 DECISION No. PPN-01-462/2021 Sofia, 26.01.2023 The Commission for the Protection of Personal Data (CPDP) in composition: chairman: Vencislav Karadzov and members: Tsanko Tsolov, Maria Mateva and Veselin Tselkov at a meeting held on 14.09.2022, on the basis of art. 10, paragraph 1 of the Law on Protection of personal data, respectively Art. 57, §1, letter "e" of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016. on the protection of natural persons in connection with the processing of personal data and on the free movement of such data (Regulation, GDPR), examined the merits of complaint No.PPN-01-462/15.06.2021 filed by P.A. The administrative proceedings are in accordance with Article 38 of the Personal Data Protection Act (PDPA). The Commission for the Protection of Personal Data was referred to a request submitted by P.A. complaint No.PPN-01-462/15.06.2021, with allegations of illegal processing of personal data, in the hypothesis of his brother T.P. video surveillance in jointly owned property located in the city of Sofia, addr. ***. He claims that the video surveillance is carried out by means of 3 cameras installed in the common parts of the property, located in the basement, yard and staircase. He asks the commission to investigate the case and stop the video surveillance, which he claims is carried out against his will and in violation of his personal integrity and that of his family members – daughter and wife, with whom he lives at the address. No evidence was attached to the complaint. According to the principles of equality of the parties in the proceedings and truthfulness, T.P. has been notified of the filed complaint, being given the opportunity to submit a written statement and relevant evidence. In response, opinion PPN-01-462#5/04.03.2022 was expressed. for groundlessness of the appeal with attached relevant evidence. Mr. T.P. informs that he is the owner of the first and second floors of the three-story residential building, as well as 2/3 ideal parts of the yard. He adds that the applicant's daughter lives on the third floor, and the latter lives in the town of B. and visits the property periodically, but does not live there. He cites acts of vandalism in the property, aggressive behavior and threats by the applicant and his ex-wife H.F. as the reason for installing the video surveillance. He claims that the applicant and his ex-wife are endangering the safety of his family, including his minor son, and damaging his property, circumstances about which have been referred to the competent authorities - 01 RU-SDVR with a complaint ent. No.*** and SRP with a complaint with entry No.*****. In order to clarify the case from a factual point of view, an inspection was carried out on the subject of the complaint, the results of which are objectified in Constitutive act PPN-02-201/05.04.2022, with annexes to it, including the Constitutive protocol of 11.11.2021, graphical representations of the location and range of the cameras and a completed questionnaire. The inspection opened on 24.02.2022. at the address specified in the complaint, with the delivery of the inspection order to T.P., who cooperated and ensured access and collection of evidence by the inspection team. B.P., wife of Mr. T.P., was also present at the inspection. From the inspection, the following was established: At the address indicated in the complaint, there is a property - a yard with a three-story family house built in it with one entrance and a shed. T.P. informs the inspection team that he is the owner of the 1st and 2nd floors of the house and 2/3 of the yard. Mr. T.P. together with his family he lives on the 1st floor, and the 2nd floor is used by his mother. The third floor of the house is owned by his brother - P.A., and his daughter currently lives there. By letter with №№PPN-01-462#5/04.03.2022 by T.P. informs that from the end of June 2021 his brother (P.A.) lives in the city of B., and his ex-wife – in the city of Sofia, address ***2, both of whom periodically visit the property at the address: Sofia, addr. ***. The inspection team was informed that due to repeated encroachments on the property and vandalism by the A family, in July 2021, Mr. T.P. has installed a video surveillance system consisting of 3 pcs. video cameras, recording device, router, mobile application, and the personal mobile phones of Mr. T.P. are used to monitor the output image and recordings from the cameras. and his wife. The video surveillance system was installed by an acquaintance of P.'s family. The site is not guarded by any other physical/legal person in accordance with the Law on Private Security Activities, who has access rights to the video surveillance system. The video surveillance system allows monitoring the output image from the cameras in "real time" mode and recording the output image when moving within the range of the cameras. The records are stored for a period of 2-3 days, after which they are deleted in the order in which they are received. The installed video surveillance system allows remote access (including maintenance and settings) through a software application installed on Mr. T.P.'s phones. and his wife Mrs. P. The installed video surveillance system does not allow transmission and recording of sound. CCTV cameras allow night operation. There is no transmission and recording of snapshots and video frames from the image to a remote device (FTP/Cloud server, E-mail or other data storage location). The video surveillance system allows identification of natural persons. The video surveillance system does not allow facial recognition of individuals (by accessing a database). The inspection team found that the video cameras were located and had a video surveillance and recording scope as follows: Camera #1 is installed inside the house above the front door of the apartment on the 1st floor, and its surveillance range includes the approach to the entrance of the house from the inside, landing on the 1st floor, the entrance to the apartment of Mr. T.P. and part of the staircase. Camera No. 2 is mounted on the back of the house on the 1st floor window facade and is directed towards the courtyard, with a part of the house facade on the 1st floor and the courtyard within its range of observation. Camera No. 3 is installed inside a basement corridor, and within its surveillance range falls a corridor and access to 3 rooms in the basement. The checking team found that on the outside of the entrance doors of the apartment and the basement, as well as under the external camera, there were informational stickers warning about the video surveillance being carried out. The checking team also found the presence of another camera, which according to Mr. T.P.'s information. the same was installed by P.A. The camera is mounted on the outer fence facing the entrance of the house. Apparently the camera is not working and is not connected to electrical power. In the course of the proceedings, the applicant submitted a certified copy of: declarations from M.P., A.A. and H.F., a certificate of current address issued by the Capital Municipality, a certificate of identity of a person with different names issued by the Capital Municipality, a notarial deed for the purchase and sale of real estate and a Transcript of the Inventory Protocol of the Sofia District Court. The Commission for the Protection of Personal Data is an independent state body that protects individuals in the processing of their personal data and access to such data, as well as control of compliance with the GDPR and Regulation (EU) 2016/679 of the European Parliament and of the Council from April 27, 2016. on the protection of natural persons in connection with the processing of personal data and on the free movement of such data. In order to exercise its powers, the commission must be validly referred. Appeal PPN-01-462/15.06.2021 contains the required details, namely: there are data on the complainant, the nature of the request, date and passively legitimized party, considering that the complaint is regular. The subject of the complaint are allegations of unlawful video surveillance in a co-owned property located in the city of Sofia, addr. ***. According to the legal concept "Video surveillance" is a technical form of processing and storage of personal data within the period stipulated by the law, carried out in compliance with the requirements for the protection of personal data, including filming of persons in a guarded object and recording of the received data. The information contained in video recordings of surveillance devices about the natural person as a whole - image, daily habits, behavioral reactions and social contacts - fall within the scope of the concept of personal data, since the person can be identified in an indisputable way. The collection and storage of personal data is a form of processing within the meaning of Article 4, §1, item 2 of Regulation (EU) 2016/679 and as such should be carried out in compliance with the provisions of the GDPR and the Regulation. The same applies to "monitoring control" - a limited form of video surveillance - monitoring with technical means, without the possibility of recording the received data, in the sense of §1, item 6 of the DR of the ZCHOH. The judicial practice and the practice of the CPLD are constant , that the video surveillance is continuous and is not a one-time act of personal data processing. The complaint was filed within the time limit under Article 38 of the Labor Code by a natural person with a legal interest against a passively legitimized party - a natural person T.P., who is claimed to be, and the commission, upon inspection, found that he has the status of a personal data administrator in the sense of Article 4, paragraph 7 EU Regulation 2016/679, insofar as it determines the purposes and means of processing personal data through video surveillance. In the course of the inspection, it was established that, in addition to the passively legitimized party, his wife B.P. had access to the video surveillance, in view of which she should participate in the proceedings as a responsible, ex officio constituted party. , which, pursuant to its powers under Article 10, paragraph 1 of the LLDP in connection with Article 57, §1, letter "f" of Regulation (EU) 2016/679, examines complaints against acts and actions of personal data administrators, which violate the rights of data subjects related to the processing of personal data, as the exceptions under Art. 2, §2, letter "c" and Art. 55, §3 of Regulation (EU) 2016/679 are not present given the circumstance that the case does not concern processing activities carried out by an individual in the course of purely personal or domestic activities and/or activities carried out by the courts in the performance of their judicial functions.  For the above reasons and given the absence of the negative prerequisites specified in art. 27, para. 2 of the APC, held on 11.05.2022. meeting of the CPLD, the complaint was accepted as admissible and the following parties were constituted as parties to the proceedings: complainant – P.A. and defendant parties – T.P., a passively legitimized party and B.P., an ex officio constituted party. An open hearing is scheduled to consider the merits of the appeal on 29.06.2022. from 13.00 hours. The parties are regularly notified of the meeting, they are instructed on the distribution of the burden of proof in the process, they are informed of the official inspection carried out in the case, and a certified copy of the report of the inspection has been sent to them for review and opinion. There were no objections to the findings. In response, Mr. T.P. submitted written statements on the subject of the dispute with attached evidence, including declarations by persons not participating in the proceedings, L.P. and D.P. and certificates of current address of B.P. and her son. Additionally, Mr. T.P. makes allegations of aggravated interpersonal problems, including in relation to expenses incurred by him for garbage collection, repairs to the building and others, which were not paid for by the complainant. He also made allegations of hooliganism by the applicant towards his family members, including pouring a bucket of water on his wife from the balcony on the third floor on 15.05.2019, pouring a bucket of dirty soapy water on the third floor balcony of the mother-in-law of Mr. - n T.P. – S.P., on 06.05.2022. He claims that the applicant with his ex-wife H.F. letters addressed to him stolen from his mailbox. Informs that H.F. is a conflicted person, with vulgar language, who has been "dealing with slander, complaints and street cats for many years". Separately, Mr. T.P. informs about complaints filed by him in 01 RU-SDVR and Sofia District Prosecutor's Office against P.A. and H.F. for damage to his property and self-governing actions, which ended with a Decree on refusal to initiate pre-trial proceedings No.*****. Adds to the case against H.F. and A.A. pre-trial proceedings in the SRS. In a statement, the applicant, Mr. P.A. also informs about deteriorated relations between the parties, caused by domestic issues related to actions carried out by Mr. T.P. renovation works "accompanied by a lot of noise", self-management in the property, including - removed by Mr. T.P. an old stone fountain in the yard, installed by their grandfather, made by Mr. T.P. remarks regarding H.F. and A.A. regarding a bicycle parked in the common parts of the building – stairwell and a car parked in front of the house and others. He adds that due to the ongoing harassment H.F. filed a defamation case against T.P. and B.P. He claims he and his family feel "followed, like illegal immigrants in their own home." He adds that his mother M.P. also does not agree with the video surveillance implemented at the address. In the course of the proceedings, a request PPN-01-462#21/15.06.2022 was filed. by M.P., A.A. and H.F. for their constitution as complainants in the proceedings insofar as they live at the address where the video surveillance is carried out and are the subject of the same. The individuals state that they are adamantly opposed to video surveillance and claim that the defendants are constantly monitoring the cameras and monitoring their entry and exit from the apartment building. They express doubt that the defendants "distribute footage from the cameras on the Internet, and it is not known who else has access to the video surveillance. " As of the date of the deposited request, the administrative proceedings have not ended, therefore there is no obstacle M.P., A.A. and H.F. to be constituted as appellants in the same, especially since the evidence attached to the file testifies to the existence of a legal interest of the persons to participate in the proceedings, as far as M.P. is the user of part of the trial property, A.A. lives in part of the property, and H.F. there is a registration at the current address in the property where the video surveillance takes place. For the stated reasons, with a decision made on 29.06.2022. meeting of CPLD M.P., A.A. and H.F. are constituted as party-complainants in the proceedings. An open hearing is scheduled to consider the merits of the appeal on 14.09.2022. from 1:00 p.m., of which the parties are regularly notified. By letter PPN-01-462#29/15.08.2022. Mrs. B.P. informed the commission about domestic conflict situations between the parties, including those sent by H.F. threats, insults, "mental harassment", "indirect physical self-harm", which are not within the competence of the CPLD. An evidentiary request was also made for admission to interrogation of D.P. as a witness to the conflictual relations between the parties. On held on 14.09.2022. meeting of the commission, the complaint was examined on its merits. The applicants P.A., M.P., H.F. and A.A. – regularly notified, do not appear or represent themselves at the meeting before the commission. The defendant T.P. – regularly notified, does not appear; is represented by B.P. with a power of attorney on file. The respondent B.P. appears in person and contests the appeal. It does not point to new evidence, there are no requests regarding the evidence, it does not support the request for admission to the questioning of D.P., due to the person's illness. In essence, he finds the complaint groundless and asks the commission to disregard it. She clarifies that the cameras serve only to protect her property from intentional damage and vandalism, in connection with which three complaints have been filed with the police and two with the prosecutor's office. The first appeal to the First RU-SDVR with entry №***t 1.03.2022, Sofia District Prosecutor's Office with entry No.*** dated 2.03.2022. on the occasion of breaking a cartridge in one of the basements and pulling out a sewer pipe located in the common parts of the basements, connecting our bathroom to the common sewer pipe; laying of mineral plaster on the common landing; dismantling of the camera stand above the front door from the PA; prying off baseboards to exterior insulation, tearing rubber seal to exterior sink, flat tire on car, filling car gas cap latch with glue, threats on viber by PA, opening front door to house through the night by H.F.; one of the cameras being sprayed with spray by HF, rocks being thrown at it by HF. and a verbal threat to fight by A.A. The second complaint in the First RU-SDVR is from 06.06.2022. with entrance No.*** is about the deliberate pouring of buckets of water from the balcony on the third floor of P.A. The third complaint in First RU-SDVR was filed on 13.06.2022. with entrance №*** and is on the occasion of self-governing actions of P.A. in connection with the replacement of the cartridge on the door of the second floor, which is not his property. Mrs. P. claims that after the cameras were installed, the cases of vandalism stopped. He believes that the aim of the applicants is to remove the cameras so that they can again damage the personal property of the P. family located in the common common parts of the property. It specifies that there is no filming of public areas, and the video surveillance takes place within the administrator's property and is necessary for the purposes of the administrator's legitimate interest in protecting property and property under Article 6, §1, letter "f" of the Regulation. She says that the other important motive for the video surveillance is to ensure the safety of her minor son as a result of the aggressive behavior of the A. family, specifying that they live in constant stress and fear of physical self-harm by P.A. and his ex-wife H.F. and asks the commission not to order the removal of the cameras, which are only in place for the purpose of prevention and protection. In its capacity as an administrative body and in connection with the need to establish the truth of the case, as a basic principle in the administrative proceedings, according to Art. 7 of the APC, requiring the presence of established actual facts and given the evidence collected and the allegations made, the commission accepts that considered in essence, complaint PPN-01-462/15.06.2021 is unfounded. The subject of the complaint are allegations of unlawful video surveillance in a jointly owned property located in the city of Sofia, addr. ***. From the evidence collected in the case file, it was established, and it is not disputed between the parties in the proceedings, that there is a piece of land at the indicated address - a yard with a three-story family house built in it, with one entrance, and a shed. It is not disputed, and it is evident from the copies of ownership deeds attached to the file, that the property is in co-ownership mode. The defendant - T.P. is the owner of the 1st and 2nd floors of the house and 2/3 of the yard. The third floor of the house is owned by his brother - P.A., the complainant in the proceedings. M.P., mother of P.A. and T.T.P., have established a lifetime and gratuitous right of use, on the 2nd floor of the house. The evidence in the case file testifies to complicated conflict relations between the parties at the household level, the resolution of which is not within the competence of the CPLD. There are also numerous complaints to the authorities of the Ministry of Internal Affairs and the Prosecutor's Office. From an on-site inspection, it was established that a video surveillance system consisting of 3 units was built and functioning in the property. video cameras, recording device, router, mobile application, and the personal mobile phones of Mr. T.P. are used to monitor the output image and recordings from the cameras. and B.P. Common parts of the shared property are covered by video surveillance - the approach to the entrance of the house from the inside, the landing on the 1st floor, the entrance to the apartment of Mr. T.P. and part of the staircase, corridor and steps to 3 rooms in the basement, part of the facade of the house on the 1st floor and the inner courtyard. The property of the complainant, floor 3 of the building, does not fall under the scope of video surveillance, and the same applies to the apartment used by M.P. second floor of the house. It is indisputable that the video surveillance was carried out without the consent of the applicants. The same, however, is legal, according to an argument from Article 32 of the Law on Property, insofar as the disposal of property, including video surveillance, is admissible after a decision of co-owners owning more than half of the common property, as the defendant T.P. owns in relation to the monitored property, namely 2/3 of the same. In this regard and insofar as the conditions for the legality of the processing are alternatively listed in Article 6, §1 of the GDPR, video surveillance in the property is possible and lawful and without the consent of the subjects of data in the hypothesis of Article 6, §1, letter "e" of the GDPR, the presence of a legitimate interest of the controller or of a third party, taking priority over the interest of the subject of the data subject subject to video surveillance.
A conflict of interest was established on the part of one of the co-owners, the appellant P.A., who has a minority share. According to the file, it is indisputable that the property is not in condominium mode and due to the predominant share of one of the co-owners – the defendant T.P., he can make decisions to dispose of the property, as it is according to the Law on Property. After being able to dispose, he can also take decisions on actions to protect this thing, such as its security through video surveillance and processing of information through this video surveillance, including personal data. In the specific case, he should not ask permission and/or consent from the owner with a minority share. The circumstances that the appellants visit and use the property are irrelevant and cannot change the fact of who disposes of the property itself and makes appropriate decisions for its protection. This is not the minority owner, but the owner with a larger majority share, who, in accordance with the principle of transparency and good faith, has also put up information signs about the video surveillance being carried out, i.e. there is information about how the property is guarded, so external visitors should comply with this information and be considered informed that their personal data will be processed within the range of the cameras.
The Commission shares the concerns of the respondent, as a mother, for the safety of her minor son and the responsibility that every parent has in terms of providing a safe and secure environment for raising children, in view of their, and the parents', mental and physical health and peace of mind . In this regard, it accepts that in the conditions of complicated conflict relations with the applicants and signs of self-harm and vandalism, the video surveillance of common parts of the property is to protect the legitimate interest of the child.
In the hypothesis of Art. 6, §1, letter "e" of the GDPR, the processing of personal data through the established video surveillance system is necessary for the purposes of the legitimate interest of the controller and a third party, for the protection of the controller's property and physical and mental health of his minor child, interests that take precedence over the interest of the data subject subject to video surveillance, insofar as the life and health of persons, even more so of children, of adolescents, are the highest value and priority not only of their relatives, but also of society generally. In this particular case, the rights of the persons subject to video surveillance should be limited, especially since with their behavior and unlawful actions they provoked the video surveillance to be carried out for the purpose of protection and prevention from subsequent acts of self-harm and vandalism. In this regard, the commission finds the complaint groundless and the video surveillance admissible, limited to what is necessary in connection with the protection of the administrator's property and the health of his child and proportionately to achieve the claimed preventive security goal.
Guided by the above and on the basis of Article 38, Paragraph 3 of the Personal Data Protection Act, the Commission for the Protection of Personal Data,
RESOLVE:
Announces complaint No. PPN-01-462/15.06.2021. for unfounded.
The decision is subject to appeal within 14 days of its delivery, through the Commission for the Protection of Personal Data before the Administrative Court of Sofia - city.
	CHAIRMAN: MEMBERS:
	Vencislav Karadjov /p/ Tsanko Tsolov /p/
		Maria Mateva /p/
		Veselin Tselkov /p/