NAIH (Hungary) - NAIH/2020/2729/15

NAIH - NAIH/2020/2729/15
Authority:	NAIH (Hungary)
Jurisdiction:	Hungary
Relevant Law:	Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 13(1) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	14.12.2020
Published:	16.12.2020
Fine:	700.000 HUF
Parties:	n/a
National Case Number/Name:	NAIH/2020/2729/15
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Hungarian
Original Source:	NAIH (Hungary) (in HU)
Initial Contributor:	n/a

The Hungarian DPA fined a construction company for excessive monitoring of property which allowed for surveillance of employees without their knowledge.

English Summary

Facts

A construction company had installed a video surveillance system on a construction site to protect the property and the physical integrity of employees. However, cameras partially captured a social room and activities of the employees. They had not been sufficiently informed about that while signing a contract, having knowledge only about the video system monitoring the property.

Dispute

Is a video surveillance system that partially captures activities of employees without their knowledge compliant with Article 5 GDPR?

Holding

The DPA concluded that the video surveillance system introduced by the company was unreasonable and that it failed to provide sufficient information about collection of personal data from its employees. The company was fined 700.000 HUF and instructed to change the angle of view of the camera so that it doesn't monitor workers' activities.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.

Case number: NAIH / 2020/2729/15 Subject: Decision on request
                                                                    data protection authority
Clerk: pending




                                        H A T Á R O Z A T



The National Authority for Data Protection and Freedom of Information (hereinafter referred to as the Authority) with […]
([…]) (Hereinafter referred to as the “Applicant”) against […] (hereinafter referred to as the “Applicant”)
hereinafter referred to as "the request"), the processing of personal data by natural persons
the free movement of such data and Directive 95/46 / EC
Regulation (EU) 2016/679 repealing Directive (hereinafter referred to as General

alleged breach of obligations by the Applicant
in the data protection authority proceedings initiated by the Authority on 24 March 2020 a
The applicant grants his application and

1. Notes that


    the. the Applicant has infringed Article 5 (b) and (c) of the General Data Protection Regulation
       (‘Purpose-based’ and ‘data-saving’) when the establishment of a site under [...] […]
       He set the angle of view of the camera in his room called
       to monitor only the area justified for the protection of persons and property, but also the

       it was also suitable for observing short administrative workers.

    b. The Applicant infringed Article 13 (1) of the General Data Protection Regulation,
       when its employees working at its site under […] are employed from 18 November 2019 to 2020.
       in the period between 3 April was not properly informed by the camera data processing taking place there

       circumstances.

2. Instructs the Applicant to ensure that the equipment installed in the premises of […]
    change the angle of view of the camera so that it is not suitable for workers
    unreasonable monitoring and be consistent with the personnel and

    for the purpose of protecting property.

3. for the above infringements, 30. From the date on which this Decision became final
    within a day


                                  700,000 HUF, ie seven hundred thousand HUF

                              order to pay a data protection fine;

4. order the final decision of the Applicant and the Applicant's identification data

    (anonymisation).

The fine is the Authority's forint collection account for the collection of centralized revenues
(10032000-01040425-00000000 Centralized direct debit account IBAN: HU83 1003 2000 0104




…………………………………………………………………………………………………………………………………… ………………………………….
1055 Budapest Tel .: +36 1 391-1400 ugyfelszolgalat@naih.hu
Falk Miksa utca 9-11. Fax: +36 1 391-1410 www.naih.hu0425 0000 0000) must be paid by bank transfer. When transferring the amount, NAIH / 2020/2729
JUDGE. should be referred to.

If the debtor fails to meet his obligation to pay the fine within the time limit,
is required to pay a late payment allowance. The rate of default interest is the statutory interest, which is a
the central bank base rate valid on the first day of the calendar half-year affected by the delay. THE
the Authority's centralized revenue collection forint account

(10032000-01040425-00000000 Centralized direct debit account).

Failure to comply with the notice under point 2 and the fine and penalty for late payment under point 3
in the event of non-payment, the Authority shall order enforcement of the decision, the fine and the penalty payment.

In view of the fact that the Authority exceeded the administrative deadline, it was HUF 10,000, ie HUF ten thousand
pay the Applicant, at his / her choice, by bank transfer or postal order.


There is no administrative appeal against this decision, but it has been available since its notification
Within 30 days of the application addressed to the Metropolitan Court in an administrative lawsuit
can be challenged. The emergency does not affect the time limit for bringing an action. The application to the Authority
shall be submitted electronically, which shall forward it to the court together with the case file. The trial
The application for maintenance must be indicated in the application. During the emergency, the court is hearing
acting outside. For those who do not receive a full personal exemption from judicial review

the fee of the procedure is HUF 30,000, the lawsuit is subject to the right to record material fees. Before the Metropolitan Court
legal representation is mandatory in proceedings.

                                         EXPLANATORY STATEMENT

I. Background, clarification of the facts


       the. Content of the request received by the Authority

The Applicant submitted an application to the Authority by e-mail dated 15 March 2020,
supplemented the following day, 16 March 2020. In the application, it stated that the Applicant […]
Based on its own experience, a camera system for property protection purposes was installed at the site below
for monitoring workers' work and rest periods, and
are also used to control According to the Applicant, among other things, this observation

nor did he receive sufficient information about the purpose and legal basis of the
worked at the site. He did not receive any information about the cameras at the site yet
no warnings were posted either.

Applicant is an official procedure in connection with the above - in his opinion, illegal conduct
requested the Authority to conduct it.

The application did not contain a statement from the Applicant as to the identity of the Authority

whether to investigate the data controller's activities of the Requested. Furthermore, the
were not attached to the application by the Applicant documenting the infringing situation
recorded recordings or other documents that may be used in the course of evidence, and not
the content and form of the instruction of the superior acting on behalf of the Applicant was precisely described. THE
In view of the above, the Authority called on the Applicant to rectify the deficiencies, which he did in March 2020
Replaced on the 24th.






                                                 2In connection with the application and its replacement, it can be stated that between the Applicant and the Applicant
On January 20, 2020, an employment contract was created to fill the position of “warehouse manager”. THE
The job description and the data management information were attached to the employment contract
Applicant submitted to the Authority.

General employees dated January 16, 2020, handed over upon signing the employment contract

a separate section in the data management information deals with the operation of the camera surveillance system.
According to this, the Applicant operates a camera surveillance system, which, however, is not used by the
primary and explicit monitoring of workers and their activities. The camera
surveillance only for the protection of human life, physical integrity, personal liberty, and
in the case of property protection. No cameras will be installed in rooms
where human dignity may be violated, in particular in changing rooms, washrooms, toilets and
in premises where the Applicant's employees take breaks between work. THE

the camera system stores the recorded images for 72 hours. The rules are only brief and
informs about the camera surveillance in general, it is not specifically under the Applicant […]
monitoring at its premises.

According to the Applicant, his duties included, inter alia, that the Applicant […]
the image transmitted by the camera system installed at the site for the protection of persons and property
check. Access to the camera system […], as directed by the fleet and logistics manager

received from the Applicant's IT department. Narration by the Applicant and by him by the cameras
According to photos attached from the transmitted images, the site was also used by employees for recreation
the so-called […] Was also camcordered. The Applicant received several verbal instructions from his superior
([…]) To monitor employees for the purpose of staying too much time in “[…]”. THE
According to the applicant, there was an employee who had too many stays in the rest area
moved to another area within the site. According to the applicant, upon entry
the cameras have been in operation for months.


In the application, based on the above, the Applicant requested that the Authority investigate the matter a
Applicant's unlawful conduct of camera data processing by employees
and the non-disclosure of the lack of information.

On the basis of the request and its supplement, the right to information self - determination and the
CXII of 2011 on freedom of information. Section 60 (1) of the Information Act (hereinafter: the Information Act)

data protection authority proceedings were initiated on 24 March 2020.

      b. Facts established during the data protection authority proceedings

1) In the case, the Authority issued NAIH / 2020/2729/6. to clarify the facts
called on the Applicant to make a statement and provide documents within the deadline
he did.


On the basis of the applicant's statement, it can be stated that it is for the purpose of personal and property protection
the operation of a camera system for new entrants as part of the entry process
informed. The text of the prospectus has already been attached to the application by the Applicant.
Applicant also informed the Authority that the prospectus for employees of the internal
can also be accessed at any time via an IT network.







                                                3According to the applicant's declaration, the site below […] has a dry matter storage activity
(high-value telecommunications and IT equipment, hardware, cables, wires, etc.), there
a total of 37 employees perform their activities. He applied for the camera system built here
security and property of buildings, equipment, technical articles,
protection of its valuables, preservation of their value and condition, and staying in the monitored area
protection and insurance of the life, physical integrity and property of persons
prevention of infringements, detection of detected infringements, official or judicial

installed and operated for the purpose of

There has been an employer instruction on the installation and use of the cameras operated by the Applicant
issued on March 24, 2020, which was emailed to employees working in the field
information on 3 April 2020. The email includes a link to the camera surveillance system
issued on 24 March 2020. The rules
applies generally to cameras operated by the Applicant and not only to […]

on site. The information e-mail was also addressed to all employees (from: […],
to: […]).

The purpose of the camera surveillance is applied to the security of buildings and property
protection, as well as personal protection objectives set out in the above detailed privacy policy
regulations. The legitimate interest of the Candidate was indicated as the legal basis for the observation. The
the balancing test required for data management based on the legitimate interests of the controller a

contained in separate regulations. Article 3.2 of the Regulations can not install a camera such
premises or from a viewing angle that allows employees to spend their working time
and it is forbidden to place a camera in a locker room, toilet or shower
and in all places where visual observation would be a violation of human dignity.

Candidate attached to his response the camera placed in the areas monitored by the affected person
information (which is annexed to the detailed rules of procedure) and the […]

installation diagram for on-site cameras.

According to the applicant's statement, the cameras operating at the […] site are not present at the workplace
or to monitor the intensity of work, but for the purpose of protecting property
installed them. No observation is made in rooms that are staffed
they are used to relax. Applicant sent a list of cameras installed at the site as well
snapshots showing the viewing angle of the cameras. The cameras do not record sound, a

images are stored for up to 30 days.

According to the Applicant's statement, a room called […] was also referred to by the Applicant
watching camera. The purpose of installing this camera is to protect property, as there are high-value small machines,
tools and parts are stored. The room in addition to short-term administration
tasks are also performed (for example, publishing warehouse material, receipt by computer
documentation), continuous employee presence, but constant performance of tasks in this
not in room. Based on the submitted camera image for storage in the room

shelves, cabinets, as well as a desk with computer and printer and several office swivel chairs
can be served:

[…]








                                                4The camera image sent is the same as the camera image attached by the Applicant for the room and
with regard to the angle of view, with the difference that in the case of recruitment of the Applicant there are more
employee is also visible.

For images transmitted by on - site cameras in the Privacy Policy 1

can be accessed by employees in a specific breakdown. To learn about camera images
general manager, HR manager, security manager, network operation center (NOC)
team leader and staff performing 0-24 hour dispatching tasks are eligible. A given
area (eg the […] site in question) cameras, the logistics manager, the logistics manager
team leader and warehouse manager are entitled to get to know the camera images. Additional authority

may be issued in consultation with the security manager.

2) In the case, the Authority issued NAIH / 2020/2729/8. to clarify the facts
called on the Applicant to make a statement and provide documents within the deadline
he did.


At the Authority's request, the applicant stated that it had not received any complaints from the […] site
camera system.

The camera system is called Its “trial operation” began on the 18th of November 2019 at the site. THE
Development of a specific privacy policy for camera surveillance
based at the time “was already in progress” for its issuance and email to employees

finally, as referred to in the Applicant's previous statement, on 3 April 2020
took place.

Logging access to camera images Requested with […] central video server
performs. The following access data is logged: time,
user ID, user IP address, user type, event, server name,

event information, event supplementary information. The log data requested by the person and
CXXXIII of 2005 on the rules of property protection and private investigation.
22/2006 on the implementation of Act (IV. 25.) Decree of the Ministry of the Interior with reference to Section 10 (2)
Store for 30 days.

The applicant also stated that the room […] at the […] site was not

a room set aside for employees to spend their working time. Its basic function is a warehouse,
and short-term administrative tasks are performed there. It is permanent in the room
tasks are not performed by employees.

3) In the case, the Authority issued NAIH / 2020/2729/10. to clarify the facts

called on the Applicant to make a statement and provide documents within the deadline
he did.

At the request of the Authority, the applicant stated that the installation of the camera system at the […] site
after, from November 18, 2018, it was immediately suitable for image capture, so in this respect
there was no difference between its “live” and “test run” in terms of data management.



1
 Requested NAIH / 2020/2729/7. Annex 3, point 12, to its reply






                                                 5The system was professionally reviewed on 6 April 2020 due to an internal coordination problem
line, during which it was found that the constructed configuration is supplemented in several respects
and needs to be changed, but not until the Authority has completed its procedure
changes Requested, it is still in its original condition on the site.

Information on the "trial operation" of the camera system and the start of the related data management
was not posted to workers. Information on the operation of the system in 2020.

was sent to the employees by e-mail on April 3, as already requested
he also referred in his previous answers.

      c. A NAIH / 2020/2007. in an investigation procedure on the same subject
          established and merging cases

In addition to the Applicant's request, he was further affected by an e-mail dated 22 February 2020 to the Authority

A complaint was also received in which the complainant described that the Applicant […]
worked at his site and was not familiar with data management when his employee entered
regulations regarding the camera surveillance system and was not available at the site
posting warning and information on camera surveillance. The complainant also described
that a resting space was also observed by the cameras.

As in this case the complainant did not consent to the disclosure of the identity of the complainant

therefore, in this case the Authority initiated an investigation procedure against Infotv. § 52
based on NAIH / 2020/2007. case number.

The Authority's NAIH / 2020/2007/4. Applicant also sent the 2020.
the employer's instructions dated 24 March 2020 and the e-mail dated 3 April 2020
on the availability of the data protection rules for camera data management, which are already the subject of this decision
I./.b./1). It is also requested as the legal basis and purpose of data processing

indicated references in official procedure NAIH / 2020/2729. Requested
also sent a drawing of the installation of the cameras and the images they transmitted, which are the same
with the sender in the present official proceedings.

By activating the camera surveillance system and starting data management
In this case, the Applicant also indicated the date of 18 November 2019 as
Start of “trial run”.


Given that the complaint is complained about by the camera surveillance system is data protection
was a data protection authority procedure with the same content
ongoing NAIH / 2020/2729. The Authority therefore decided in case NAIH / 2020/2007 No.
concluded the investigation procedure on 16 July 2020 and the findings set out therein are hereinafter referred to as
It was further examined ex officio in case NAIH / 2020/2729. On the joinder of cases a
Authority Applicant NAIH / 2020/2729/11. notified under document number dated 16 July 2020.


II. Applicable legal provisions

CL of 2016 on General Administrative Procedure. Section 99 of the Act (hereinafter: the Act)
the authority, within the limits of its competence, monitors the provisions of the law
compliance with the provisions of this Regulation and with the provisions of the enforceable decision.







                                               6Based in accordance with Article 2 (1) of the General Data Protection Regulation
the general data protection regulation applies to data processing.

According to Article 4 (1) of the General Data Protection Regulation, "personal data" means identified or
any information relating to an identifiable natural person ("data subject"); identifiable by a
a natural person who, directly or indirectly, in particular by an identifier, e.g.
name, number, location data, online identifier or physical, physiological,

genetic, intellectual, economic, cultural or social identity
identifiable by a factor.

According to Article 4 (2) of the General Data Protection Regulation, "processing" means personal data
or any operation on data files, whether automated or non - automated; or
a set of operations, such as collecting, recording, organizing, sorting, storing, transforming, or
change, query, view, use, transmit, distribute or otherwise

harmonization, interconnection, restriction, deletion,
or destruction.

Personal data pursuant to Article 5 (1) (b) of the General Data Protection Regulation
collected only for specified, explicit and legitimate purposes and not processed
in a way incompatible with those objectives; not in accordance with Article 89 (1)
considered incompatible with the original purpose for the purpose of archiving in the public interest, scientific

and further processing for historical research or statistical purposes (‘for
constraint ”).

Pursuant to Article 5 (1) (c) of the General Data Protection Regulation, personal data are:
they must be appropriate and relevant to the purposes of the data processing, and
should be limited to what is necessary (‘data saving’).


Pursuant to Article 5 (2) of the General Data Protection Regulation, the controller is responsible for
and be able to comply with the principles set out in
(‘accountability’).

According to Article 6 (1) (f) of the General Data Protection Regulation, personal data
is lawful only if and to the extent that at least one of the following is met:
data processing in order to enforce the legitimate interests of the controller or a third party

necessary, unless those interests take precedence over those interests
or fundamental rights and freedoms which require the protection of personal data,
especially if the child is affected.

Pursuant to Article 13 of the General Data Protection Regulation
If personal data concerning the data subject are collected from the data subject, the controller shall:
at the time of obtaining personal data, make the following available to the data subject
all information:

(a) the identity and contact details of the controller and, if any, of the controller 's representative;
(b) the contact details of the Data Protection Officer, if any;
(c) the purpose of the intended processing of the personal data and the legal basis for the processing;
(d) in the case of processing based on Article 6 (1) (f), the controller or a third party
  legitimate interests of a party;
(e) where applicable, the recipients or categories of recipients of the personal data, if any;






                                                 7f) where applicable, the fact that the controller is a third country or international organization
 personal data to the Commission and the Commission for Compliance
 the existence or absence of a decision in accordance with Article 46, Article 47 or Article 49 (1).
 in the case of the transmission referred to in the second subparagraph of
 guarantees and the means of obtaining a copy thereof, or
 reference to their availability.
2. In addition to the information referred to in paragraph 1, the controller shall be the personal data

at the time of acquisition, in order to ensure fair and transparent data management
provide the data subject with the following additional information:
(a) the period for which the personal data will be stored or, if that is not possible, that period
  aspects of its definition;
(b) the data subject's right to request from the controller the personal data concerning him or her
  access to, rectification, erasure or restriction of the processing of data, and
  may object to the processing of such personal data and to the data portability concerned

  the right to
(c) information based on Article 6 (1) (a) or Article 9 (2) (a);
  in the case of data processing, the right to withdraw the consent at any time, which
  does not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal;
(d) the right to lodge a complaint to the supervisory authority;
(e) that the provision of personal data is required by law or by a contractual obligation
  based on or a precondition for concluding a contract and whether the person concerned has a personal obligation

  data and the possible consequences for them
  failure to provide data;
(f) the fact of automated decision-making referred to in Article 22 (1) and (4), including:
 profiling as well as, at least in these cases, the logic used and that
 understandable information on the significance of such data processing and on the data subject
 what the expected consequences are.


2005 on the rules for the protection of persons, property and private investigators
évi XCCCIII. Pursuant to Section 30 (3) of the Act (hereinafter: the Act), it is not applicable
an electronic surveillance system in a place where surveillance may violate human dignity,
in particular in changing rooms, changing rooms, washrooms, toilets, hospital rooms and social
in the residence of the institution.

Section 9 (2) of Act I of 2012 on the Labor Code (hereinafter: Mt.)

according to the employee's right to personality may be restricted if the restriction is an employment relationship
absolutely necessary and proportionate to the achievement of the objective. THE
the manner of restriction of the right to privacy, the expected duration of the conditions, and
the circumstances justifying the necessity and proportionality of the employee in writing in advance
be informed.

Mt. 11 / A. § (1), the employee's conduct related to the employment relationship
can be checked. In this context, the employer may also use a technical tool, of which the

inform the employee in writing in advance.

The Acre. Pursuant to Section 103 (1) of the Act on Proceedings
provisions of the Act. It shall apply with the exceptions provided for in Sections 103 and 104.








                                                8 Act CXII of 2011 on the right to information self-determination and freedom of information. law
(hereinafter: the Information Act) pursuant to Section 61 (1) (a), the Authority
in the context of the data processing operations set out in
may apply the legal consequences set out in the Data Protection Regulation.

Pursuant to Article 58 (2) (b) and (i) of the General Data Protection Regulation, the supervisory
the authority, acting in the corrective capacity of the authority, condemns the controller or processor if

breached the provisions of the Regulation or Article 83
impose an administrative fine accordingly, depending on the circumstances of the case
in addition to or instead of the measures referred to in Paragraph 2 of the same Article
(d), the supervisory authority, acting in its corrective capacity, shall instruct the controller
or the data processor to carry out its data processing operations, where appropriate in a specified manner and
within the time limit laid down in this Regulation.


The conditions for the imposition of an administrative fine are set out in Article 83 of the General Data Protection Regulation.
contained in Article. Infotv. 75 / A. § of the General Data Protection Regulation.
the powers set out in Article 2 (2) to (6), taking into account the principle of proportionality
in particular through legislation on the processing of personal data
or in a binding act of the European Union
to remedy the breach in the event of a breach of Article 58 of the General Data Protection Regulation
in particular by alerting the controller or processor.


The Acre. Pursuant to Section 104 (1) (a), the Authority shall act ex officio in its area of competence
initiate proceedings if he becomes aware of the circumstance giving rise to the proceedings;
under paragraph 3 of the same paragraph, the ex officio procedure is the first procedural act
starts on the day of the execution of the contract, the initiation of the notification to the known customer may be omitted if the
the authority shall take a decision within eight days of the initiation of the procedure.


    III. Decision

   the. Legal basis of the examined data management

According to the definition in Article 4 (1) of the General Data Protection Regulation, one
man's face, his image is considered personal data, the taking of the image as well as the data
and any operation carried out shall be considered as data processing within the meaning of Article 4 (2).


Given that the viewing angles of the cameras were designed to be observed
outside the premises and the property located there
workers are also monitored on the basis of documents sent to the Authority at the workplace
rules on camera surveillance should also be taken into account for the legality of the case
in connection with its judgment. In assessing this, the following labor law rules apply.

Pursuant to Section 42 (2) (a) of the Labor Code, the employee is obliged to do so on the basis of the employment contract

to perform work under the direction of the employer. In accordance with this, Section 52 (1) b) of the Mt.
and (c) defined as the employee’s basic duty that the employee
is obliged to be at the disposal of the employer during his working hours and his work is generally expected
expertise and diligence, rules, regulations, instructions and
performed as usual. In order to comply with these legal obligations, Mt. 11 / A. § (1)
provides for the possibility for the employer to involve the employee in the employment relationship






                                               9Check your related behavior. This right is necessarily accompanied

handling of personal data.


Data management related to employer control from the provisions of the Mt., employment
data management independent of the employee's contribution due to its nature. With your consent
In this context, it should be noted that its general data protection regulation
                          2
must be voluntary. In relation to voluntary contributions
however, established under Article 29 of the already repealed Data Protection Directive
Data Protection Working Party (hereinafter: Data Protection Working Party) in several resolutions

also explained that the volunteer in the employee-employer relationship is questionable
possibility of contribution. In the world of work, therefore, instead of the data subject 's consent, there is another legal basis,
the use of data management based on the legitimate interests of the employer is justified.


Article 6 (1) (f) of the General Data Protection Regulation under the legal basis of a legitimate interest
thus, personal data may be processed if the processing is carried out by the controller (or

third party), unless those interests
preceded by the right of data subjects to the protection of personal data.


It is important that the employer, as data controller, has a discretionary interest in invoking this legal basis
must perform. 6 Carrying out a balance of interests is a multi-step process in which

the legitimate interest of the controller, ie the employer, and the counterpoint to the weighting must be identified
the data subject, the employee, the fundamental right concerned, and finally on the basis of the weighting
it must be determined whether personal data can be processed. Where the balance of interests

as a result, it can be concluded that the employer’s legitimate interest precedes the employees
the right to the protection of personal data, a camera system can be operated.











2
 Article 4 (11) of the General Data Protection Regulation: ‘‘ consent of the data subject ’means the voluntary, specific and
a sufficiently informed and unambiguous statement giving the statement or confirmation concerned
by means of an unequivocally express act that he or she consents to the processing of personal data concerning him or her. "
3The Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data

Directive 95/46 / EC of the European Parliament and of the Council
4 Prior to the date of application of the General Data Protection Regulation, the Data Protection Working Party shall:
an independent European adviser on data protection and privacy issues

was replaced by the European Data Protection Board
5Article 6 (1) (f) of the General Data Protection Regulation: "The processing of personal data shall only take place if and to the extent that
lawful if at least one of the following is met: the processing is lawful by the controller or a third party

necessary to safeguard the interests of the person concerned, unless those interests take precedence over such interests
interests or fundamental rights and freedoms which necessitate the protection of personal data, in particular where
affected child. "
6 The Data Protection Working Party 6/2014 provides assistance in carrying out the interest balance. number, the data controller

Opinion on the concept of legitimate interests under Article 7 of Directive 95/46 / EC, in which the general
during the period of application of the Data Protection Regulation. The opinion can be obtained from the following link:
https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf







                                                      10From the "principle of accountability" under Article 5 (2) of the General Data Protection Regulation
however, as a result, the employer must prove that it uses electronic
monitoring system is compatible with the principle of purposeful data management and the balancing of interests
its outcome resulted in the primacy of the legitimate interest of the controller. This is a requirement
designates the framework for the purpose of an electronic monitoring system in the workplace
to operate.


Requested in the data protection regulations sent to the Authority as the legal basis for the monitoring
legitimate interest has been indicated. Required for data management based on the legitimate interest of the data controller
the balancing test is included separately in the data management rules sent to the Authority. THE
data management of a built-in camera system, necessarily monitoring employees
as a legal basis, he therefore requested Article 6 (1) (f) of the General Data Protection Regulation
applied. The use of this legal basis is accepted by the Authority as appropriate in the workplace
in connection with a camera system for the protection of persons and property, and thus in connection therewith

it makes no further findings.

   b. The purpose of the examined data management

Data management in the Applicant's replies to the Authority and in the attached documentation
to protect the security of buildings and their property, and
marked personal protection objectives. Thus, the purpose of operating the camera system is not to

monitoring and influencing the work of employees, but also protecting people and property.

In this regard, it is important to mention that workplace camera surveillance is absolute
is a constraint on respect for human dignity, and therefore cameras for workers and
not to operate on a permanent, non-targeted basis
may. It is also illegal to use an electronic monitoring system that
aimed at influencing employees ’behavior at work, employees

permanent monitoring and control with cameras. The reason for this is for control purposes
observation typically violates the principle of necessity proportionality, as the employer has a number of
there is another way to live Mt. 11 / A. § (1). Therefore,
it is not possible to operate cameras that are exclusively for the workers and the work done by them
activity is monitored on a permanent basis. Exceptions are workplaces where the
the lives and physical integrity of workers may be in imminent danger and thus exceptionally operable
camera, for example, in an assembly hall, furnace, industrial plant or other source of danger

facilities. It should be emphasized, however, that only in that case
an operable camera to protect the life and physical safety of workers in the event of danger
it actually exists and is direct, that is, the potential danger cannot be constitutional
acceptable data management purpose. However, all this must be proven by the employer
balancing test.
















                                               11In the case of surveillance for property protection purposes, the employer must also certify the
in the balance of interests, that there are in fact circumstances which justify
placement of certain cameras and otherwise the goal to be achieved cannot be ensured. The protection of property
In the case of purpose monitoring, another important requirement is to pay special attention to the employer
must be such that the angle of view of the given camera is essentially aimed at the property to be protected,
and, as a result of the above, should not become an observation of the work of workers
suitable tool.


In addition, it is also not possible to use an electronic monitoring system in a room
which has been designated for the purpose of taking a break between employees. An exception to this
may be the case if there is some valuable property to be protected in this room,
in connection with which an employer interest can be justified (for example, employees
the equipment was damaged several times and the damage had to be borne by the employer). In this
In this case, a camera can be placed in the room for this specific purpose, but then the

The employer must also pay particular attention to the principle of data saving
be such that the angle of view of the camera can only be directed at the property to be protected.

Based on your requested responses and the submitted images transmitted by the placed cameras
it can be established that they are the storage premises on the premises, the goods stored there and the
courtyard and parking spaces there are observed. An exception to this is called […]
room, as here a larger desk, chairs and

computer workstation as well, which Requested response based on short-term administration
activities (for example, publishing of warehouse materials, receipt by computer
documentation).

The purpose of the installation of […] 's camera is also the protection of persons and property
because in the room, outside the workstation, there are high-value small machines, tools,
parts are stored. In the case of a recording attached by the Applicant, there are several in the room

employee is also visible.

Regarding the angle of view of this camera, it can be stated that its lower-right part is administrative
furniture and objects forming part of a workstation, while the upper left part is large
small appliances, tools and parts, as well as cabinets and shelves suitable for storing them
are visible.


According to his requested statement, […] is not a room designated for breaks between work. If
it would be, there, under the Privacy Policy of the Requested Camera Surveillance
camera could not be operated. Nevertheless, the Applicant's request was received by the Authority
in connection with a further complaint, it can be stated that it was also used for this purpose by the employees, a
with short-term administrative work. For example, according to the applicant's statement, several employees
was also called upon by the site 's logistics manager to spend less time on
in the room.


Irrespective of the allegations made in the application or in the complaint, it can be concluded that […] -
installed in the camera angle of view is suitable to see through them the workers (the tested
37 people in the period) requested to view the pictures of the cameras
through your authorized employees. This is because the camera's viewing angle is more than just
high - value assets to be protected or storage units containing them (mediated
upper left half of the image), but also the workstation for administrative purposes (lower right half of the transmitted image)






                                               12 hanging. Constant monitoring of the latter part of the room is neither the protection of property nor the
nor is it justified in order to protect the life and physical integrity of workers, as there is only physical
there is administrative work that does not pose a real threat to health, and there is significant storage of valuables
it doesn't happen either.

The ability of the image transmitted by the camera to monitor the intensity of work is
are also likely to be the subject of an independent complaint. The system is suitable

to ensure that it does not serve to unduly monitor employees by the intermediary
by those authorized to view the image (in this case, these are the logistics manager and the warehouse manager) a
Responsible as a data controller operating and operating the system
belongs to.

On the basis of the above, the Authority concludes that the Applicant's [[] site is named […]
the angle of view of the camera installed in the room is suitable for unreasonable surveillance of workers,

thus incompatible with the original purpose of protecting persons and property. Through the camera
therefore infringes Article 5 (1) (b) of the General Data Protection Regulation
the principle of "purpose limitation".

In addition, since said camera is aimed not only at the assets to be protected, but also at
a wider spectrum of vision is included in the image it conveys, thus enabling the room
the Authority is of the opinion that the principle of data saving - the general

Article 5 (1) (c) of the Data Protection Regulation.

In view of the above, the Authority requested the Applicant, in the operative part of this Decision, to
to change the angle of view of the camera installed in the […] room of the […] site
so that it is not suitable for unreasonable monitoring of workers and in accordance with
be for the purpose of protecting the person and property of the system installation.


    c. Informing stakeholders about the data management examined

An essential requirement for data management related to camera surveillance at work,
that employees ’data management is appropriate, transparent and easy to understand
receive information. In this connection, the following should be taken into account:

Pursuant to Section 9 (2) of the Labor Code: “On the manner, conditions and conditions of restriction of the right to personality

the expected duration and the circumstances justifying its necessity and proportionality
the worker must be informed in advance in writing. "

Mt. 11 / A. § (1), if the employer also uses technical means a
employees, they must inform them in writing in advance.

Article 13 (1) to (2) of the General Data Protection Regulation states that data processing
what information should be made available to employees.


For data management related to camera surveillance, the general data protection regulation
In accordance with the system of requirements laid down by
circumstances must be reported:

    - the person operating the electronic monitoring system (legal or natural)
       determining





                                                13 - the contact details of the Data Protection Officer, if appointed by the Data Controller
       person
    - the location of each camera and the purpose for which it is intended
       the area, subject, or whether you are directly with the camera

       whether the employer carries out a fixed observation,
    - the legal basis for the processing,

    - the determination of the legitimate interest of the controller,

    - the storage period of the recording,
    - the persons entitled to access the data and whether the recordings are made

       to which persons and bodies, in which case the employer may forward,
    - the rules for reviewing recordings and whether to record recordings
       what purpose the employer may use,

    - the rights of employees to electronic rights
       in the context of the monitoring system and how they can exercise their rights,

    - in the event of a breach of their right to information self-determination
       enforcement tools.

In connection with the obligation to provide information, it is also necessary to emphasize to the employer
for each camera, you must indicate exactly what that camera is like

for the purpose of the given area and what area or equipment the angle of view of the camera is aimed at.
This allows the employer to justify to employees why it is considered
it is necessary to monitor the area. The practice of a
employer generally informs employees that it is electronic
uses a monitoring system in the workplace.

An additional requirement in the context of proper information is that the employer is obliged

to place an alert on the fact that the area is electronic
uses a monitoring system.

Applicant notified by the Authority at the request of the […] site of the camera system
immediately after its installation and commissioning on 18 November 2019
it was suitable for image capture, which began at this time.


Applicant distinguishes between the periods of operation of the system so-called. “Trial” and “sharp
although he did not comment on the exact duration of the trial operation. Requested
However, according to the statement, there was no difference between the “sharp” and the
"Trial operation", so the system operated in the same way during the relevant period. The two
the conditions for data management were thus the same.

On the “trial operation” of the camera system installed on site and the related data management

information about the start of the contract was not sent to employees on November 18, 2019
before.

Applicant attached to his application his employment contract on the day of his entry
Data management information provided by the applicant. The prospectus is general, not specific to only






                                                 14-camera document focusing on data management, but also the employee's personal data
contains information on the general management of Up to one paragraph in the prospectus
The applicant requests some issues of camera data management (eg legal basis, retention period, purpose,
prohibitions). This shorter summary document does not include those listed above
all categories as it is not with a camera system at a specific site
is only a general guide. According to the applicant, the site is a warning
signs were not posted either, with the availability of any further, more specific information

connection.

More detailed data protection regulations on the operation of the requested camera systems in 2020.
was sent to employees on April 3 by email containing a link to
To the policy available on your requested internal network. This document is not only for […]
for all cameras operated by the Applicant
contains detailed privacy rules. The e-mail is not only from the employees of the […] site,

but received by all employees (addressee: […]), so it is likely to be considered
Requested general “camera” data management policy.

Based on the above, it can be stated that the Applicant handed over to the Applicant upon entry
in his data management prospectus he only informed him in general terms that he was performing his job
you can observe it with a camera. Such general, concise and easy-to-understand information is
data management options are to be welcomed and basically expected from data controllers.


However, brief general employee information alone is not enough if specific
with data management (in this case with camera surveillance at the specific site)
no further guarantees have been included in a more detailed data management policy
guaranteeing the rights and freedoms of those concerned. For these further
guarantees or a document describing them are not referred to in the prospectus (eg by link).


No information on camera data management was provided at the specific site, and the camera
detailed internal rules for monitoring well after the start of data processing,
was established with a delay of several months.

The absence of these additional specific guarantees defeats the purpose of the information, namely that the data subject is concerned
be aware of the circumstances in which your personal data are processed by the controller.
It is important that the data controller, at the request of the data subject, has additional specific, specific data processing

provide more detailed information on your circumstances. General privacy policy
Article 13 (1) to (2) of Regulation (EC) No 1049/2001 specifies in detail which
shall inform the data subject of the information, of which, however, the
the information given when the employee entered was only partially compliant. The briefing is not
it included, for example, the balancing test and other references where it did
detailed rules would be available. The reason for this is that the regulations can only be
months later, after the start of data management, the
workers. The content of the warning sign to be placed in the monitored area is also only

subsequently, defined in these regulations.

Article 13 (1) of the General Data Protection Regulation provides that the controller a
at the time of obtaining personal data, make available to the data subject a
each of the information listed.







                                               15In this case, the Applicant was not able to start the data processing (which is the so-called
‘Trial operation’ date of 18 November 2019) to ensure this, as it is only a very
provided brief and general information on the possibility of camera surveillance by employees
upon entry. Complementing, briefing and briefing the brief for all employees
available detailed camera data management policy only after data management begins more
adopted and communicated to stakeholders (3 April 2020). After that the
information has already complied with the requirements of Article 13.


On the basis of the applicant 's request and the joint complaint, it can thus be concluded that a
at the site, there was inadequate information about camera data management at the site
employees (a total of 37 people in the period under review) all the way to detailed data management
until the issue of the regulations.

On the basis of the above, the applicant infringed Article 13 (1) of the […]

for on-site camera data management from 19 November 2019 to 3 April 2020.
because it did not provide sufficient information and specificity to the
workers.

    d. Findings concerning the sanction applied.

The Authority has examined the type of sanction it intends to impose on the Applicant

for the breaches detected and whether a data protection fine is justified. E
Article 83 (2) of the General Data Protection Regulation and Infotv. 75 / A. §-the
based on Infotv. § 61 (5), considered all relevant to the case
and found that in the case of the infringement discovered in the present proceedings, the Applicant
warning and solicitation is not in itself a sufficiently proportionate and dissuasive sanction,
it is therefore appropriate to impose a fine.


In determining the need to impose a fine, the Authority considered the infringements
aggravating and mitigating circumstances as follows:

Aggravating circumstances:

    - In connection with the data management activities of the Applicant, the Authority has already done so before
       infringement in an official data protection procedure ([…])


    - In relation to its position in the Requested Market and the resources available to it
       he is increasingly expected to comply with data protection legislation, including the workplace
       compliance with data management.

    - Infringement of camera data management and insufficient information at the investigated site is long
       lasted until 18 November 2019 - 3 April 2020


    In setting the amount of the fine, the Authority took into account that
       Infringements of principle by the applicant are covered by Article 83 of the General Data Protection Regulation
       (5), it falls within the higher maximum fine category
       constitute an infringement.








                                                16 Mitigating circumstances:

    - Infringement of camera surveillance and lack of information on the data management under investigation
       did not affect a particularly wide range of persons (a total of 37
       employee).

    - Only one camera ([…]) image transmitted at the site may be suitable for

       unjustified monitoring of workers.

Other circumstances considered:

    - The Authority also took note of the fact that the Applicant cooperated in all aspects of the
       Authority in the investigation of the case, although this conduct is not - as the law
       obligations were also not exceeded, he assessed as explicitly mitigating

       as a circumstance.

In setting the amount of the fine, the Authority took into account that
Net sales of HUF […] (HUF […]) in the business year between January 1, 2019 and December 31, 2019
volt. In setting the fine, it took into account the duration of the infringement
taking into account the Authority’s business year 2019 and the fact that 2020 is not yet available
public data available. On the basis of the above, the amount of the fine imposed is based on the gravity of the infringement

proportionate, shall not be considered excessive.

The Authority has issued the Infotv. Pursuant to Section 61 (2) (c) of the decision, the Applicant ID
ordered the disclosure of his data by obscuring his data, as it does not affect him
a wide range of persons.

ARC. Other issues


The powers of the Authority are limited by the Infotv. Section 38 (2) and (2a), its jurisdiction is
covers the whole country.

The Acre. § 112 and § 116 (1) and § 114 (1), respectively
there is a right of appeal against an administrative action.


The rules of administrative litigation are laid down in Act I of 2017 on the Procedure of Administrative Litigation (a
hereinafter: Kp.). A Kp. Pursuant to Section 12 (2) (a), the Authority
administrative lawsuit against the decision of the Kp. Section 13 (11)
The Metropolitan Court has exclusive jurisdiction pursuant to On civil procedure
on 2016 CXXX. Act (hereinafter: Pp.) - the Kp. Pursuant to Section 26 (1)
applicable - legal representation in a lawsuit within the jurisdiction of the General Court pursuant to Section 72
obligatory. Kp. Pursuant to Section 39 (6), unless otherwise provided by law, the application
has no suspensory effect on the entry into force of the administrative act.


A Kp. Section 29 (1) and with this regard Pp. Applicable in accordance with § 604, electronic
CCXXII of 2015 on the general rules of administration and trust services. Act (a
hereinafter: E-Administration Act), pursuant to Section 9 (1) (b), the customer is legal
representative is required to communicate electronically.







                                               17The time and place of the filing of the application is Section 39 (1). THE
Information on the possibility of requesting a hearing can be found in Kp. Section 77 (1) - (2)
based on. The amount of the fee for an administrative lawsuit is set out in Act XCIII of 1990 on Fees. law
(hereinafter: Itv.) 44 / A. § (1). From the advance payment of the fee is
Itv. Section 59 (1) and Section 62 (1) (h) shall release the party initiating the proceedings.

74/2020 on certain procedural measures in force during an emergency. (III. 31.)

According to Section 35 of the Government Decree (hereinafter: Government Decree), unless this Decree provides otherwise
the emergency does not affect the running of the time limits.

Pursuant to Section 41 (1) of the Government Decree, the court is hearing at the time of the emergency
acting outside. If a lawsuit were to be held outside the time of the emergency, the plaintiff would then
you can ask the court to hear out of court instead of hearing the emergency
postpone until the end of

(a) the court did not order, at least in part, the suspensory effect of the administrative act,
(b) the action has suspensory effect and the court has not ordered the suspension of the suspensory effect
el,
(c) no interim measure has been ordered.

The Acre. According to § 132, if the debtor does not comply with the obligation contained in the final decision of the authority
fulfilled, it is enforceable. The decision of the Authority Pursuant to Section 82 (1) of the Communication

becomes final. The Acre. Section 133 of the Enforcement - if by law or government decree
unless otherwise provided - ordered by the decision-making authority. The Acre. Pursuant to Section 134 a
enforcement - if local in a law, government decree or municipal authority matter
the decree of the local government does not provide otherwise - it is carried out by the state tax authority. Infotv.
Pursuant to Section 60 (7), a specific act included in the decision of the Authority
obligation to perform, to behave, to tolerate or to stop
implementation of the decision shall be carried out by the Authority.


Budapest, October 14, 2020


                                                                Dr. Attila Péterfalvi
                                                                       President
                                                                 c. professor






















                                                 18