Persónuvernd - 2020010548

Persónuvernd - 2020010548
Authority:	Persónuvernd (Iceland)
Jurisdiction:	Iceland
Relevant Law:	Article 2(2)(c) GDPR Article 6(1)(f) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	17.12.2020
Published:	19.01.2021
Fine:	None
Parties:	n/a
National Case Number/Name:	2020010548
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Icelandic
Original Source:	Persónuvernd (in IS)
Initial Contributor:	n/a

The Icelandic DPA (Persónuvernd) ordered a resident of an apartment building to stop surveilling other residents and public spaces through CCTV cameras installed in the resident's apartment and car. The DPA concluded that the processing did not comply with the GDPR, and ordered the resident to delete the footage.

English Summary

Facts

The DPA received a complaint regarding electronic monitoring in an apartment building in Kópavogur. The complaint stated, among other things, that her neighbor, also a resident of the building, had installed numerous cameras in the windows of his apartment and in a car. They were directed, among other things, to the complainant's parking space and a bedroom window of her apartment. She demanded to remove the cameras immediately. It is said that the neighbor published the recorded footage of the surveillance cameras, without consent, on social media.

Dispute

Is monitoring of a common property and a private property of someone else without his or her consent compliant with the GDPR?

Holding

The DPA established that the processing of the personal data in question cannot be considered to concern only private interests of the responsible party or be intended for his personal use. According to the DPA, the responsible party had not demonstrated the imminent danger to him or his property or the need to monitor areas outside his own private property, ie. areas that belong to common property or are considered private property of other residents of the house.

The DPA called the responsible party to refrain from all electronic monitoring which targets the common property and private property of other residents, delete all footage collected to this day and delete relevant content posted in social media.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Electronic monitoring in a multi-family house
Case no. 2020010548
19.1.2021
The Data Protection Authority has ruled in a case where there was a complaint about electronic monitoring in a multi-family house, where cameras were aimed at the common property and private property of some. There are also complaints about the publication of busy content on online media. The ruling concludes that the electronic monitoring and publication of recorded images on online media did not comply with Act no. 90/2018 and rules no. 837/2006 on electronic monitoring and processing of personal information generated by electronic monitoring. 

Ruling

At a meeting of the Board of the Data Protection Authority on 17 December 2020, the following ruling was issued in case no. 2020010548 (former case no. 2018101634):

I.
Procedure

1.
Outline of case
On October 29, 2018, the Data Protection Authority received a complaint from [B] (hereinafter referred to as the complainant) regarding electronic surveillance with surveillance cameras in an apartment building at [...] in Kópavogur. The complaint states, among other things, that [A], also a resident of [...], had installed numerous cameras in the windows of his apartment and in a car. They are directed, among other things, to the complainant's private car park and the bedroom window of her apartment. The complainant demands that the surveillance cameras be removed immediately. It is said that [A] published the recorded footage of the surveillance cameras, without consent, on social media.

2.
Correspondence
By letter dated On 6 February 2019, [A] was invited to provide explanations regarding the complaint. He replied with an undated letter, which the Data Protection Authority received 18 cm. The Data Protection Authority considered that further answers were needed from [A] and sent him a letter back, dated. March 18 s.á. That letter was answered by [A] with two e-mails on the 24th cm, but the e-mails were accompanied by 13 photographs and two screenshots from surveillance cameras as well as a link to two recorded videos from the surveillance camera of a car dashboard on the video channel Youtube. Privacy reiterated its request for replies by letter dated. May 10 s.á. The 16th cm received an e-mail from [A] but without answering repeated questions from the Data Protection Authority.

By letter dated On 21 August 2019, the complainant was given an opportunity to comment on the explanations provided [A]. At the complainant's request, she was given a further deadline to reply. The complainant replied by letter dated October 14, but the letter was accompanied by drawings of the house along with five photographs.

In resolving the case, all of the above documents have been taken into account, although not all of them are specifically described in the following ruling.

The handling of this case has been delayed due to heavy work at the Data Protection Authority.

3.
The complainant's views
The complaint is based on the fact that [A] installed surveillance cameras in the multi-family house at [...] in Kópavogur, without the consent of the residents. The cameras are located in the windows of his apartment, both on the front and back of the house, and are, among other things, directly on the steps to the entrance of the complainant's apartment. Cameras are also directed to a parking space in front of a garage, and to an apartment on the upper floor in the back house, both of which are the complainant's private property.

The complainant states that she moved to the multi-family house in [...] in the summer of 2017. She was not aware of the surveillance cameras then, as they had been hidden in a decoration in the windows of apartment [A]. The complainant first noticed the cameras in the early winter of 2018 and sent a complaint to the Data Protection Authority as a result. The complainant had informed other residents of the multi-family house about the cameras and received confirmation that none of them had been informed about them. Other residents of the house had confirmed that [A] had never referred the monitoring to them at a house meeting. [A] has since, in early 2019, put up a sticker about the monitoring, but he has also done so without consultation with other residents of the house.

The complainant's letter also states that the car mentioned in the original complaint is no longer present and therefore the complainant does not mention it in his letter.

The complainant refutes [A]'s allegations of cannabis smoking and reiterates his demand that he remove the cameras from the windows of the house immediately. It is unacceptable that [A] monitors the occupants of the house without their consent. It will not be seen what benefit he has, in spite of his illness, from observing human movements in front of the house, as the entrance to his apartment is on the back of the house. Finally, the complainant demands that daily fines be imposed if [A] does not comply with the request to remove the cameras.

4.
Perspectives of the camera owner
An e-mail [A] states that in 2015 he installed cameras in the windows of his apartment. Initially, this was due to an alleged illegal home stay that he believed was run in the house by previous owners. After a while, he found the arrangement convenient to see who was outside the house. [A] says he has […] and has difficulty walking and is therefore late to the door. His e-mail also states that the complainant is illegally renting out storage and a garage. She says that it is a "scumbag" on her behalf who smokes cannabis in front of the house and it makes him insecure. It is stated that the guarded area is the sidewalk in front of the front door and kitchen window of apartment [A], a common garden and a driveway that is in common. It is also stated that he believes that the complainant was aware of the surveillance cameras as she moved into the house after their installation in 2015. [A] also states that the monitored area is well marked. Finally, he confirms in his e-mail that a decision on monitoring has not been made at a formal house meeting, as a legal house meeting has not been held since 2014.

Regarding a surveillance camera in a car, [A] claims to have installed a camera in his car's dashboard after being damaged. The surveillance camera starts when the car is started. He is therefore unable to understand how the camera should be able to take pictures through the complainant's bedroom window, which is on the second floor of the building.

[A] denies having recorded material and posted on Facebook, but confirms that he has posted recorded footage on the video channel Youtube, among other things by people smoking near the house.

II.
Assumptions and conclusion

1.
Scope - Responsible party - Defining a case
Scope of Act no. 90/2018, on personal data protection and the processing of personal data, and Regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thereby the authority of the Data Protection Authority, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partly or wholly automatic and the processing by other methods than automatic of personal data that are or are to become part of a file.

According to para. Article 4 Act no. 90/2018, Coll. paragraph 2 (c) Article 2 of the Regulation, the Act and the Regulation do not apply to the processing of an individual's personal data that only concern his or her private interests or his or her family or are intended solely for personal use. The Court of Justice of the European Union came to that conclusion, in case no. C ‑ 212/13 (František Ryneš) from 11 December 2014, that the above exemption should be interpreted narrowly. Therefore, video recording for surveillance purposes, even if only in part, for areas outside the territory of the responsible party, could not be covered by the exemption provision. In this case, it is clear that [A] uses cameras to monitor the common property and private property of other residents of the property. In addition, he has also confirmed that he has published videos, which were collected with the cameras in question, of the residents of the house and their guests, on the video channel Youtube. In the light of the above, the processing [A] of the personal information in question can therefore not be considered to concern only his private interests or his family or be intended for personal use. Exemption provisions of para. Article 4 Act no. 90/2018, Coll. also point c of the second paragraph. Article 2 of Regulation (EU) 2016/679 does not apply and the processing of personal data by the monitoring in question therefore falls within the scope of Act no. 90/2018 on personal protection and the processing of personal information.

Personal information includes information about a person who is personally identifiable or personally identifiable, but a person is considered personally identifiable if he or she can be identified, directly or indirectly, such as by reference to an identity such as name, ID number, location data, online identity or one or more physical characteristics , physiological, genetic, spiritual, material, cultural or social, cf. Point 2 of Article 3 of the Act and point 1. Article 4 of the Regulation.

Processing refers to an operation or series of operations in which personal information is processed, whether the processing is automatic or not, cf. Point 3 of Article 3 of the Act and point 2. Article 4 of the Regulation.

Electronic monitoring is monitoring that is continuous or repeated regularly and involves supervision of individuals with remote-controlled or automatic equipment and takes place in public or in an area that a limited group of people normally go through, cf. Number 9 Article 3 Act no. 90/2018. The term covers surveillance which leads to, should lead or may lead to the processing of personal data and television surveillance carried out using television cameras, webcams or other similar equipment, without the collection of footage or other activities equivalent to the processing of personal data. From the complaints of the complainant and the owner of the cameras on the purpose of the use of the machines in question, it can be deduced that electronic monitoring takes place here, which must meet the conditions of Act no. 90/2018.

The person responsible for the processing of personal information complies with Act no. 90/2018 is named the responsible party. According to point 6. Article 3 of the Act refers to a person who decides alone or in collaboration with another purpose and methods of processing personal information, cf. 7. tölul. Article 4 of the Regulation. As such, [A] is considered to be responsible for the processing in question.

In the initial complaint to the Data Protection Authority, the complainant had also complained about a camera in the car of the guarantor that was directed to her bedroom window. In the complainant's reply letter to the explanations provided by the guarantor, it was stated, among other things, that the car in question was no longer present and therefore she would not discuss it further in her letter. The Data Protection Authority considers that the complainant has, with his above-mentioned comment, dropped the aspect of the complaint and will therefore not be discussed further in this ruling.

2.
Legality of processing
In order for electronic monitoring to be permitted, the conditions of the first paragraph must be met. Article 14 Act no. 90/2018. It stipulates that electronic monitoring is always subject to the condition that it is carried out for objective purposes. Electronic monitoring of an area, which is usually carried out by a limited group of people, is also subject to the condition that it is specifically needed due to the nature of the activities that take place there. During electronic monitoring, care must also be taken, among other things, that a signal or other conspicuous means clearly notifies the monitoring and who is responsible for it, cf. Paragraph 4 same articles.

As has been stated, this is electronic monitoring that leads to the processing of personal information. In order for the processing of such information to be permitted, one of the conditions provided for in Article 9 must be met. Act no. 90/2018 and Article 6. of Regulation (EU) 2016/679, to be complied with.

As is the case here, point 6 comes into consideration in particular. Article 9 of the Act, cf. paragraph 1 (f) Article 6 of the Regulation, to the effect that personal data may be processed, it is necessary to safeguard legitimate interests unless the fundamental rights and freedoms of the data subject are overridden. In assessing whether the authorization in question can apply, three conditions must be met. First, the processing must be carried out in the interests of the legitimate interests of the responsible party or a third party who receives the personal information. Secondly, it is required that the processing is necessary in the interests of them. Thirdly, the interests or fundamental rights and freedoms of the data subject which require the protection of personal data must not outweigh the legitimate interests referred to.

In the preliminary ruling of the European Court of Justice in case no. C ‑ 212/13 (František Ryneš) from 11 December 2014, it was stated that the court considered that the guarantor may have a legitimate interest in protecting his property, his life and his family. In section 3.1.1 of the guidelines of the European Privacy Council no. 3/2019, on the processing of personal information with video recording equipment, which were issued on the basis of item e of the first paragraph. Article 70 Regulation (EU) 2016/679, states, among other things, that in really dangerous situations, the responsible party may have a legitimate interest in protecting its property by installing surveillance cameras against burglary, theft or damage. In such cases, it is not sufficient that the risk is fabricated or speculated by the guarantor. There must be a real risk before monitoring begins, such as property damage or serious incidents. It is the responsibility of the person to prove such incidents or damage. In addition, the authorization for monitoring needs to be reassessed regularly in view of the existing hazards. Section 3.1.2 of the aforementioned instructions also states that before the responsible party decides to install a surveillance camera, he must always assess whether the processing is appropriate and necessary for the purpose. He should also examine whether it is possible to achieve the same goal with other and milder methods. Surveillance with surveillance cameras may only be used if the stated goal is not achieved by other and milder means that result in less interference and influence on the fundamental rights and freedoms of the data subjects. It is the responsible party who is responsible for ensuring that the processing of personal data always complies with the provisions of the first paragraph. Article 8 Act no. 90/2018 and to be able to demonstrate it, cf. Paragraph 2 Article 8 of the Act.

The fundamental rights and freedoms of individuals are, among other things, protected in the Constitution of the Republic of Iceland. In Article 71 of the Constitution no. 33/1944, Coll. Amendment Act no. 97/1995, deals with privacy. It says in the 1st paragraph. that everyone should enjoy privacy, home and family. It is clear in the case that the complainant considers himself to have a great deal of trouble with the monitoring and has declared himself opposed to it.

As stated, the person in charge set up surveillance cameras with reference to the fact that the previous occupants of the house had been staying at home. Later, he found the arrangement convenient as he was late for the door due to […]. It is the opinion of the Data Protection Authority that the responsible party has not demonstrated the imminent danger to him or his property or the need to monitor areas outside his own private property, ie. areas that belong to common property or are considered private property of other residents of the house. It will therefore not be considered that the monitoring in question can be based on point 6. Article 9 Act 90/2018, cf. paragraph 1 (f) Article 6 of the Regulation.

In addition to the authorization according to the above, the processing of personal information and electronic monitoring must meet all the basic requirements of the first paragraph. Article 8 Act no. 90/2018, Coll. Article 5 Regulation (EU) 2016/679. Among other things, it stipulates that personal information shall be processed in a lawful, fair and transparent manner towards the data subject (point 1); that information shall be obtained for clearly stated, lawful and objective purposes and not further processed for other and incompatible purposes (point 2, cf. also the first paragraph of Article 14 of the Act); and that they shall be sufficient, appropriate and not in excess of what is necessary for the purpose of processing (paragraph 3).

The Data Protection Authority has set rules no. 837/2006, Coll. Paragraph 5 Article 14, on electronic monitoring and the processing of personal data generated by electronic monitoring. According to Art. According to these rules, electronic monitoring must take place for stated, clear and objective purposes, such as for security or asset protection. Then it says in Article 5. of the rules that in all electronic monitoring, care shall be taken not to go beyond what is urgently necessary in view of the intended purpose. It also states that care should be taken to respect the privacy of those under surveillance and to avoid any unnecessary interference with their privacy. When deciding whether to use electronic monitoring, it should therefore always be ascertained whether the goal of such monitoring can be achieved with other and less realistic measures.

It cannot be seen that the aforementioned processing of personal information complies with the above principles or the above provisions of rules no. 837/2006 on electronic monitoring and processing of personal information generated by electronic monitoring.

3.
Conclusion
In view of all the above, the conclusion of the Data Protection Authority is that electronic monitoring [A] at [...] in Kópavogur is not in accordance with Act no. 90/2018 on personal protection and processing of personal information, Regulation (EU) 2016/679, and rules no. 837/2006 on electronic monitoring and processing of personal information generated by electronic monitoring.

In accordance with this conclusion, and with reference to points 6 and 7. Article 42 Act no. 90/2018, Coll. points f and g of the second paragraph. Article 58 of the Regulation, it is hereby proposed that the responsible party refrain from all electronic monitoring, which focuses on the common property and private property of other residents at [...] in Kópavogur. It is also proposed that the responsible party delete all footage that has been collected through the monitoring so far. Finally, the guarantor is asked to delete the content he has shared on the video provider Youtube.

Confirmation that these instructions have been followed shall be received by the Data Protection Authority no later than 30 December 2020.


Ú r s k u r ð a r o r ð:
Electronic monitoring [A] that [...] in Kópavogur does not comply with the provisions of Act no. 90/2018, Regulation (EU) 2016/679 and Rules no. 837/2006 on electronic monitoring and processing of personal information generated by electronic monitoring.

[A] shall discontinue the monitoring immediately and delete monitoring material that has accumulated to date. He must also delete recorded material that he has shared on the video channel Youtube.

Confirmation that these instructions have been followed shall be received by the Data Protection Authority no later than 30 December 2020.

If the Data Protection Authority has not received confirmation [A] according to the above within the given deadline, it will be considered to apply the coercive measures that the institution has according to Art. Paragraph 1 Article 45 Act no. 90/2018. It says:

If the instructions of the Data Protection Authority are not complied with, cf. Points 6, 7 and 9 Article 42 of this Act, she may, before deciding on an administrative fine pursuant to Art. Article 46 of this Act, imposed daily fines on the person to whom the instructions are directed until it has been remedied in its opinion. Fines can amount to up to ISK 200,000. for each day that passes or begins to pass without following the instructions.



In Privacy, December 17, 2020


Ólafur Garðarsson
Vice Chairman


Björn Geirsson Vilhelmína Haraldsdóttir


Þorvarður Kári Ólafsson