KR - Mål nr 1552-22

KamR Stockholm - Mål nr 1552-22
Court:	KamR Stockholm (Sweden)
Jurisdiction:	Sweden
Relevant Law:	Article 5 GDPR Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6(1)(f) GDPR Article 13 GDPR Article 14 GDPR
Decided:	26.01.2023
Published:	26.01.2023
Parties:	Storstockholms Lokaltrafik (SL) Integritetsmyndigheten (IMY)
National Case Number/Name:	Mål nr 1552-22
European Case Law Identifier:
Appeal from:	Förvaltningsrätten i stockholm (Sweden) Mål nr 21905-21
Appeal to:	Unknown
Original Language(s):	Swedish
Original Source:	Kammarrätten (in Swedish)
Initial Contributor:	Pantalaimon1337

The wording of Article 13 suggests that some kind of deliberate action by the data subject to be regarded as having been collected from him. This cannot be the case when personal data are collected by means of the body-worn cameras in question.

English Summary

Facts

The Swedish Privacy Authority (IMY) decided on 21 June 2021 that AB Storstockholms Lokaltrafik (SL) would pay an administrative fine of SEK 16 million under the General Data Protection Regulation of which - SEK 4 000 000 relates to SL's use of body-worn cameras to preventing and documenting threats and violence, through the use of pre-recording technology for one minute, - SEK 8 000 000 relates to SL's use of body-worn cameras to ensure the identity of passengers liable to pay a surcharge, and - SEK 4 000 000 relates to SL's failure to provide information to data subjects.

SL first intended to use the body-worn cameras on 4-10 ticket inspectors in the metro during a test period starting from December 2018. Test period was extended and later introduced permanently. The body-worn cameras are used since they became permanent by about 55 ticket inspectors on weekdays and 20 ticket inspectors on public holidays across the network. The technology works as follows a camera and microphone continuously record images and sound. The cameras have a circular memory that allows any video footage older than one minute to be is automatically cleared unless the ticket inspector activates a recording. Then the footage from one minute back from when the recording was activated (so-called automatic pre-recording). The ticket inspector has been instructed to activate recording when the to issue a surcharge or when threatening or violent situations arise. The footage from the camera is uploaded after the shift to a server where it reviewed by a few evidence administrators.

The case was appealed to Stockholms förvaltningsrätt, where they dismissed the administrative fine regarding against SL's use of body-worn cameras to preventing and documenting threats and violence, through the use of pre-recording technology for one minute, Förvaltningsrätten considers that the evidence supports that SL's use of body cameras with a one-minute pre-recording is both necessary and proportionate to document and prevent threats and violence.

Though, the use of body cameras to ensure the identity of the passengers were not proportional. In an overall assessment Förvaltningsrätten therefore considers that SL's use of body-worn cameras for to ensure the identity of the person liable to pay a surcharge was not compatible with the General Data Protection Regulation. The Administrative Court agrees with IMY's assessment that SL violated Article 6(1)(f), 5(1)(a) and 5(1)(c) of the GDPR .

Additionally, Förvaltningsrätten agreed with IMY in its decision for SL's failure to provide information to data subjects. Förvaltningsrätten relies heavily on the previously published guidance from EDPB in its Guidelines 3/2019 on how data subjects should be informed about video-surveillance. The guidelines state, inter alia, that a gradual or combination of methods may be used in light of the amount of information to be provided. For video-surveillance, the most important information should then be displayed on the warning sign itself (first level), while additional mandatory information can be provided by other means (second level), such as a complete information sheet or a digital source referred to by the warning sign.

Conversely, the case was appealed to Kammarrätten, which had a different interpretation of article 13

Holding

Kammarrätten first took at textual approach to article 12-14 GDPR. Article 13 states that if personal data relating to a data subject is collected from the data subject, the controller shall, when the personal data are obtained, provide certain information to the data subject, while Article 14 specifies the information that shall be provided if the personal data have not been obtained from the data subject.

The first question Kammarrätten must consider is whether the collection of personal data by means of a body-worn camera is to be regarded as the data is collected from the data subject.

Kammarrätten notes two different sources: 1) The Article 29 Working Party, now the European Data Protection Board, has in its guidelines on transparency under the GDPR adopted on 29 November 2017, stated that personal data to be considered as obtained from data subjects includes data obtained through observation by means of cameras, for example (p. 26) and that Article 13 is thus applicable.

2) The Court noted that the European Court of Justice in a judgment of 11 December 2014 concerning camera surveillance carried out by a private individual (C-212/13, EU:C:2014:2428) indicated as applicable law, inter alia, the provision that now found in Article 14 of the General Data Protection Regulation. The case concerned a fixed camera filming, inter alia, a public road.

The Case-law from the EU indicated that it's in fact article 14 GDPR which is the appropriate article to consider in this scenario. The wording of Article 13 - "collected from the data subject" - suggests that that some kind of deliberate action by the data subject for the personal data to be regarded as having been collected from him. This cannot be considered to be the case when personal data are collected by means of the body-worn cameras in question. Kammarrätten therefore considered that the wording of the provision, taken together with the ruling of the European Court of Justice, suggests that Article 13 is not applicable.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

CLAIMS, M.M.
The Swedish Privacy Agency (IMY) demands that the administrative
the penalty fee of SEK 16 million must be determined. IMY believes that AB
Greater Stockholm's Lokaltrafik (SL) appeal must be rejected.
SL primarily requests that no administrative penalty fee be imposed. IN
secondly, it is requested that the decided penalty fee be set at one
significantly lower amount.
WHAT THE PARTIES PROVIDE
IMY
IMY brings forward i.a. following. There is no legal basis for SL's
camera surveillance using pre-recording technology for that long
as one minute in the context of threatening or violent situations. The
It is not clear from the documentation submitted by SL that a one-minute pre-recording is
necessary and proportionate to achieve the purpose. As a comparison
it appears from the Police Authority's guidelines for camera use that the police
body cameras use 30 seconds of pre-recording of image but not sound.
Even if the activities differ, it cannot be considered necessary
and proportionately for SL to use a longer pre-recording time than
the police.
The use of the pre-recording technique means that material is recorded
continuously while the ticket inspectors move throughout SL's geographical area
area and in all types of traffic. That a ticket inspector has a so-called badge
on the arm, it is not certain that you as a traveler will pay attention.
The Court of Appeal in Stockholm has in a judgment addressed the burden of proof but has not
touched on the question of the importance of the principle of responsibility for the placement of the burden of proof.
The starting point should be that the burden of proof lies with IMY when it applies
the question of whether there are conditions for imposing a penalty fee. When it
THE COURT OF CHAMBER
IN STOCKHOLM
VERDICT Page 3
Department 01 Case No. 1552-22
applies to questions about whether a personal data controller complies with the requirements regarding
personal data, however, the principle of liability must be taken into account. The
personal data controller has an obligation to show that i.a. the principles of
legality and data minimization in Article 5 of the EU Data Protection Regulation,
2016/679, (data protection regulation) is followed. SL has not been able to show that these
principles are adhered to.
That violations of the current provisions of the regulation may entail
penalty fees are clearly stated in the regulation. The circumstance
that SL began and also expanded its use of body-worn cameras during
the course of the inspection is important for the assessment of the sanction fee, which
also expressed by the administrative court. The Administrative Court has also made one
correct assessment of the issue of processing time.
SL
SL brings forward i.a. following. There is a lack of relevant practice, guidelines and
recommendations that speak for IMY's assessment. It is indisputable that
the processing of personal data when recording is activated during an ongoing
threatening or violent situation is necessary and proportionate.
The reality and conditions for ticket inspectors is that they know
threatening or violent incidents must first prioritize putting themselves
in safety. Activation of the body camera may therefore be de-prioritised
and the recording may thus be delayed.
The use of body-worn camera to ensure identity of
travelers who have to pay a surcharge is not disproportionate from the outside
circumstances. The intrusion into personal integrity that it entails
must be considered limited based on travelers' awareness of surveillance within
public transport and the technical and organizational security measures that
apply.
THE COURT OF CHAMBER
IN STOCKHOLM
JUDGMENT Page 4
Department 01 Case No. 1552-22
After the pilot project and during the course of the supervisory case has
the ticket controllers with which a first information layer has been equipped
a badge that informs that camera surveillance is taking place. Information is provided
in addition, partly on the website, partly on the receipt when the surcharge is issued.
The possible violation means that all relevant information does not
left in the right place or in the right order must take into account
the circumstances are considered limited.
The principle of liability in the Data Protection Regulation is not one
rule of evidence. The burden of proof, as well as the responsibility for investigation, rests with interventions
against an individual as the main rule on the decision-making authority.
The general principle of legal certainty under EU law stipulates that all
regulations, especially those prescribing sanctions, must be clear and
precise In the absence of guiding practice, it has not been possible to assess
with sufficient certainty about the use of body-worn cameras for
current purposes would mean that a penalty fee would be imposed, or
the amount of the penalty fee. Administrative law does not have enough
extent considering IMY's long processing time in the case.
REASONS FOR THE COURT OF COURT'S DECISION
What the goal applies to and starting points for the trial
The first question in the case is whether SL should impose a penalty fee on them
grounds invoked by IMY. If the assessment is that SL should be imposed
penalty fee, the next question is to test the size of the penalty fee.
It must be clearly stated that there are conditions for imposing a certain one
administrative sanction fee and it is IMY that has the burden of proof.
THE COURT OF CHAMBER
IN STOCKHOLM
JUDGMENT Page 5
Department 01 Case No. 1552-22
In order to assess the size of the penalty fee, a position must first be taken
the seriousness of the violations and then whether there are mitigations
or aggravating circumstances. In conclusion, an assessment of whether
the penalty fee is effective, proportionate and dissuasive.
The Court of Appeal's assessment
Use of body-worn cameras with pre-recording technology to
prevent and document threats and violence
In light of the type of situations in which pre-recording is actualized
and when it is also a question of using the material to document crimes
the Court of Appeal makes the same assessment as the Administrative Court in regard to
SL's use of body-worn cameras with a pre-recording time of one
minute to prevent and document threats and violence. What IMY stated about
The use of the police authority, which has other duties and powers
of body-worn cameras does not cause any other assessment. So there is
not grounds for imposing an administrative penalty fee in this part.
Use of body-worn cameras to ensure the identity of
travelers who must pay a surcharge
The Court of Appeal considers, like the administrative court, that the basis does not provide
support that it is necessary to routinely film with image and
audio recording to ensure the traveler's identity every time a
surcharge is printed. The Court of Appeal therefore makes the same assessment as
administrative law regarding SL's use of body-worn cameras for
to ensure the identity of travelers who must pay surcharges. In this
part, there are therefore conditions for imposing an administrative penalty fee.
THE COURT OF CHAMBER
IN STOCKHOLM
JUDGMENT Page 6
Department 01 Case No. 1552-22
Information to registered users
According to IMY and the administrative court, SL has breached its obligation to i
in accordance with Article 13 of the Data Protection Regulation, inform the data subjects
information to be provided if the personal data is collected from
the registered. Through the deficiencies in the information provided by
SL has also violated the principle of transparency in Article 5.1 of the regulation.
The data subject's right to information is regulated in Articles 12–15 i
data protection regulation. Article 13 states that if personal data which
relating to a registered person is collected from the registered person, it shall
personal data controller, when the personal data is obtained, provide certain
information to the registered. Article 14 states which information is
must be provided if the personal data has not been obtained from it
registered. The extent of the information obligation and the possibilities for
exceptions to this obligation differ between regulations. The
there is no definition in the data protection regulation of the concepts collected
from respectively received from the registered.
The Article 29 group, now the European Data Protection Board, has in its
guidelines on transparency according to the data protection regulation adopted on
November 29, 2017, stated that personal data to be counted as
collected from the data subjects includes data collected through
observation using e.g. cameras (p. 26) and that Article 13 is thus
applicable.
The first question the Court of Appeal must decide is about collection of
personal data using a body-worn camera is to be considered that
the data collected from the data subject.
The Swedish Camera Surveillance Act (2018:1200) does not specify in what
legal text or preparatory works which article the law relies on
THE COURT OF CHAMBER
IN STOCKHOLM
JUDGMENT Page 7
Department 01 Case No. 1552-22
the information requirement for camera surveillance. Neither gives the reasons in
data protection regulation support for Article 13 to be applicable in such cases
treatment that is current in the target.
The Court of Appeal notes that the European Court of Justice in a judgment on 11 December 2014
regarding camera surveillance carried out by a private person (C-212/13,
EU:C:2014:2428) as the applicable law stated i.a. the provision which
is now found in Article 14 of the Data Protection Regulation. The goal was one
camera which was permanently mounted and which filmed e.g. a public road.
The wording of Article 13 – collected from the data subject – indicates as follows
the Court of Appeals that some type of deliberate action is required from it
registered for the personal data to be considered to have been collected from him.
This cannot be considered the case when personal data is collected by means of
the current body-worn cameras. The Court of Appeal therefore considers that
the wording of the provision, taken together with the ruling of the European Court of Justice,
argues that Article 13 is not applicable. What is stated in Article 29-
Against this background, the group's guidelines have no decisive significance.
IMY thus had no reason to impose a penalty fee in this part
on the basis that SL breached its obligation to provide information according to Article 13.
The size of the penalty fee
The Court of Appeal has made the assessment that SL's treatment of
personal data to identify travelers who must pay surcharges have
entailed a violation of the data protection regulation. It has been about one
extensive personal data processing of a large number of data subjects in a large
part of public transport. The treatment has been going on for a relatively long time and
the Court of Appeal considers that it is a serious violation. What SL
has stated that this was done without intent and not through negligence
does not change this assessment.