NAIH (Hungary) - NAIH-3734-15/2023

NAIH - NAIH-3734-15/2023
Authority:	NAIH (Hungary)
Jurisdiction:	Hungary
Relevant Law:	Article 6(1)(f) GDPR Article 38(2) GDPR Article 58(2)(d) GDPR Article 83 GDPR 2005. évi CXXXIII. törvény - Law 133 of 2005 about the rules of the activity to protect the security of persons and assets and of private detectives Procedural laws concerning administrative procedures and judicial redress
Type:	Complaint
Outcome:	Partly Upheld
Started:	24.02.2023
Decided:	30.11.2023
Published:	30.11.2023
Fine:	n/a
Parties:	n/a
National Case Number/Name:	NAIH-3734-15/2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Hungarian
Original Source:	Decision (in HU)
Initial Contributor:	Lszabo

The Hungarian DPA reprimanded a controller for breaching Article 6(1)(f) GDPR. Although the surveillance system installed by the controller was legitimate, it covered a too wide area and, thus, the processing at the time of the complaint was not proportionate.

English Summary

Facts

The Hungarian DPA received a complaint from a data subject regarding the presence of surveillance cameras outside a shop of the controller covering a wide public area in front of its entrance.

Due to the angle and distance of the cameras, the people recorded were not identifiable since the image of an adult person, for example, could only be recorded up to the waist. A warning sign of camera surveillance and an information sheet were present at the store's entrance, as well as on the gate next to the store's entrance and on the panel covering the front door when the store is closed.

Following a request by the DPA on 8 March 2023, the controller made a minor modification to the camera's field of view by means of physical masking in such a way that it covered only a smaller portion of the public road. The controller further explained that the legal basis for the surveillance in question was its legitimate interest: to prevent and detect stealth and vandalism. To corroborate this, he gave a few examples of incidents and explained that some burglars covered their faces when entering the shop, meaning that it was not sufficient to observe only the shop. The controller also presented an assessment weighing the interest of privacy against his legitimate interest in protecting his property. He explained that storage of the images was necessary to reconstruct what happened and discover who committed the infraction during an investigation.

Holding

Considering the balancing assessment presented by the controller, the DPA acknowledged that the controller had a legitimate interest in installing the surveillance system. However, the DPA found it necessary to consider whether it was necessary and proportionate for the surveillance system to also cover certain parts of public areas. In this respect, the DPA stated that the controller failed to justify why the camera surveillance could also cover areas not part of its property. Moreover, considering that surveilling the public area in front of the shop would also limit the freedom of the people walking on the sidewalk, the DPA found the area covered by the system to be disproportionate to its purpose.

Thus, the DPA decided that there had been a breach of Article 6(1)(f) GDPR since, although the surveillance system was legitimate, it covered a too wide area. Hence, the processing at the time of the complaint was not proportionate with respect to the purposes of the data processing.

Due to the breach found, the DPA issued a reprimand and ordered the controller, pursuant to Article 58(2)(d) GDPR, to further narrow the scope of observation of the surveillance system by excluding the public areas.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Hungarian original. Please refer to the Hungarian original for more details.

Decision
The National Data Protection and Freedom of Information Authority 
(hereinafter: the Authority) […] of the applicant 
(residential address: [...]; hereinafter: the Applicant) arrived at the Authority on February 24, 2023, and on March 1, 2023, the [ ...] 
(headquarters: [...]; company registration number: [...]; hereinafter: Applicant) in the data protection official proceedings initiated against the public space surveillance camera operated by him on the street front of the building at […], the Authority makes the following decisions : 
I.	At the request of the Applicant, the Authority determines that the Applicant has violated European Regulation No. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free flow of such data, as well as on the repeal of Regulation 95/46/EC 
II.	(General Data Protection Regulation) Article 6 
III.	(1) point f) of the parliamentary and council 
IV.	(EU) regulation 
V.	(hereinafter: GDPR). 
VI.	The Authority grants the Requester's request and, based on Article 58
VII.	(2)
VIII.	(d) of the GDPR, orders the Requester to stop monitoring the public road or the area suitable for parking between the public road and the sidewalk with a camera 
IX.	The Authority dismissed the Petitioner for the violation established in point I gives you a warning. 
The II.The Respondent must take the measure prescribed in point II. within 30 days from the date of delivery of this decision, and immediately prove it to the Authority, together with the submission of supporting evidence. There is no place for an administrative appeal against this decision and order, but it can be challenged in an administrative lawsuit within 30 days from the date of notification. 
The statement of claim must be submitted electronically to the Authority, which forwards it to the court together with the case documents. The request to hold a hearing must be indicated in the statement of claim. In the case against the order, the court acts in a simplified case, outside of a trial. For those who do not benefit from the full personal tax exemption, the fee for the administrative lawsuit is HUF 30,000, the lawsuit is subject to the right to file a tax record. Legal representation is mandatory in proceedings before the Metropolitan Court. 1 The NAIH_K01 form is used to initiate the administrative lawsuit. The form can be filled out using the general form filling program 
(ÁNYK program). The form is available and can be downloaded from the Authority's website: https://www.naih.hu/kozig-hatarozat-birosagi-felulvizsgalata 

Justification
I. Subject of the procedure 
(1) The Requester's request for official data protection procedure was received by the Authority on February 24, 2023, in which it submitted that the Requester operates two cameras suitable for monitoring public areas on the street front facade of the building at […] - where a general store is otherwise operating - which are used to monitor the two neighboring they are also suitable for monitoring the area in front of the property. 
(2) The Applicant is considered affected because his spouse is a part owner of the property at […], where renovation work is being carried out, so he regularly turns around in the field of view of the cameras placed on the front of the store, monitoring the public area. 
(3) According to the Applicant's knowledge, the previous owner of the Applicant, [...] can monitor the image transmitted by the cameras on his mobile phone. According to the Applicant's presentation, at one time […] he also called the police, as he was bothered by the fact that the owner of one of the neighboring properties stopped in the parking space created in front of the property at […], since, according to his point of view, he was hiding the business from customers. At that time, according to the Applicant's presentation, [...] was not at the scene, but was watching the camera footage through his mobile phone. 
(4) The Applicant requested that the Authority oblige the Applicant to stop the illegal behavior and sanction the Applicant in the strictest possible way. 

II. Facts
(5) The Applicant operates an electronic surveillance system in the grocery store operating in the property owned by […], as well as on the street front of the property, which is thus suitable for monitoring the public area. 
(6) Two cameras were placed on the street front of the property. Until March 7, 2023, these include the sidewalk in front of the property, a small part of the sidewalk in front of the two neighboring properties, the area suitable for parking in front of the property, between the public road and the sidewalk, as well as part of the public road and the trodden sidewalk on the other side of the public road a part of the path without was observed, however, due to the setting of the viewing angle and the distance, the image of the people traveling on the path was not recorded in a way suitable for identification, since the image of an adult person could only be recorded up to waist height. 
(7) After receiving the Authority's request, on March 8, 2023, the Respondent made a minor modification to the camera's field of view by means of physical masking in such a way that it is no longer suitable for the sidewalk in front of the neighboring properties and the opposite to observe a well-trodden path, and even a smaller part of the public road than before - smaller than a car - falls into the field of view of the cameras. The cameras will still be able to see the sidewalk in front of the store, as well as the area suitable for parking in front of the store, between the road and the sidewalk. 
(8) The Respondent indicated the protection of persons and property as the reason for the operation of the camera system, since only one employee works in the store at a time, the area around the property is typically deserted in the early and late hours, i.e. the cameras also serve to protect the life and physical integrity of the employees. According to the information available on the Internet and the photographs attached by the Applicant, the store is open on weekdays from 7:00 a.m. to 10:00 p.m., on Saturdays from 10:00 a.m. to 10:00 p.m., and on Sundays from 4:00 p.m. to 10:00 p.m. According to the respondent's statement, the morning opening time is 6:00 a.m. Opposite the property 3 the ... works […] University […]. According to the Applicant's statement, pedestrian traffic in the street is hectic during the day, which is also influenced by the order of education, however, the main entrance of the university does not open from […] street, but from […] street. 
(9) As the legal basis for the data processing carried out in the public area by means of the camera system, the Respondent indicated its legitimate interest in data processing, in support of which it prepared an interest assessment test, which forms Annex No. 2 of the Camera Regulations attached by the Respondent. The Camera Regulations, together with its annexes, have been in effect since August 1, 2022. 
(10) In order to prove the legality of the interest, the Respondent referred to Act CXXXIII of 2005 on the rules for the protection of persons and property, as well as private investigative activities. to Article 31 (1) of the law - previously in force - according to which the form of the electronic surveillance system that enables image, sound or image and sound recording can be used for the protection of human life, physical integrity, personal freedom, (...) and property protection (…). In the weighing of interests test regarding the authenticity and actuality of the legitimate interest, the Respondent explained that the protection of personal and property is a genuine interest defined in legislation, and the investigation of suspicions pointing to extraordinary events arising in the business is the fundamental economic interest of the data controller. According to the Respondent, the legitimate interest is current, because both the protection of persons and property, as well as the investigation of emerging emergency cases, are based on needs and events that occur constantly, continuously, or usually in the practice of the Respondent. Due to the location of the property, the number of passers-by and those driving on it is hectic, in the event of a possible break-in, robbery, theft or attack, the existence of witnesses is uncertain. 
(11) In the weighing of interests test, the Respondent also stated that the protection of persons and property is a general societal interest, which in a broader sense is related to the effective detection of crimes and public safety. 
(12) It was also explained in terms of the necessity of data processing that the operation of the electronic monitoring system is for the protection of real estate, human life and physical integrity, property protection, as well as the prevention and detection of possible extraordinary events, the prosecution of their perpetrators, and the prevention of illegal acts. The operation of the camera system contributes significantly to the achievement of these goals, because the incidents listed above can be significantly prevented when possible perpetrators are aware that their actions are being recorded by cameras, thus their illegal behavior will be easier to investigate afterwards. 
(13) In the interest assessment test, the Respondent further explained that there is no technique or system that can be used to reconstruct what happened during an extraordinary event or crime without recording images and videos, so achieving these goals is less restrictive and offensive to the informational self-determination and privacy rights of those concerned. method cannot be ensured. The operation of an alarm system - with which the property is equipped anyway - would be suitable exclusively from the point of view of property protection, but it does not enable the investigation and detection of extraordinary events or crimes, or the identification of perpetrators. The anonymization of the recordings or the live surveillance without recording would make it impossible to investigate and prove possible extraordinary events and crimes, and the possible proceedings would also be hindered by the lack of the recording as evidence. 
(14) In the weighing of interests test, it is recorded that camera surveillance limits the right of informational self-determination of those concerned, however, according to the Respondent's point of view, the restriction is necessary and proportionate. The reason for this is that "data processing is negative for the data subject 4 its effects are offset by its positive effects and the fact that data processing is predictable. ” According to the weighing of interests test, the balance is tipped towards the permissibility of data processing by personal and or ensuring security, cases of disturbances and break-ins and thefts occurring several times in the area, comprehensive information provided by the Requested Party, and data security and data protection measures taken to protect the affected parties. 
(15) As part of the data security measures, it was recorded that the indirect image from the cameras can only be seen by staff members and not by customers. The recordings are recorded on a separate data medium, to which only the manager of the Respondent is entitled to access. All activities performed on files containing recordings – deletion, archiving, extraction – are logged in the system. 
(16) In order to support his legitimate interest, the Respondent submitted in his statement - separately from the interest assessment test - that there are several shops within a 500-meter radius of the shop, where thefts and vandalism are regular, and therefore he considered the installation of street front cameras justified. According to the presentation of the Applicant, the store has been stolen 8-10 times in the last 8 years. For this reason, the manager of the Respondent filed two reports, on the basis of which infringement procedures were initiated, given that the thefts were committed for a value not exceeding fifty thousand forints, i.e. they did not reach the infringement value limit. 
(17) According to the Respondent's statement, there was a case when the perpetrator waited outside the entrance and waited until no one was in the store except for the employee, while in other cases the perpetrator took the hood of the jacket or sweater in front of the entrance only to cameras should not show your face. As a result, according to the Respondent's point of view, the existence of cameras placed on the street front, and the adjustment of their angle of view in such a way that the faces of those who enter are visible, are essential in identifying the perpetrators. 
(18) Images are recorded with the installed cameras, the type of recorder is MaZi HAVR-1672H1. The recorder is connected to a router and has internet access. The mobile application for the cameras is iVMS-4500 4.7.11 (Build 20211023), through which the images of the cameras are available, the application logs exits and entries, the application is password protected. 
(19) The recording time recorded by the cameras is 48 hours. 
(20) According to the Respondent's statement and the evidence of the photographs attached by him, he informs the persons concerned about the data processing taking place with a sign warning of camera surveillance and a posted text data processing information sheet at the entrance of the store. A sign warning of camera surveillance was also placed on the gate next to the store's entrance, as well as on the panel covering the front door when the store is closed. 
(21) The Applicant has attached its "Regulations for the use of the camera surveillance system", the balance of interests test - described above - and its data processing information related to the data processing carried out by means of the camera surveillance system. 
(22) According to the Respondent's statement, the information sheet was placed on the door of the store, in which it informs those concerned about the operation of the camera surveillance system and that the cameras also record images. In the information, the Respondent indicated Article 6 (1) (f) of the GDPR as the legal basis for data processing, indicating that the subject of the legitimate interest is the protection of personal and property. The information sheet includes the retention period of the recordings, as well as the contact details of the person entitled to access them. 
(23) In the information sheet, in relation to the rights of the data subjects, the Respondent informs the data subjects, among other things, that if the recording of the recordings affects their rights or legitimate interests, then 5 its yoke within 24 hours from the recording, you can ask the Application not to delete the recording. The information also includes legal remedies. 
(24) On behalf of the Applicant, the manager submitted - as an addition to the contents of the Applicant's application - that he had called the 112 emergency number on one occasion. The reason for this was that there are several apartments with a gate in the property at […]. The Applicant's family members regularly park in the parking lot, preventing the other residents from using the parking lot and entering the yard of the property, therefore the residents of the neighboring property and those coming to them use the parking space in front of the store - the area suitable for parking between the public road and the sidewalk - it is occupied, so customers cannot stop in front of the store, which, in his opinion, causes a disadvantage for him. The Applicant submitted that it is also prohibited to park in front of one's own gate, if the property has several parts of the house owned by different owners. This is considered a violation, which is why the emergency dispatcher sent the police. 
(25) The Authority contacted the […] Police Department in order to be able to decide on the legality of the data processing carried out by means of the camera system, as well as whether the legitimate interest of the data controller according to Article 6 (1) point f) of the GDPR actually exists, and whether the does data processing carried out in order to enforce a legitimate interest proportionately limit the right of the data subject to the protection of personal data to the goal to be achieved with the data processing – personal and property protection – it is necessary to know how common the crimes and violations mentioned by the Respondent are in the vicinity of the property – theft, vandalism , physical assault - and how they compare to the city average. 
(26) The […] Police Department informed the Authority that the Unified Investigation Authority and Prosecutor's Office Crime Statistics (hereinafter: ENyÜBS) does not contain data on the proceedings completed in the current year, but rather on those committed in the current year. In the area of […] for the years 2018-2022, the number of crimes registered in the police procedure based on ENyÜBS data was as follows: in 2018, 918 thefts, 63 vandalism, 18 robberies, 20 bodily harm; In 2019, 631 thefts, 51 vandalism, 7 robberies, 124 assaults; in 2020, 447 thefts, 72 vandalism, 13 robberies, 126 assaults; in 2021, 554 thefts, 83 vandalism, 12 robberies, 130 assaults; In 2022, 439 thefts, 56 vandalism, 11 robberies, 114 assaults. The number of violations against property was 730 in 2018, 729 in 2019, 583 in 2020, 577 in 2021, and 649 in 2022. 
(27) The [...] Police Department informed the Authority that neither the ENyÜBS nor the statistics that can be extracted from the Netzsaru [...] system, which contains data on violations, contain any data that would show where within the city, on which street, in which district the crimes, violations of regulations, so it cannot provide information on how many property crimes or violations have occurred in [...] street in the last 5 years. 
(28) In order to find out the nature of the known crimes and violations committed against the Respondent, the Authority obtained the relevant documents of the proceedings - report, testimony of the Respondent's manager or employees - from the […] Police Department, in which the Respondent or the Respondent's former owner, […] filed the complaint . 
(29) During the official procedure, there was a change in the person of the manager and owner of the Respondent, from June 15, 2023, the manager of the Respondent, and from August 15, 2023, the owner […].

III. Applicable legislation 
(30) Based on Article 2 (1) of the GDPR, the GDPR must be applied to the data processing in this case. 
(31) Recital (47) GDPR: The data controller - including the data controller with whom the personal data may be disclosed - or the legitimate interest of a third party may create a legal basis for data processing, provided that the interests, fundamental rights and freedoms of the data subject do not take precedence, taking into account the data controller the reasonable expectations of the person concerned based on their relationship. Such a legitimate interest can be discussed, for example, when there is a relevant and appropriate relationship between the data subject and the data controller, for example in cases where the data subject is a client of the data controller or is employed by it. In order to establish the existence of a legitimate interest, it is necessary to carefully examine, among other things, whether the data subject can reasonably expect, at the time and in connection with the collection of personal data, that data processing may take place for the given purpose. The interests and fundamental rights of the data subject may take precedence over the interests of the data controller if the personal data are processed under circumstances in which the data subjects do not expect further data processing. Since it is the task of the legislator to determine by law the legal basis on which public authorities may process personal data, the legal basis supporting the legitimate interest of the data controller cannot be applied to data processing carried out by public authorities in the performance of their duties. The absolutely necessary processing of personal data for the purpose of preventing fraud is also considered a legitimate interest of the data controller concerned. The processing of personal data for direct business purposes is also considered to be based on a legitimate interest. 
(32) GDPR Recital (148): In order to strengthen compliance with the rules prescribed by this regulation, in the event of any violation of this regulation, sanctions, including administrative fines, must be imposed in addition to or instead of the appropriate measures prescribed by the supervisory authority based on this regulation. In case of a minor violation of this regulation, or if the fine likely to be imposed would represent a disproportionate burden for a natural person, a reprimand can be applied instead of a fine. However, due attention must be paid to the nature, severity, duration, and intentionality of the violation and whether measures were taken to reduce the amount of damage suffered, as well as the extent of responsibility, previous violations in this area, how the supervisory authority became aware of the violation, as well as whether the data manager or data processor complies with the measures ordered against it and whether it applies a code of conduct, as well as any other aggravating or mitigating circumstances. Appropriate procedural guarantees, including effective legal protection and the right to a fair trial, must be applied to the imposition of sanctions, including administrative fines, in accordance with the general principles of EU law and the Charter. 
(33) Article 6 (1) GDPR: The processing of personal data is legal only if and to the extent that at least one of the following is fulfilled: the) the data subject has given his consent to the processing of his personal data for one or more specific purposes; b) the data processing is necessary for the fulfillment of a contract in which the data subject is one of the parties, or it is necessary for taking steps at the request of the data subject prior to the conclusion of the contract; c) of data processing and is necessary to fulfill the legal obligation of the data controller; d) data processing is necessary to protect the vital interests of the data subject or another natural person; e) data processing is in the public interest or is necessary for the execution of a task performed in the context of the exercise of public authority granted to the data controller; 7 f) data processing is necessary to enforce the legitimate interests of the data controller or a third party, unless these interests are overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data, especially if the data subject is a child. Point f) of the first subparagraph cannot be applied to data processing carried out by public authorities in the performance of their duties. 
(34) Article 58 (2) point b) of the GDPR: Acting within the corrective powers of the supervisory authority: b) condemn the data manager or the data processor if their data processing activities violated the provisions of this regulation; d) instructs the data controller or the data processor to bring its data processing operations into line with the provisions of this regulation - in a specified manner and within a specified period of time; 
(35) Article 77 (1) GDPR: Without prejudice to other administrative or judicial remedies, all data subjects have the right to file a complaint with a supervisory authority – in particular in the Member State of their usual place of residence, place of work or place of suspected infringement – if the data subject in his opinion, the processing of his personal data violates this regulation. 
(36) Infotv. Section 2 (2): For the processing of personal data falling within the scope of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: General Data Protection Regulation), the General Data Protection Regulation shall be applied in Articles III-V. and VI/A. Chapter, as well as Section 3, Section 3, 4, 6, 11, 12, 13, 16, 17, 21, 23-24 point, paragraph (5) of § 4, paragraphs  (3)- (5),  (7) and  (8) of § 5, paragraph  (2) of § 13, § 23, § 25 in § 25/G. in paragraphs  (3),  (4) and  (6) of § 25/H. §  (2), 25/M. in paragraph  (2) of § 25/N. § 51/A. in paragraph  (1) of § 52-54. §, § 55  (1)- (2), § 56-60. § 60/A. §§  (1)- (3) and  (6), § 61 §  (1) points a) and c), § 61 § § 61 paragraphs  (2) and  (3), § 4 § b) and  (6)- (10), paragraphs 62-71. §, § 72, § 75  (1)- (5), § 75/A. § and shall be applied with the additions specified in Annex 1. 
(37) Infotv. Pursuant to Section 60 (1), in order to assert the right to the protection of personal data, the Authority may initiate official data protection proceedings ex officio. CL of 2016 on the general administrative procedure for the official data protection procedure. Act 
(hereinafter: Ákr.) shall be applied with the additions specified in the Infotv. and the deviations according to the general data protection regulation. 
(38) Infotv. 75/A. §: The Authority exercises its powers contained in paragraphs (2)-(6) of Article 83 of the General Data Protection Regulation by taking into account the principle of proportionality, in particular by the fact that, for the first time, the regulations on the handling of personal data - defined in legislation or in a binding legal act of the European Union in the event of a violation, in accordance with Article 58 of the General Data Protection Regulation, measures are taken to remedy the violation, primarily by warning the data controller or data processor. 
(39) CL of 2016 on the general administrative procedure for the official data protection procedure. Act (hereinafter: Ákr.) shall be applied with the additions specified in the Infotv. and the deviations according to the general data protection regulation. 

IV. Decision 

IV.1. The legality of monitoring public space 
(40) In the present procedure, the Authority must assess whether the processing of data by the Respondent through the camera system is necessary for the purposes of personal and property protection, as well as crime prevention and detection, as well as the limitation of rights associated with data processing - the limitation of the right to protect personal data – is it proportionate to the goal to be achieved? 
(41) The Authority primarily considers it necessary to record that the Court of Justice of the European Union (hereinafter: CJEU) in C-212/13. no., in the case of František Ryneš v. Úřad pro ochranu osobnyk dátní, he stated that if the video camera surveillance system continuously records and stores personal data, and if it even partially covers public space, i.e. the data processing is directed outside the private sphere of the data controller, it cannot be considered data processing for household purposes. However, this does not mean that in justified cases, in the event that the conditions set forth in Article 6, Paragraph (1) point f) of the GDPR exist, in addition to providing adequate guarantees, camera surveillance of parts of public areas should not take place in proportion to the desired goal. 
(42) Article 6 (1) point f) of the GDPR
the processing of personal data is lawful if and to the extent that the processing is necessary to enforce the legitimate interests of the data controller or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data take precedence over these interests , especially if a child is involved. 
(43) The legitimate interest of the Respondent, and also the purpose of the data processing, is to protect its store from vandalism, prevent theft there, ensure the safety of its employees, and in the event of a crime or rule violation, facilitate their detection and provide evidence during the proceedings. 
(44) However, for the legality of data processing, it is not sufficient that a legitimate legitimate interest related to data processing can be identified on the side of the data controller, but that it is based on EUB C-708/18. according to point 44 of its judgment no., it must be existing and actual at the time of data processing, and it cannot be theoretical or hypothetical at this time. 
(45) According to the Authority's point of view, the Respondent's legitimate interest in data processing can be considered existing and actual, as it has been confirmed by the […] Police Department that there have already been minor crimes against property in the Respondent's shop, for which infringement or criminal proceedings have been initiated. 
(46) In the attached balance of interests test, the Respondent examined the alternatives to data processing implemented by means of street-front cameras, i.e. whether there is a method that is equally suitable for achieving the data processing goal, but involves less legal restrictions, or does not involve legal restrictions, i.e. the handling of personal data. The Authority accepts the Respondent's argument that the operation of the alarm system alone - which the store has anyway - is not a real alternative in the specific case, since it only operates outside opening hours, but does not provide protection against minor thefts committed during opening hours, in relation to those does not have a deterrent effect. 9 
(47) The European Data Protection Board 3/2019. in point 27 of its guidelines on the handling of personal data with video devices (hereinafter: Guidelines)2, it was explained that "it is usually necessary to use video camera surveillance up to the border of the property to protect the area and premises of the data controllers. However, it happens that monitoring the property is not enough for effective protection. In some individual cases, it may be necessary to extend the video surveillance to the surrounding areas. In this context, the data controller should resort to physical and technical solutions, such as covering or marking out non-relevant areas." 
(48) According to the Authority's point of view, when assessing the legality of camera data processing in public areas, it should be taken into account that there is no front yard between the building housing the store and the sidewalk, the store's entrance opens directly onto the street, so camera surveillance of the store's entrance can only be carried out in such a way that a small part of the public area also falls under the fact that the monitored area can be reduced by masking the cameras. Until March 7, 2023, the Applicant did not use masking on the cameras, but from March 8, 2023, it will use masking, i.e. the sidewalk sections in front of the neighboring properties, the beaten path opposite and a part of the public road were covered. The cameras monitor the sidewalk in front of the store, the area suitable for parking in front of the store, between the public road and the sidewalk, and the public road to a lesser extent than before. 
(49) According to the Authority's point of view, the fact that the shop is open every day until 22:00, on a street with varying traffic during the day, but with little traffic in the evenings, and the fact that there is usually only one employee in the shop at the same time should also be taken into account in connection with the existence of a legitimate interest in monitoring the public area. The Authority's position is that the cameras placed on the street front already have a deterrent effect in connection with the commission of crimes, and if someone nevertheless commits a crime to the detriment of the Applicant, the images recorded by the cameras placed on the street front can contribute to the identification of the perpetrator, if, for example, the hood or cap is put on by the offender in front of the entrance to the store, but it can also be important in relation to the investigation of the crime, for example in terms of the direction in which the offender leaves the store, thus facilitating the work of the investigative authority, in which area the police may be worth reviewing or the images of surveillance cameras operated by the municipality. 
(50) The Authority considers it necessary to note here that the Applicant referred in his statement to the Authority to the fact that there are cases when the perpetrators cover their faces on the street, in front of the store, however, this aspect was not presented by the Applicant in the balance of interests test, however, since the ada is relevant from the point of view of the legitimate interest related to the treatment, so the Authority will take it into account anyway. 
(51) In the interest assessment test and in the identification of its legitimate interest in data processing, the Applicant did not separate certain parts of the public area, i.e. it considered its legitimate interest to be uniformly present in monitoring the sidewalk, the public road, and the area suitable for parking between them. However, according to the Authority's point of view, in the context of the necessity and proportionality of data processing, the extent to which the monitoring of certain parts of the public space is necessary to assert the legitimate interest of the Respondent should be examined. 
(52) As the Authority has already referred to above, according to point 27 of the Guidelines, in certain, justified cases, camera surveillance can be extended to the strip extending beyond the boundary of the property - thus to public land - by limiting it to the most necessary area. 2 https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_hu.pdf 10 
(53) During the procedure, the Respondent did not provide any circumstances that would have supported the need for such a wide surveillance of the public area, nor did any circumstances indicating this arise in the documents obtained from the Police Department. 
(54) Nevertheless, in this particular case, according to the Authority's point of view, the camera surveillance directed at the narrow lane beyond the boundary of the property, in this case the sidewalk, only slightly restricts the rights and freedoms of the persons concerned, since although the cameras record their images and movements, the surveillance is limited to only a narrow section of the sidewalk . 
(55) In view of the above, the position of the Authority is that, according to the above, the Respondent has a legitimate interest in the monitoring of the narrow area directly in front of the store, carried out continuously since the receipt of the request and continuously since then, by means of the cameras operated by the Respondent on the street front of the store, the actual and existing , and the data processing is in this interest and is necessary to achieve the resulting data processing goal, i.e. to adequately ensure asset protection, and the limitation of rights is proportionate to the goal to be achieved, i.e. in this respect, its data processing can be considered legal. 
(56) Based on the Applicant's request, the Authority examined whether the extent of data processing carried out by means of cameras was legal until March 8, 2023 - that is, before the Applicant carried out the masking - and thereafter. According to the Authority's point of view, the legitimate interest related to data processing already existed before March 8, 2023 based on point (50), however, the scope of the monitoring - the sidewalk section in front of neighboring properties, the area suitable for parking between the public road and the sidewalk, the public road, and the observation of a part of the well-trodden, unpaved path on the other side of the road - exceeded the amount necessary to achieve the data processing goal and assert the legitimate interest. As a result, the Respondent monitored the public area to a disproportionate extent both before and after the masking was carried out, since the level of monitoring and data processing established in points (47)-(50) is sufficient to achieve the data processing goal. Based on all of this, the Authority concludes that until March 8, 2023, the Respondent illegally operated the cameras placed on the street front of the building at [...] in violation of Article 6 (1) point f) of the GDPR in such a way that they were suitable for neighboring properties the sidewalk section in front of the property, the areas suitable for parking between the public road and the sidewalk in front of the neighboring properties and the store, the public road and a part of the well-trodden, unpaved path on the other side of the road, as well as the fact that the cameras currently, March 2023 With its settings used since 8, the Respondent violated Article 6 (1) point f) of the GDPR when, with reference to its legitimate interest as explained above, it did not ensure that the data processing was proportionate during the surveillance using the cameras installed on the building at […] , and thereby observed not only the sidewalk section in front of the store, but also the public road, as well as the parking area in front of the store, between the public road and the sidewalk. 

IV.2. Decision on the Applicant's requests 
(57) The Applicant requested that the Authority oblige the Applicant to stop the illegal behavior and sanction the Applicant in the strictest possible way. 
(58) The Authority interpreted the latter request as a request for the imposition of a data protection fine based on its wording. 
(59) The Authority rejects the Applicant's request for the imposition of a data protection fine, as the application of this legal consequence does not directly affect the Applicant's right or legitimate interest, such a decision by the Authority does not give rise to any right or obligation for him, and as a result, with regard to the application of this legal consequence that falls within the scope of enforcing the public interest - the 11 regarding the imposition of fines - the Applicant does not qualify as a customer under Art. Based on paragraph (1) of § 10, therefore, in this regard, I submit an application there is no room for revision, this part of the submission cannot be interpreted as a request. 

IV.3. Legal consequences 
(60) The Authority finds that the Respondent has violated Article 6 (1) point f) of the GDPR. 
(61) The Authority grants the Requester's request and, based on Article 58 (2) point d) of the GDPR, instructs the Requester to bring its data processing in line with the GDPR, i.e. to eliminate the public area - not including the sidewalk section in front of the store -, i.e. monitoring the public road and the area suitable for parking in front of the store, between the public road and the sidewalk, either by moving or removing the cameras, or by masking. 
(62) Infotv. 75/A. §, the Authority exercises its powers contained in paragraphs (2)-(6) of Article 83 of the General Data Protection Regulation, taking into account the principle of proportionality, in particular that the regulations on the handling of personal data - defined in legislation or in a binding legal act of the European Union - for the first time in the event of a violation, in accordance with Article 58 of the General Data Protection Regulation, measures are taken to remedy the violation, primarily by warning the data controller or data processor. 
(63) The Authority does not consider it necessary to impose a data protection fine on the Respondent, given that the Respondent violated the provisions of the GDPR for the first time, and also took measures to legalize the scope of data processing during the procedure. 
(64) Based on all of this, the Authority's position is that the established violation cannot be considered serious enough to justify the application of a data protection fine, so it considers the warning to be a sufficient sanction, taking into account the preamble (148) of the GDPR, according to which in case of a minor violation of the GDPR, a reprimand instead of a fine can be applied. 
(65) Based on all of this, the Authority made a decision in accordance with the provisions of the statutory part. A. Other questions 
(66) The competence of the Authority is set by Infotv. Section 38, paragraphs (2) and (2a), its jurisdiction covers the entire territory of the country. 
(67) The decision is in Art. 80-81 § and Infotv. It is based on paragraph (1) of § 61. The decision is in Art. Based on § 82, paragraph (1), it becomes final upon its publication. 
(68) The Akr. According to § 112 and § 116, paragraph (1), and § 114, paragraph (1), the decision and the termination order can be appealed through a public administrative lawsuit. 
(69) The rules of the administrative proceedings are determined by Act I of 2017 on the Administrative Procedures (hereinafter: Act). The Kp. On the basis of § 12, paragraph (1), the administrative lawsuit against the Authority's decision falls under the jurisdiction of the court, the lawsuit is referred to in the Kp. On the basis of § 13, paragraph (3) point a) point aa), the Metropolitan Court is exclusively competent. The Kp. On the basis of § 27, paragraph (1) point b), legal representation is mandatory in a lawsuit within the jurisdiction of the court. The Kp. According to § 39, paragraph (6), the submission of the claim does not have the effect of postponing the entry into force of the administrative act. 12 
(70) The Kp. Paragraph (1) of § 29 and, in view of this, Pp. CCXXII of 2015 on the general rules of electronic administration and trust services, applicable according to § 604. Act (hereinafter: E-Administration Act) § 9, paragraph (1), point b), the client's legal representative is obliged to maintain electronic contact. 
(71) The time and place of submitting the statement of claim is set by Kp. It is defined by § 39, paragraph (1). Information about the possibility of a request to hold a hearing can be found in Kp. It is based on paragraphs (1)-(2) of § 77. The amount of the fee for the administrative lawsuit is determined by Act XCIII of 1990 on fees. Act  (hereinafter: Itv.) 45/A. Section  (1) defines. Regarding the advance payment of the fee, the Itv. Paragraph  (1) of § 59 and point h) of § 62  (1) exempt the party initiating the procedure. 
(72) If the Applicants do not provide adequate proof of the fulfillment of their required obligations, the Authority considers that the obligation was not fulfilled within the deadline. The Akr. According to § 132, if the obligee has not complied with the obligation contained in the final decision of the authority, it can be enforced. The Authority's decision in Art. According to § 82, paragraph (1), it becomes final with the communication. The Akr. Pursuant to § 133, enforcement is ordered by the decision-making authority, unless otherwise provided by law or government decree. The Akr. Pursuant to § 134, the enforcement - unless otherwise provided by law, government decree or local government decree in local authority matters - is carried out by the state tax authority. Infotv. Pursuant to § 60, paragraph (7), the Authority undertakes the implementation of the decision in relation to the obligation to carry out a specific act, to behave in a specific manner, to tolerate or stop, contained in the Authority's decision. 
Budapest, November 30, 2023. 
Dr. Habil. Attila Péterfalvi
president 
honorary professor