Datainspektionen - DI-2019-7782
From GDPRhub
| Datainspektionen - DI-2019-7782 | |
|---|---|
 | |
| Authority: | Datainspektionen (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1) GDPR Article 9(2) GDPR Article 13 GDPR Article 35 GDPR Article 36 GDPR Kamerabevakningslagen (2018:1200) |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 24.11.2020 |
| Published: | 24.11.2020 |
| Fine: | 200000 SEK |
| Parties: | n/a |
| National Case Number/Name: | DI-2019-7782 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Swedish |
| Original Source: | Datainspektionen (in SV) |
| Initial Contributor: | Elisavet Dravalou |
The Swedish DPA (Datainspektionen) held that installation of CCTV cameras in an LSS home (housing with special services for adults) breached Articles 5(1)(a), 6(1), 9(2), 13, 35 and 36 GDPR and Section 15 Camera Surveillance Act. The DPA imposed a fine of SEK 200,000 (approx. €19500).
English Summary
Facts
On 2 May 2019, the Swedish DPA received a complaint from a relative of the data subject according to which Gnosjö's Social Affairs Committee (Socialutskott) processes personal data of a resident at one of the municipality's LSS homes (housing with special services for adults), through CCTV cameras. The Social Affairs Committee placed the CCTV cameras to increase the security of the resident, as the resident has demonstrated serious self-harming behaviour.
Dispute
The complainant claimed that the Social Affairs Committee should have stated that CCTV camera surveillance takes place and ask the consent from the resident's family or guardian.
Holding
The Swedish DPA held that, although the intention of the Social Affairs Committee was to protect the resident from harming himself, the installation of CCTV cameras in the resident's bedroom is considered a big intrusion of the resident's privacy. This means that the processing of personal data has been disproportionate to the purpose. The processing of personal data that has taken place through the camera surveillance has thus not complied with Articles 5(1)(a)(i), 6, 9(2), and 13 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Page 1 Decision Diarienr 1 (22) 2020-11-24 DI-2019-7782 Postal address: Box 8114, 104 20 Stockholm E-mail: datainspektionen@datainspektionen.se Website: www.datainspektionen.se Phone: 08-657 61 00 Gnosjö Municipality - Social Affairs Committee Supervision according to the EU Data Protection Regulation 2016/679 - camera surveillance on an LSS accommodation Table of Contents The Data Inspectorate's decision ................................................ ................................... 3 Administrative penalty fees ................................................ .................... 3 Report on the supervisory matter ............................................... ........................... 4 Background ................................................. .................................................. .. 4 What has emerged in the case ............................................. .................... 4 Motivation for decision ............................................... .............................................. 5 Personal data controller ................................................. .................................. 5 What rules apply to camera surveillance ............................................. ........... 6 The Data Inspectorate's assessment ................................................ .................. 6 Basic principles for the processing of personal data (Article 5) ...... 7 The Data Inspectorate's assessment ................................................ ................... 7 Legal basis for the processing of personal data (Article 6) ................... 9 The Data Inspectorate's assessment ................................................ ................. 10 Processing of sensitive personal data (Article 9) ...................................... 11 The Data Inspectorate's assessment ................................................ .................. 13 Impact assessment and prior consultation (Articles 35 and 36) ................. 13 The Data Inspectorate's assessment ................................................ ................. 15 Information for registered ............................................... .......................... 16 The Data Inspectorate's assessment ................................................ ................. 18 Choice of intervention ............................................... ................................................ 19 Legal regulation ................................................ ........................................... 19 Penalty fee ................................................. ............................................. 20 Page 2 The Data Inspectorate DI-2019-7782 2 (22) Appendix ................................................. .................................................. .......... 21 Copy for information to: ............................................. .................................. 21 How to appeal ............................................... ........................................... 21 Page 3 The Data Inspectorate DI-2019-7782 3 (22) The Data Inspectorate's decision The Data Inspectorate states that Gnosjö Municipality - Social Affairs Committee below the period March 2019 - April 2020, the camera has monitored a resident of an LSS living 1 in her bedroom and thereby processed personal data in violation of - Article 5 (1) (a) of the Data Protection Regulation 2 when the camera surveillance took place without legal basis and legal support for the treatment of personal data ie. not been legal. That the camera surveillance has been performed in a way that is more intrusive to the resident's personal privacy than what which can be considered reasonable, reasonable and proportionate in relation to the purpose, ie. did not live up to the requirements of accuracy as well as that the camera surveillance took place without the resident being prescribed information either under the Data Protection Regulation or the Camera Surveillance Act, ie. did not live up to the requirements of transparency. Article 6 (1) by processing personal data without having any legal basis for it, Article 9 (2) by processing sensitive personal data on disease and health condition without having legal support for it the treatment, Articles 35 and 36 by failing to meet the requirements of a impact assessment and not have prior consultation with The Data Inspectorate and Article 13 by failing to comply with the information requirement registered (the resident) and § 15 of the Camera Surveillance Act (2018: 1200) by not having left information about the camera surveillance through clear signage or on any other effective way. Administrative penalty fees The Data Inspectorate decides by decision pursuant to Articles 58 (2) and 83 i the Data Protection Ordinance, Chapter 6 Section 2 of the Act (2018: 218) with supplementary provisions of the EU Data Protection Regulation and § 25 point 4 i Camera Surveillance Act (2018: 1200) that Gnosjö Municipality - Social Affairs Committee for 1 Housing with special service according to law (1993: 387) on support and service to certain handicapped. 2 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on that free flow of such data and repealing Directive 95/46 / EC (General Data Protection Regulation). Page 4 The Data Inspectorate DI-2019-7782 4 (22) infringements of Article 5 (1) (a), Article 6 (1), Article 9 (2), Article 13, Article 35 and Article 36 of the Data Protection Ordinance and Section 15 of the Camera Surveillance Act shall pay an administrative penalty fee of SEK 200,000. Report on the supervisory matter Background On 2 May 2019, the Data Inspectorate received a report from another relative a resident of an LSS residence in Gnosjö municipality according to which the social committee in Gnosjö municipality (hereinafter the social committee) processes personal data through to camera monitor a resident at one of the municipality's LSS homes. According to notification, the social committee must have stated that the camera surveillance takes place with support of an approval / consent from the resident's family and former trustee of the resident. There is no approval / consent according to the submitter of the notification. The Data Inspectorate has due to the information that the notification contains initiated supervision for the purpose of reviewing the processing of personal data which the social committee must have carried out through camera surveillance is in accordance with the data protection rules and the camera surveillance law. The supervisory case began with a supervisory letter on 15 July 2019. Answer to The supervisory letter was received on 21 August 2019. Supplementary letters from The Social Affairs Committee has been received on 2 December 2019, 11 May 2020, 12 August 2020 and November 4, 2020. What has emerged in the case The Social Affairs Committee has processed personal data by real-time camera monitor a resident of an LSS residence in order to increase the security of it accommodation. The camera was installed in March 2019 and surveillance ceased on the 29th April 2020 in connection with the business being taken over by another contractor. The Social Affairs Committee has stated the following. The resident has lived in the LSS accommodation since the autumn of 2013. He needs support in his everyday life around the clock from two people, when he exposes himself to serious self-harming behavior and needs help to prevent this. In emotionally difficult situations, he wants to be himself in his own bedroom with closed door, the staff has then been in the living room and been prepared to enter if necessary. It has happened that it has become completely quiet inside Page 5 The Data Inspectorate DI-2019-7782 5 (22) at the resident's and when staff have opened the door to see how they are doing he slept but was awakened when the door was opened. The resident has then again become emotionally upset and risk of self-harming behavior has existed. At others On several occasions it has happened that the resident seriously injured himself without staff have heard something. During the resident's first time at the LSS accommodation, there were periodically three staff members service, despite this, it happened several times to both the resident and the staff was injured. There have been such serious incidents that it has involved one great danger to her life. After the staff group has received both training and guidance, the business decided that it is better for the resident to only have two staff on duty around the clock and they have been working since the spring 2014. The staff has noticed that when the resident becomes anxious and shows signs of wanting to harm themselves, staff or things, it passes more quickly if they lets him be alone in his bedroom. Since the camera was installed, there have been no serious incidents when the resident has been alone in the bedroom. The staff was able to quickly pay attention to what he had in mind and they have not had to disturb when he came to rest. The fact that the camera is installed does not mean a reduction of the number of staff on duty; they are always double-staffed around the clock. The camera is only used in real time to see how the resident is feeling, nothing material is saved. There is also no sound recording. If the resident wants staff inside their room, the staff is there and the camera is not used. Justification of decision Personal data manager The Social Affairs Committee has stated that the Social Affairs Committee is responsible for personal data the processing of personal data that has taken place through camera surveillance of a home in one of the municipality's LSS homes. This is supported by the inquiry where it appears that it is the Social Affairs Committee that decides on camera surveillance and specific purpose and means with personal data processing. Page 6 The Data Inspectorate DI-2019-7782 6 (22) What rules apply to camera surveillance Camera surveillance is a form of personal data processing. The Camera Surveillance Act (2013: 460), to which the Social Affairs Committee referred, was replaced on 1 August 2018 by the Camera Surveillance Act (2018: 1200) and it now applies in its place. How and to what extent it is allowed to camera surveillance is thus regulated in the Data Protection Regulation and the Camera Surveillance Act (KBL), which supplements the Data Protection Ordinance. Section 2 of the KBL states that the purpose of the law is to meet the need for camera surveillance for legitimate purposes and to protect natural persons against undue invasion of privacy during such surveillance. The definition of camera surveillance in § 3 KBL means, among other things, that it should be a matter of equipment, which without being maneuvered on site, is used on a methods that involve permanent or regular repeated personal surveillance According to § 7 KBL, a permit is required for camera surveillance of a place there the public has access, if the surveillance is to be conducted by an authority. The Social Affairs Committee is an authority and must therefore be based on it permission to camera-monitor a place to which the public has access. The question is then if the public is considered to have access to the seat of the Social Affairs Committee camera guards. Practice shows that the concept of “place where the public has access ”shall be interpreted broadly (see the Supreme Administrative Court's decision RÅ 2000 ref. 52). The Data Inspectorate's assessment The Data Inspectorate states that this is a matter of lasting and regular repeated personal surveillance, with a camera that is not operated on the spot, when the social committee uses camera surveillance and films a resident an LSS home, in his bedroom, in real time. In the light of what has emerged about the location of the surveillance, it living room, the Data Inspectorate assesses that it is not a question of a place to which the public has access. There is thus a requirement to apply for a permit not. The fact that the camera surveillance is unlicensed only means that the rules in the Camera Surveillance Act if a permit for camera surveillance does not apply. Other rules in the Camera Surveillance Act apply just as for those subject to a permit camera surveillance, such as rules on professional secrecy and information and when Page 7 The Data Inspectorate DI-2019-7782 7 (22) the camera surveillance includes personal data processing, the rules in the Data Protection Regulation. Basic principles for the processing of personal data (Article 5) Article 5 of the Data Protection Regulation contains a number of basic principles which the data controller must take into account when processing personal data. The data controller has, in accordance with Article 5 (2) of the Data Protection Regulation responsibility for compliance with the Regulation and must be able to demonstrate that they basic principles are followed. It follows from Article 5 (1) (a) that all processing of personal data must be lawful; correct and characterized by openness. That the treatment must be correct means that it should be fair, equitable, reasonable and proportionate in relation to them registered. Article 5 (1) (c) regulates the principle of data minimization, which means that: personal data processed to be adequate, relevant and not for extensive in relation to the purposes for which they are treated. It follows from recital 39 that personal data should only be processed for the purpose of the treatment cannot reasonably be achieved by other means. The Data Inspectorate's assessment In assessing whether the treatment is proportionate, the need for to carry out the treatment is weighed against the intrusion into the individual's personal integrity. Regarding the need for processing, the Data Inspectorate can note that the information provided by the Social Affairs Committee shows that it residents' illness creates great difficulties both for themselves and for staff, and that situations have arisen where there has been a risk of the resident's life and health. It has also happened that staff have been added damage. The inquiry into the matter supports the Social Affairs Committee's assessment that it has there has been a need to take action to manage and improve the situation. The problem that has arisen before and that the municipality has managed to curb through the camera surveillance, consists in that when the resident becomes upset is calmed down best by being able to retreat and be alone in the bedroom, while at the same time there is the greatest risk of him injuring himself Page 8 The Data Inspectorate DI-2019-7782 8 (22) himself seriously. There has thus been a need to be able to have the resident under supervision without being disturbed by the staff. At the same time, the Data Inspectorate finds that the current camera surveillance means that the resident is monitored by a camera in his bedroom. It is thus a question of a very privacy-sensitive processing of personal data which means that the resident is monitored in the home's most private sphere. The Data Inspectorate assesses that the camera surveillance has entailed a significant intrusion into it residents' privacy. In order for such surveillance to be judged to be an acceptable intrusion into personal integrity, alternative measures must first be ruled out. The Data Inspectorate states that the Social Affairs Committee has previously taken measures in the form of e.g. guidance, to try to improve the situation. It appears however, not by the inquiry that the Social Affairs Committee has tried to fulfill precisely the need to keep the resident under surveillance without risking disturbance; with less intrusive measures than through camera surveillance. According to The Data Inspectorate's assessment should be possible for the Social Affairs Committee to with relatively simple and less intrusive measures same needs as with camera surveillance. Against this background, the Data Inspectorate finds that the Social Affairs Committee does not have shown that the interest in camera surveillance exceeds the resident's right to privacy and a protected private sphere. The Data Inspectorate states that the way in which the camera surveillance was carried out entailed an extensive monitoring of the resident that has led to a significant intervention in the resident privacy. This means that the processing of personal data, ie. camera surveillance, has been disproportionate to the purpose. The processing of personal data that has taken place through the camera surveillance has thus not living up to the requirements of correctness in Article 5 (1) (a) the Data Protection Regulation. As the Data Inspectorate states in the following in the justification under the headings Legal basis for the treatment of personal data (Article 6), Processing of sensitive personal data (Article 9) and Information to the data subjects has the processing of personal data without a legal basis in Article 6 (1), without support in Article 9 (2) and without demonstrated that the resident has received information in accordance with Article 13 of the the regulation and also not in accordance with the requirements of the Camera Surveillance Act. The means that the Social Affairs Committee can also not be considered to have lived up to the requirements in Article 5.1 (a) of the Data Protection Regulation on legality and transparency. Page 9 The Data Inspectorate DI-2019-7782 9 (22) Legal basis for the processing of personal data (Article 6) According to Article 5 (1) (a) of the Data Protection Regulation, personal data must be processed legally. In order for the treatment to be considered legal, it is required that at least one of the conditions of Article 6 (1) is met. The Social Affairs Committee has stated that the legal basis applicable to it The current personal data processing is that the processing is necessary to perform a task of general interest in accordance with Article 6 (1) (e) the Data Protection Regulation. The provision of social services is one such information of general interest referred to in Article 6 (1) (e) the legal basis of general interest and the exercise of authority Member States in accordance with Article 6 (2) maintain or introduce more specific provisions to adapt the application of the provisions of Regulation to national circumstances. National law can be closer establish specific requirements for data processing and other measures to: ensure legal and fair treatment. But there is not just one possibility to introduce national rules but also an obligation; Article 6.3 states that the basis for the treatment referred to in paragraph 1 (c) and (e) shall be: determined in accordance with Union law or the national law of the Member States. The legal basis may also contain specific provisions to: adapt the application of the provisions of the Data Protection Regulation. The law of the Union or the national law of the Member States shall fulfill an objective of: public interest and be proportionate to the legitimate aim pursued. This means that additional provisions in national law are required by which the basis for the treatment is determined. Recital 41 states that one legal basis or legislative action should be clear and precise and its application should be predictable for persons covered by it. For the processing of personal data in the activities of the social services is established the basis for the treatment in section 6 of the Act (2001: 454) on the treatment of personal data within the social services (SoLPuL). It is clear from that provision that personal data may only be processed if the processing is necessary to tasks within the social services must be able to be performed. The preparatory work for the Data Protection Act develops what recital 41 entails supplementary national legislation (Bill 2017/18: 105 New Data Protection Act p. 51). Page 10 The Data Inspectorate DI-2019-7782 1 0 (22) What degree of clarity and precision is required in terms of it legal basis for a certain processing of personal data should be considered necessary must in the opinion of the Government assessed on a case-by-case basis, based on the treatment and the nature of the business. It should be clear that a treatment of personal data that does not constitute an actual violation of it personal integrity, such as in the treatment of students' names in regular school activities, can be done with the support of a legal basis which is generally held. A more tangible intrusion, for example processing of sensitive personal data in health and healthcare, requires that the legal basis be more precise thus making the intrusion predictable. If the intrusion is significant and involves monitoring or mapping it individual personal circumstances are also required in particular legal support according to ch. 2 6 and 20 §§ RF. This means that the requirements for the supplementary national regulation in terms of precision and predictability increases when it comes to one more tangible intrusion. If the intrusion is significant and involves surveillance or mapping of the individual's personal circumstances, which the current the treatment does, special legal support is also required according to ch. Sections 6 and 20 form of government. The Data Inspectorate's assessment The Data Inspectorate finds that § 6 SoLPuL is a fairly broad and unspecified provision which forms the basis for the processing of personal data in a large number of areas. According to the Swedish Data Inspectorate's assessment, individuals by the provision anticipate that the social services treat large amounts of privacy-sensitive information about individuals in their business, such as for example in case processing. However, it can not be assumed that individuals can anticipate that the Social Services may also perform privacy-sensitive camera surveillance. Against the background of that camera surveillance is an extremely privacy-sensitive treatment and that it thus, high demands are placed on national regulations regarding precision and predictability, the Data Inspectorate assesses that the legal basis in § 6 SoLPuL cannot constitute a supplementary national provision to it the legal basis of Article 6 (1) (e) of the Data Protection Regulation in this case privacy-sensitive camera surveillance. Page 11 The Data Inspectorate DI-2019-7782 1 1 (22) In addition, § 6 SoLPuL requires that the treatment is necessary to perform a task within the social services. Regarding the meaning of the term necessary, the following appears from the preparatory work for the Data Protection Act (Bill. 2017/18: 105 p. 51). According to the Swedish Academy's Dictionary, the Swedish word means necessary that something absolutely required or can not omitted. However, the concept of Union law does not have this strict meaning. Necessity requisites in Article 7 i The Data Protection Directive has e.g. not considered to be a requirement that it must be impossible to perform a task of general interest without the treatment measure being taken (Bill 2017/18: 105 p. 46). Even if the necessity requirement does not mean that it should be impossible to perform a task of general interest if the treatment is not carried out, it may according to the Data Inspectorate's assessment is not considered necessary to carry out a privacy-sensitive processing of personal data via camera surveillance if there are other reasonable options for performing one task that serves the same purpose. As the Data Inspectorate previously stated the social committee should be able to live up to the purpose of the camera surveillance in a different way than with just camera surveillance. Thus, neither is the requirement that the treatment shall be necessary for the complementary national the regulation in § 6 SoLPuL shall be applicable fulfilled. The Social Affairs Committee has thus dealt with the camera surveillance personal data without having a legal basis for the processing under Article 6.1 of the Data Protection Regulation. Any other legal basis for the treatment under Article 6 (1) has also not been shown to exist. Processing of sensitive personal data (Article 9) It follows from Article 9 (1) of the Data Protection Regulation that health information constitutes a special category of personal data ( so-called sensitive personal data). The main rule is that the processing of such personal data is prohibited. IN Article 9 (2) sets out a number of exceptions for sensitive personal data treated. The Social Affairs Committee has stated that the camera may monitor situations in which the resident's disease picture and state of health appear. It means Page 12 The Data Inspectorate DI-2019-7782 1 2 (22) that the current camera surveillance at the LSS accommodation includes treatment of health information ie. sensitive personal data. In order for a processing of sensitive personal data to be legal, both are required a legal basis under Article 6 (1) and that any of the exceptions to the prohibition the processing of sensitive personal data in Article 9 (2) is applicable. Already it the fact that the Social Affairs Committee has carried out the camera surveillance without having a legal basis for the proceedings under Article 6 (1) means that processing has been in breach of Article 9 of the Data Protection Regulation. If, on the other hand, there had been a legal basis for the treatment under Article 6.1, the Social Affairs Committee would thus also have had to apply some of the exceptions in Article 9 (2) for the processing of personal data to be lawful. Article 9 (2) (h) states that the processing of sensitive personal data may take place if the treatment is necessary for reasons related to /… / social care or management of health services and social care and by their system, on the basis of Union law or the national law of the Member States right or under agreements with health professionals and under provided that the conditions and safeguard measures referred to in paragraph 3 are fulfilled. In order for the derogation in Article 9 (2) (h) to apply, it is therefore necessary supplementary rules of Union or national law. In Swedish law has the possibility of processing sensitive personal data in the social services activities are regulated in § 7 (3) SoLPuL. It is clear from that provision that sensitive personal data may be processed on the basis of Article 9 (2) (h) the Data Protection Regulation if the information has been provided in a case or is necessary for the business and provided that the requirement of confidentiality in Article 9 (3) of the Data Protection Regulation is fulfilled. For the processing of sensitive personal data in accordance with Article 9 of the the regulation thus places even higher demands on the complementary national the regulation regarding precision and predictability for it to be applicable. Then the generally formulated national regulation can not be considered live up to the requirements of precision and predictability and thus constitute legal basis for the processing of non-sensitive personal data by camera surveillance, nor can it in a similar way in general drafted the national provision on the treatment of sensitive Page 13 The Data Inspectorate DI-2019-7782 1 3 (22) personal data is considered to live up to the requirements of precision and predictability. The provision in § 7 SoLPuL can thus not constitute such a supplement national law required for the derogation in Article 9 (2) (h) of the this Regulation shall apply to the processing of sensitive personal data through camera surveillance. In addition, section 7 of SoLPuL also requires that the information has been submitted in one case or are necessary for the business for the provision to be able to apply. Then the processing of personal data does not refer to a case but camera surveillance is an actual act, the information must be necessary for the activity may be that the treatment can be performed. However, since the necessity requirement cannot be considered fulfilled regarding the requirement of a legal basis for the processing of personal data, it may is also not considered to be fulfilled with regard to the exemption in Article 9 (2) (h) against the ban on the processing of sensitive personal data. The Data Inspectorate's assessment Even if the Social Affairs Committee had a legal basis under Article 6 (1) (i) the Data Protection Regulation, fulfills the processing of personal data by In summary, camera surveillance does not require one in Article 9 (2) applicable exemption from the ban on treating sensitive personal data. The Data Inspectorate thus assesses that Gnosjö municipality by camera-watching situations where the disease picture and health condition sensitive data has been processed in breach of Article 9 (1) and 9.2 of the Data Protection Regulation. Impact assessment and prior consultation (Articles 35 and 36) It follows from Article 35 of the Data Protection Regulation that a personal data controller in some cases must make an impact assessment regarding data protection, ie. before the processing of personal data make an assessment of a planned processing consequences for the protection of personal data. The obligation applies on a type of treatment, in particular with the use of new technologies and with taking into account its nature, scope, context and purpose, is likely to lead to a high risk to the rights and freedoms of natural persons. Article 35 (7) sets out what an impact assessment should include. It will at least include a description of the planned treatment and the purposes of the treatment, an assessment of the need for and proportionality in the processing, an assessment of the risks to the data subjects' rights Page 14 The Data Inspectorate DI-2019-7782 1 4 (22) and freedoms as well as the measures planned to manage the risks and demonstrate that the Data Protection Regulation is complied with. An impact assessment can thus be described as a tool for identify risks with the processing of personal data and develop routines and measures to manage the risks, and thus assess the treatment is proportionate to its purpose. To implement one Impact assessment before starting treatment is thus often an important one action to assess whether a treatment is lawful. According to Article 36, the controller shall consult: The Data Inspectorate before the processing of an impact assessment regarding data protection under Article 35 shows that the processing would lead to a high risk unless the data controller takes measures to reduce the risk. The European Data Protection Board, EDPB 3 , has developed guidelines 4 regarding i what situations a treatment is likely to lead to a high risk of physical freedoms and rights of persons. The guidelines set out nine criteria to be considered in assessing whether a processing of personal data is likely to lead to a high risk for the data subject. If two of the criteria are met, it can personal data controller in most situations assume that a impact assessment should be performed, but also a treatment that only meets one of these criteria may in some cases require an impact assessment. Conversely, two or more of the criteria in the guide may be met but the data controller can still make the assessment that the processing probably does not lead to a high risk to the data subject's freedoms and rights. IN such situations, the controller should justify and document the reasons why an impact assessment is not carried out and include the views of the Data Protection Officer. The Data Inspectorate has, on the basis of guidelines from Article 29- the working group and the criteria developed by the group, a list of personal data processing covered by requirements for impact assessment regarding data protection (2019-01-16, dnr DI-2018-13200). The list complements and specifies Article 35 (1) and is intended to: 3 European Data Protection Board, formerly the Article 29 Working Party. 4 Guidelines on impact assessment regarding data protection and determining whether the treatment "is likely to lead to a high risk" within the meaning of the Regulation 2016/679, WP 248 rev. 01. Page 15 The Data Inspectorate DI-2019-7782 1 5 (22) further exemplify when the conditions in that provision can be considered be met. The list is not intended to be exhaustive when an impact assessment needs to be made. Criteria to be considered in the assessment of whether a planned treatment is likely to lead to a high risk is including whether the treatment concerns systematic monitoring of humans, sensitive data or data of a very personal nature, data on vulnerable persons or the use of new technologies or new organizational ones solutions. An impact assessment must be made of at least two of those on the list the listed points are included in the planned treatment. It is only mandatory to perform an impact assessment on the planned the treatment ”is likely to lead to a high risk to the rights of natural persons and freedoms ”. A treatment can meet two or more of the criteria but it personal data controller can still make the assessment that it is unlikely to leads to a high risk. In such situations, the person responsible for personal data should justify and document the reasons for an impact assessment not performed and include the views of the Data Protection Officer. In the end of The Data Inspectorate's list is also given examples of when at least two of the criteria must be considered to exist and thus when an impact assessment must be done. Examples are given when activities in social care uses camera surveillance in people's homes. The Social Affairs Committee has stated that they have not made any impact assessment because they do not save information from the camera surveillance. The Social Affairs Committee has also not submitted any request for prior consultation The Data Inspectorate. The Data Inspectorate's assessment The Data Inspectorate states that criteria that must be taken into account in the assessment of whether a treatment is likely to lead to a high risk is whether the treatment is intended systematic monitoring of people, sensitive data or data of very personal in nature, information on vulnerable persons or the application of new technology or organizational solutions. The Swedish Data Inspectorate's list shows that when activities within social care uses welfare technology, e.g. robots or camera surveillance, in people's housing, it is an example of treatment that requires one impact assessment is performed. Then the criteria are considered systematic Page 16 The Data Inspectorate DI-2019-7782 1 6 (22) monitoring, processing of sensitive personal data and use of new technology or new organizational solutions be met. According to the Data Inspectorate's assessment, the treatment in question has included a number of criteria suggest that the treatment is likely to lead to a high risk to the data subject's freedoms and rights. An explicit example in The Data Inspectorate's list of when impact assessment is required according to The Data Protection Regulation is when activities in social care, as in this cases, use camera surveillance in people's homes. Then the Social Affairs Committee does not has presented its assessment of not carrying out an impact assessment it has not shown that the treatment is unlikely to lead to a high risk, although several of the criteria in the guidelines are met. According to the Data Inspectorate assessment, the social committee has thus processed personal data in violation of Article 35 of the Data Protection Regulation. Based on what has emerged in the case, the Social Affairs Committee has not either submitted with a prior consultation. Because the Social Affairs Committee has not done any impact assessment, no assessment has been made of whether the processing entailed some risks to the data subject's freedoms and rights. Thus, the Social Affairs Committee has also not been able to show that the high risk that likely to have been lowered in such a way that there has been no reason to request prior consultation with the Data Inspectorate. According to the Data Inspectorate assessment, the social committee's processing of personal data thus also has in breach of Article 36 of the Data Protection Regulation. Information for registered Article 13 of the Data Protection Regulation sets out the information to be provided provided if personal data is collected from the data subject, such as information on identity and contact details of the personal data responsible, the purposes of the processing for which the personal data is intended, the legal basis, the period during which the personal data will be stored as well as the data subject's rights. Article 12 of the Data Protection Regulation states that the data controller shall take appropriate measures to enable it registrants provide all the information referred to in Article 13, and that such information must be provided in a concise, clear, concise, comprehensible and easy available form and using clear and distinct language. The information must be provided in writing or in some other form. For reasons Page 17 The Data Inspectorate DI-2019-7782 1 7 (22) 58 of the Data Protection Regulation states that information must be concise, easily accessible and easy to understand and designed in clear and simple language and that, if necessary, visualization is used. The Social Affairs Committee has stated that they provided oral information to it residents, the resident's trustees and relatives. Also staff and visitors is said to have received information about the camera surveillance. Regarding the information provided to the resident, the Social Affairs Committee has stated that the resident has received information about the camera surveillance through that he was there watching when the camera was installed, and that the boss orally explained to the resident that the purpose of the camera is to the staff should know that the resident is feeling well. It has not emerged that in addition provided some other information about the camera surveillance to the resident. The Data Inspectorate states that the information provided by the Social Affairs Committee to the data subject (the resident) only includes information that camera surveillance is in progress, and not all the information it provides personal data controller is obliged to provide to the data subject at collection of personal data in accordance with Article 13 of the Data Protection Regulation. The Social Affairs Committee has also stated that information has been provided to it trustee was registered. Chapter 11, Sections 4 and 7 of the Parental Code (1949: 381) state that the court may appoint a trustee for a person who, due to illness, mental disorder, impaired health or similar condition need assistance in guarding their rights, managing their property or caring for their person, and it is not enough that a good man be ordained or that the individual on any other less intrusive way gets help. The management assignment must be adapted to the needs of the individual in each particular case and may be limited to certain property or concern. The Data Inspectorate states that even when a trustee's assignment is designed in such a way that it includes the task of caring for the individual there are restrictions on what a trustee is allowed to do. Of the preparatory work for the provisions on trusteeship are set out below. In general, the principal should also be able to decide on matters himself concerning his accommodation as well as the content of the care offered. One trustees should therefore not normally represent the principal Page 18 The Data Inspectorate DI-2019-7782 1 8 (22) when it comes to issues of consent to, for example, surgical procedures. Of course, this does not prevent one from e.g. the side of care institutions obtains the administrator's views (Bill. 1987/88: 124 p 172). The Data Inspectorate has sent a request for supplementation on 15 June 2020 requested the Social Affairs Committee to provide documentation to the Data Inspectorate regarding the scope of the trustee assignment and the information provided the trustee. However, the Social Affairs Committee has not provided the information regarding the scope of the nominee assignment and has also not reported on what information has been provided to the trustee. The Social Affairs Committee has in addition nor reported its assessment that the trustee can represent it housing in respect of his right to information under Article 13 i the Data Protection Regulation. The Data Inspectorate's assessment The Social Affairs Committee has not shown that there is an opportunity to provide information the trustee, instead of the person registered in the case in question, or that it information provided for in Article 13 of the Data Protection Regulation has been provided. The Social Affairs Committee has thus not fulfilled its duty to provide information by inform the trustee. Nor does the information that the Social Affairs Committee has provided to the resident is sufficient for the duty to provide information to be fulfilled, the Social Affairs Committee's processing of personal data has also taken place in violation with Article 13 of the Data Protection Regulation. Furthermore, it appears from section 15 of the Camera Surveillance Act (KBL) that information on camera surveillance must be provided through clear signage or on something else effective way. It also appears that provisions on the right to information about the personal data processing such as camera surveillance means are found in the Data Protection Ordinance and other regulations specified in section 6 KBL. The Social Affairs Committee has not provided information that there is any sign that informs that camera surveillance is being conducted. For the Social Affairs Committee to be considered have lived up to the requirements regarding information in the Camera Surveillance Act must thus, information about camera surveillance is considered to have been provided on something else effective way. Page 19 The Data Inspectorate DI-2019-7782 1 9 (22) As stated above, the information about the camera surveillance lives on The Social Affairs Committee states that it has not complied with the requirements for information according to the Data Protection Regulation. The Data Inspectorate further assesses that nor did the Social Affairs Committee live up to the requirements to provide information on camera surveillance in another effective way. This means that the treatment of personal data also occurred in violation of the requirement for disclosure in § 15 KBL. Because the resident has not received the prescribed information according to the Data Protection Ordinance and also not according to the Camera Surveillance Act can the Social Affairs Committee is not considered to have complied with the transparency requirements of Article 5 (1) (a) the Data Protection Regulation. Choice of intervention Legal regulation If there has been a violation of the Data Protection Regulation The Data Inspectorate a number of corrective powers available under the article 58.2 a – ji of the Data Protection Regulation. The supervisory authority can, among other things instruct the data controller to ensure that the processing takes place in in accordance with the Regulation and if required in a specific way and within a specific period. It follows from Article 58 (2) of the Data Protection Ordinance that the Data Inspectorate in accordance with with Article 83 shall impose penalty fees in addition to or in place of others corrective measures referred to in Article 58 (2), as the case may be in each individual case. For the purposes of Article 83 (7) of the Data Protection Regulation, national authorities may: rules state that administrative sanctions may be imposed on authorities. According to ch. 6 Section 2 of the Data Protection Act allows for penalty fees to be decided authorities, but to a maximum of SEK 5,000,000 or SEK 10,000,000 depending on whether the infringement concerns articles covered by Article 83 (4) or 83.5 of the Data Protection Regulation. Section 25 (4) KBL also states that a penalty fee can be charged by the person who conducts camera surveillance and breaks against the disclosure requirement in section 15. Article 83 (2) sets out the factors to be taken into account in determining whether a administrative penalty fee shall be imposed, but also what shall affect the size of the penalty fee. Of central importance for the assessment of Page 20 The Data Inspectorate DI-2019-7782 2 0 (22) the seriousness of the infringement is its nature, severity and duration. About it in the case of a minor infringement, the supervisory authority may, in accordance with recital 148 i the Data Protection Regulation, issue a reprimand instead of imposing one penalty fee. Penalty fee The Data Inspectorate's inspection has shown that the Social Affairs Committee has considered personal data in violation of Articles 5, 6.1, 9.2, 13, 35 and 36 of the Data Protection Regulation. In addition, the Social Affairs Committee has violated section 15 KBL. In assessing whether the violations are so serious that an administrative sanction fee is to be imposed, the Data Inspectorate has taken into account that the personal data processing intended for camera surveillance of a resident in a very private sphere and in a position of dependence, where the treatment to some extent included sensitive personal data. The treatment has been ongoing from March 2019- April 2020, which is considered a relatively long time. Consideration has also been given to that the Data Inspectorate has become aware of the processing through a tip from a relative of the data subject. These circumstances are seen as aggravating. According to the Swedish Data Inspectorate's assessment, the processing did not involve one minor infringement without infringements that should lead to an administrative penalty fee. Then the articles in the Data Protection Ordinance that the Social Affairs Committee violated covered by Article 83 (5) of the Data Protection Regulation and concerns an infringement of the duty to provide information in section 15 KBL is the maximum amount for the sanction fee in this case SEK 10 million, according to ch. Section 2, second paragraph the law (2018: 218) with supplementary provisions to the EU data protection regulation. The administrative penalty fee shall be effective, proportionate and deterrent. This means that the amount must be determined so that it the administrative penalty fee leads to correction, that it provides a preventive effect and that it is also proportional in relation to both current violations as to the ability of the supervised entity to pay. In determining an amount that is efficient, proportionate and deterrent, the Data Inspectorate can state that the social committee has processed sensitive personal data about a resident in a situation that is very private and which means that housing is in a position of dependence Page 21 The Data Inspectorate DI-2019-7782 2 1 (22) towards the municipality. The violation concerns the supervision of a person in his bedroom, which is a very privacy-infringing treatment. In addition, have the treatment lasted for a relatively long time, for more than a year. The Data Inspectorate has taken into account that housing has a serious self-harming behavior, sometimes with danger to life and health both for himself and the staff. The Social Affairs Committee has taken the measure to resolve a complex situation there personnel and housing have been at risk of injury. Although the situation has been difficult to handle, the Social Affairs Committee has not tried alternatives, less intervention measures to solve the problem of being able to have the resident under supervision in a smooth manner before the camera surveillance began. Given the seriousness of the infringements and that the administrative the penalty fee shall be effective, proportionate and dissuasive The Data Inspectorate that the administrative penalty fee for the Social Affairs Committee shall be set at SEK 200,000. This decision was made by Director General Lena Lindgren Schelin after presentation by lawyer Jeanette Bladh Gustafson. At the final The proceedings also have the General Counsel Hans-Olof Lindblom and unit managers Malin Blixt and Charlotte Waller Dahlberg participated. Lena Lindgren Schelin, 2020-11-24 (This is an electronic signature) Appendix How to pay penalty fee Copy for knowledge of: Data protection representative for Gnosjö municipality: dataskyddsombud@gislaved.se How to appeal If you want to appeal the decision, you must write to the Data Inspectorate. Enter i the letter which decision you are appealing and the change you are requesting. The appeal must have been received by the Data Inspectorate no later than three weeks from on the day the decision was announced. If the appeal has been received in due time Page 22 The Data Inspectorate DI-2019-7782 2 2 (22) the Data Inspectorate forwards it to the Administrative Court in Stockholm examination. You can e-mail the appeal to the Data Inspectorate if it does not contain any privacy-sensitive personal data or data that may be covered by secrecy. The authority's contact information can be found on the first page of the decision.
