Persónuvernd (Iceland) - 2021010073
From GDPRhub
| Persónuvernd (Iceland) - 2021010073 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 2(2)(c) GDPR Article 6(1)(f) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 02.11.2021 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 2021010073 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Icelandic |
| Original Source: | Icelandic DPA (in IS) |
| Initial Contributor: | Florence D'Ath |
The Icelandic DPA issued an injunction against a private individual to stop monitoring some shared and public areas around a multi-family house through video surveillance cameras, and to delete all the recorded material.
English Summary
Facts
A private individual (the Complainant) filed a complaint with the Icelandic DPA on the ground that the Complainant's neighbor, who lived on the upper floor of the same house, had installed three surveillance cameras for monitoring the house and its surroundings. In particular, the field of vision of these cameras covered the common garden of the house, the Complainant's car park, the surrounding plots, as well as the street and sidewalk in front of the house. The Complainant argued that the processing of personal data through those surveillance cameras was not complying with the applicable data protection law.
Holding
The Icelandic DPA first recalled that the monitoring of a private property via surveillance cameras could fall outside of the scope of the GDPR in line with Article 2(2)(c) GDPR (i.e. processing of personal data "by a natural person in the course of a purely personal or household activity"). In the case at hand, however, the field of vision of the three cameras covered some shared areas (such as the common garden of the house) and some public areas (such as the sidewalk in front of the house). As a consequence, the processing of personal data was not covered by the household exemption set in Article 2(2)(c) GDPR, and had to comply with the rules and principles of the GDPR.
The Icelandic DPA then considered whether such processing could be justified on the basis of Article 6(1)(f) GDPR (i.e. processing is "necessary for the purposes of the legitimate interests pursued by the controller (...), except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject (...)). After balancing the legitimate interest of the neighbor to monitor the shared property with the right and freedoms of the Complainant, as well as any other individuals who could have been filmed by those cameras, the Icelandic DPA concluded that the neighbor had failed to demonstrate the need to monitor the covered areas. As a consequences, the Icelandic DPA considered that the processing of personal data through the surveillance cameras was unlawful.
In view of the above, the Icelandic DPA issued an injunction against the neighbor to stop the electronic monitoring of these areas, to delete all the recorded material, and to confirm that these instructions had been followed no later than 26 November 2021.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Individuals FAQ complete FAQ electronic monitoring general privacy right to be forgotten right to information about their genotype What is processing? A new privacy legislation 2018Almennt the new legislation other interesting stuff educational booklet: Privacy children's booklet: Private youth booklet: public companies and administration asked and answered all the questions and answers electronic monitoring general privacy access right controllers, processors and vinnslusamningarÁbyrgðarskyldaVinnsluskrárNý Privacy legislation 2018FræðsluefniLög and reglurLög privacy rules and regulations other sacrificed rules and guidelines operating international and European law Solutions Solutions Reviews Licensing Various letters Privacy function Privacy News Mega political process personal data my campaign? How to process personal data in election campaigns? Staff and management for media requests for promotional events policy and gi ldiAnnual Reports201620152014201320122011201020092008200720062005200420032002200120001999Other ContentPrivacy PolicyLegal DisclaimerAccessibilityService DeskTwitterEnglishDecisions in EnglishContactLearningTo reportTopic
Enter keywords
SolutionsReviewsLicensingMiscellaneous letters
Search for solutions
Year from:
Year to:
Search
Electronic monitoring in a multi-family house did not comply with the law
Case no. 2021010073
2.11.2021
The Data Protection Authority received a complaint to the effect that the complainant's neighbor had installed three surveillance cameras at a multi-family house. The field of view of the cameras, e.g. to the common owner of the house as well as to an area in public. The responsible party did not demonstrate the need for the monitoring and it was therefore the conclusion of the Data Protection Authority that the monitoring did not comply with the law. The Data Protection Authority requested that the monitoring be discontinued and that all recorded material accumulated during the monitoring be deleted.
Ruling On October 27, 2021, the Data Protection Authority issued a ruling in case no. 2021010073.I. On June 10, 2021, [B] was invited to provide explanations regarding the complaint. The answer was sent by e-mail on 30 June 2021. The above documents have been taken into account in resolving the case, although they are not specifically explained in full in the following ruling. 2. The complainant's views The complainant lives on the ground floor of a semi-detached house by [...] but [B] is the owner of an apartment on the upper floor of the house. The complainant has stated that [B] has installed three surveillance cameras on the exterior of the multi-family house. At least one camera is on the axis of rotation, so it can be rotated in various directions. Thus, the monitoring focuses on the common garden by the house, the complainant's car park, the surrounding plots, as well as on the street and sidewalk in front of the house. The consent of other owners in the multi-family house was not sought for the installation of the cameras. There are no warning signs that electronic monitoring is taking place near the house and no information has been provided on how the cameras work, such as whether they start and take videos when they sense movement. 3. Perspective [B] [B] has stated that the purpose of the monitoring is to ensure security as there have been many burglaries in the capital area. There are three surveillance cameras. The cameras raised the entrance to his property as well as a trampoline in the yard. Then the cameras are on recording which goes on a hard disk and disappears after two weeks. The cameras are very visible and not hidden. Stickers have not been installed but are in print. There is no resident association but house meetings are held. Neighbors have been notified that cameras are being set up. Then came answer [B] screenshots from all three surveillance cameras.II.Conditions and conclusion1. Scope - Responsible Scope of Act no. 90/2018, on personal protection and processing of personal information, and Regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thereby the authority of the Data Protection Authority, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partially or completely automated and the processing by other methods than automatic of personal data that are or should become part of a file. This case concerns electronic monitoring with surveillance cameras. Electronic monitoring is monitoring that is continuous or repeated regularly and involves supervision of individuals with remote-controlled or automatic equipment and takes place in public or in an area that a limited group of people normally go through, cf. Number 9 Article 3 Act no. 90/2018. The term includes, among other things, monitoring that leads to, should lead to or may lead to the processing of personal information. Article 4 Act no. 90/2018, Coll. paragraph 2 (c) Article 2 of the Regulation, the Act and the Regulation do not apply to an individual's handling of personal information that concerns only his or her personal or family's personal property or is intended solely for personal use. In this case, it is clear that the field of view of the surveillance cameras extends both to areas that are considered to be the common property of the owners of the building and to areas in public. The monitoring is therefore not limited to the territory of [B] or his family. Video recording for surveillance purposes that extends beyond the territory of the responsible party cannot be considered for private use in the above sense, cf. m.a. ruling of the Data Protection Authority in cases no. 2020010548 and 2020010691. In light of the above, the processing [B] of the personal information generated during the monitoring is considered to fall within the scope of Act no. 90/2018, and thus the authority of the Data Protection Authority, cf. above. The person who is responsible for the processing of personal information in accordance with Act no. 90/2018 is named the responsible party. As such, [B] is considered to be responsible for the processing in question. 2. Legality of processing and conclusion In order for electronic monitoring to be permitted, the conditions of the first paragraph must be met. Article 14 Act no. 90/2018. It stipulates that electronic monitoring is always subject to the condition that it is carried out for objective purposes. During electronic monitoring, care must also be taken, among other things, that a signal or other conspicuous means clearly notifies the monitoring and who is responsible for it, cf. Paragraph 4 The same articles. As has been stated, this is electronic monitoring that leads to the processing of personal information. In order for the processing of such information to be permitted, one of the conditions provided for in Article 9 must be met. Act no. 90/2018 and Article 6. of Regulation (EU) 2016/679, to be complied with. As is the case here, point 6 comes into consideration in particular. Article 9 of the Act, cf. paragraph 1 (f) Article 6 of the Regulation, to the effect that personal data may be processed if it is necessary due to legitimate interests that the responsible party or a third party safeguards, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data outweigh. In assessing whether the authorization in question may apply, three conditions must be met. First, the processing must be carried out in the interests of the legitimate interests of the guarantor or a third party. Secondly, it is required that the processing is necessary in the interests of those interests, but in that assessment it must be examined whether it is possible to achieve the same goal with other and less severe measures. Thirdly, the interests or fundamental rights and freedoms of the data subject which require the protection of personal data may not outweigh the legitimate interests referred to. It is known that the responsible party installed surveillance cameras for security and property protection purposes. Screenshots from a surveillance camera on the front of the building show that the camera's field of view extends to the common area of the semi-detached house at [...] as well as partly to an area that is in a public place. The field of view of the camera in the backyard of the guarantor extends to the common property of the owners of the house as well as to an area that is in a public place. It is the opinion of the Data Protection Authority that the responsible parties may have a legitimate interest in patrolling areas outside their private property if the conditions are there, among other things with regard to the imminent danger to them or their property. However, it is always necessary to assess whether there are interests that justify monitoring beyond the private property of the guarantor. It is the opinion of the Data Protection Authority that, as in this case, the responsible party has not demonstrated the need to monitor areas outside the site boundaries of the property in order to achieve the purpose of the monitoring. In assessing whether the monitoring of a common site can be based on the authorization in the aforementioned provision of point 6. Article 9 Act no. 90/2018, the provisions of Act no. 26/1994, on multi-family houses. According to them, the decision to install surveillance cameras in a multi-family house must be made at a legally convened house meeting, but this has not been done in the case in question. With reference to this, the Data Protection Authority is of the opinion that the monitoring of a common site could not have relied on the authorization in point 6. Article 9 Act no. 90/2018. In view of all the above, the conclusion of the Data Protection Authority is that the monitoring in question, with the field of view to which it applies, does not comply with point 6. Article 9 Act no. 90/2018, Coll. paragraph 1 (f) Article 6 of the Regulation. For that reason, the monitoring is not considered in accordance with Act no. 90/2018 and Regulation (EU) 2016/679. With reference to points 6 and 7. Article 42 Act no. 90/2018, Coll. points f and g of the second paragraph. Article 58 of the Regulation, it is hereby proposed that the responsible party abandon all electronic monitoring, which is aimed at areas that are in the common property of the owners of the house at [...] and in public, and delete all occupied material that has accumulated during the monitoring. Confirmation that these instructions have been complied with shall be received by the Data Protection Authority no later than 26 November 2021. DECLARATION: [B] processing of personal data due to electronic monitoring that [...] is not in accordance with Act no. 90/2018, Coll. Regulation (EU) 2016/679. It is proposed [B] to stop the electronic monitoring and delete all recorded material that has accumulated during the monitoring. Confirmation that these instructions have been followed shall be received by the Data Protection Authority no later than 26 November 2021.F.h. Privacy, Helga Þórisdóttir Helga Sigríður Þórhallsdóttir
Privacy PolicyLegal DisclaimerAccessibilityService DeskTwitter
