HDPA (Greece) - 50/2022
From GDPRhub
| HDPA - Decision 50/2022 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(1)(b) GDPR Article 5(1)(a) GDPR Article 5(2) GDPR Article 6(1)(f) GDPR Article 12 GDPR Article 13 GDPR Article 58(2)(i) GDPR Guidelines 3/2019 on processing of personal data through video devices Law 4624/2019 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 09.09.2022 |
| Published: | 09.09.2022 |
| Fine: | 15.000 EUR |
| Parties: | Private school Individual-Ex-employee |
| National Case Number/Name: | Decision 50/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | Hellenic DPA (in EL) |
| Initial Contributor: | Anastasia Tsermenidou |
The Greek DPA imposed a €15,000 fine on a private school for installing a video surveillance system which, among others, did not respect the purpose limitation and accountability principles.
English Summary
Facts
A former teacher (the data subject) at a private primary school (the controller) submitted a complaint to the Greek DPA regarding a video surveillance system in the classrooms, which had been recording them without knowledge or consent. The DPA started proceedings to examine the lawfulness of the processing.
The controller submitted that the video surveillance system had been operating since 2007 in order to provide direct visual contact with dangerous places for students (courtyard, balconies) and to discourage possible intruders. According to the controller, persons with access to the transmitted video were the principal, owner and president of the school, via a computer located in their office. Moreover, persons entering the site were informed by signs and verbally about the existence of the video cameras. Similarly, teachers were informed about it verbally, allegedly with no objections. The controller stated that the legal basis for the processing of personal data related to the video cameras was legitimate interest.
In its decision, the DPA considered the legal basis for processing as well as compliance with general data processing principles and data subject rights.
Holding
First, the DPA held that information to parents and employees on the operation of the system was incomplete because, according to the controller, it was given orally, in violation of Articles 5(1)(a) and (b) as well as Articles 12 and 13 GDPR. The controller was not able to prove that such information was given nor which categories of persons were informed. In particular, the DPA noted that children were not appropriately protected in this regard.
Second, the DPA stated that the principle of purpose limitation (Article 5(1)(b) GDPR) was not respected, since the access to the transmitted image by the manager and employees, that is officially unauthorised parties, did not ensure that the purpose of the processing was exclusively the protection of persons and property.
Third, the principle of accountability (Article 5(2) GDPR) was not respected because the controller did not keep activity records for the processing of personal data through the video surveillance system, but only provided them after the hearing.
Fourth, with regards to the legal basis for processing, the DPA held that the controller had not ensured that there was an overriding legitimate interest for the installation of cameras to justify the interference with fundamental rights and freedoms of persons, as required by Article 6(1)(f) GDPR. The DPA reasoned that the controller's educational establishment was not so large as to justify the need to monitor remote points of the premises by using surveillance cameras instead of milder means. Hence, there was no valid legal basis for the operation of the system.
Considering the above-mentioned violations, the DPA ordered the controller to uninstall the cameras within one month of the receipt of the notice. Furthemore, the DPA used its powers under Article 58(2)(i) GDPR and imposed a €15,000 fine on the controller.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Ave. Kifissias 1-3, 11523 Athens, Greece, T: 210 6475 600 - E: contact@dpa.gr - www.dpa.gr 2 "Iordanakeion Modern Schools SA" had surveillance cameras in the classrooms and was recorded repeatedly without having knowledge of the existence of the cameras and without its consent. The Directorate of Primary Education D' Athens by document No. G/EIS/8305/21-12-2021 also transmitted to the Authority a complaint of a ... teacher with the same content. The Authority sent a letter to the complainant company, No.G/EΞ/3/07-01- 2022, informing it about the applicable legal framework, namely Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter "GDPR"), Law No. 4624/2019, Directive 1/2011, and Guideline 3/20191 of the EDPS on the processing of personal data through video capture devices. A specific questionnaire was included in the document in order to examine the accountability obligations of the GDPR with regard to the processing of personal data through the operation of a video surveillance system. The complainant company responded with the document No. G/EIS/1686/03- 02-2022 in which it states, among other things, that the video surveillance system has been operating since 2007 in order to provide direct visual contact with dangerous places for students (courtyard, balconies) and to discourage would-be destroyers/intruders. These are fixed cameras, they do not transmit sound and the transmitted image is not recorded. The locations and fields of view of the cameras include the ground floor, exterior and courtyard areas and fields of the adjacent sports facilities, the exterior corridors on the balconies of the three floors, the exterior courtyard area of the 4ου floor, and the school auditorium. Access 1 https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019-processing- personal-data-through-video_el Ave. Kifissias 1-3, 11523 Athens, Greece, T: 210 6475 600 - E: contact@dpa.gr - www.dpa.gr 3 to the transmitted image has the principal, owner and president of the school, via a computer located in his office. The owner and president of the school made the decision to install the system. Natural persons entering the site are informed by signs and verbally about the existence of the video surveillance system. Teachers shall be informed at the time of their recruitment. Attached are teachers' affidavits, dated 21-1-2022, in which they certify that they are aware of and have no objection to the video surveillance system and that there are no cameras in the classrooms. He finally stated that he does not keep records of activities. Subsequently, in order to complete its examination of the case, the Authority invited the complainant company by letter No. C/EXE/434/15-02-2022 to the meeting of the Department on 2-3-2022. Present at this meeting were, Millas Dimitrios, with ID ..., A, ... ... and B, ... ... ... Following the meeting, the complainant company submitted a request for a hearing, ref. C/EIS/4348/15-3-2022, in which, in addition to the reference to the mode of operation of the video surveillance system, the following additional information was submitted: (a) a resolution of the Teachers' Association dated 04- 03-2022, which shows that the elementary - high school grades concerned by the said system have been consulted with the owner, informed and accept the decision of the owner - the competent representative body of the Company to operate a video surveillance system without data recording; (b) a data protection impact assessment (DIA), which assesses the use of the video surveillance system on the legal basis of the overriding legitimate interest in the protection of property and health and which documents the lawfulness of each camera; c) activity records in accordance with the Authority's template, in electronic form; d) notification texts to staff on the principles of GDPR in general, on the type of data processed by the complainant company as a controller under the contract Ave. Kifissias 1-3, 11523 Athens, Greece, T: 210 6475 600 - E: contact@dpa.gr - www.dpa.gr 4 the specific legal basis for video surveillance without keeping an image file, the rights of workers and how to exercise them. The Authority, after considering the evidence on the file, after hearing the rapporteur and clarifications from the co-rapporteur, who was present without the right to vote, after an extensive discussion, THOUGHT IN ACCORDANCE WITH THE LAW 1. The installation and operation of video surveillance systems with the capture and/or recording of images and/or sound through the collection, preservation, storage, access and transmission of personal data, constitute, as individual processing operations, interference with the individual rights to respect for privacy under Art. 9 S., 7 TFEU2 and 8 ECHR as well as the protection of personal data pursuant to Articles 5 S., 7 CPC and 8 ECHR. 9A CP, 8 ECHR and 8 TFEU3, as considered by the Authority in its Opinion No 3/2020. 2. In accordance with the CPCS Guidelines 3/2019 on the processing of personal data through video devices4, in order to determine the lawfulness of the installation and operation of the video surveillance system, the cumulative requirements of Articles 5 and 6 para. 1 GDPR and the legality of the processing must be documented internally at an earlier stage of the installation and operation of the system and, in fact, when determining the purpose of the processing, a relevant assessment may be required for each camera separately, depending on its location. In particular, these Guidelines set out the following: "α (...) 5. Video surveillance is by definition not necessary if other means are available to achieve the 2 CJEU Digital Rights Ireland para. 29. 3 CJEU Digital Rights Ireland para. 38. 4 https://edpb.europa.eu/our-worktools/ourdocuments/guidelines/guidelines-32019-processing- personal-data-through-video_el Ave. Kifissias 1-3, 11523 Athens, Greece, T: 210 6475 600 - E: contact@dpa.gr - www.dpa.gr 8 and 5 par. 2(b) of the GDPR, because the complainant is not able to prove that such oral information was given and even if it is accepted that oral information was given, it does not cover every category of subjects, in particular children, employees and visitors to the premises, not meeting the requirements of transparency and accountability. 8. The principle of purpose limitation is not respected, since the access to the transmitted image by the manager and employer does not clearly show or technically ensure that the purpose of the processing is exclusively the protection of persons and property. 9. The principle of accountability was not respected with regard to documentation through the keeping of activity records, in breach of Articles 5(5)(a) and (b) of the EC Treaty. The controller did not keep activity records for the processing of personal data through the video-surveillance system, but only provided them after the hearing. 10. In the light of the above, the Authority considers that it is appropriate to exercise the remedies provided for in Article 58(1) of the EEA Agreement. 2 of the GDPR in relation to the infringements found. The Authority also considers that, in the light of the circumstances found, it is appropriate to impose, in application of the provision of Article 58(1) of the GGC, a fine in accordance with the provisions of Article 58(1) of the GGC. 2(i) of the GDPR, the effective, proportionate and dissuasive administrative fine provided for in Article 83 of the GDPR, both to remedy compliance and to punish the unlawful conduct. 11. Furthermore, the Authority took into account the criteria for the calculation of the fine set out in Article 83(1)(a) of the EEA Agreement. 2 of the GDPR, paragraph 5(a) and (b) of the same article, which have applicable in present case and the Guidelines on the application and determination of administrative fines for the purposes of Regulation 2016/679 adopted on 03- 10-2017 by the Article 29 Working Party (WP 253), as well as the facts of the case under consideration, in particular: (a) the nature, gravity and duration of the infringement, in view of the nature, gravity and duration of the infringement; Ave. Kifissias 1-3, 11523 Athens, Greece, T: 210 6475 600 - E: contact@dpa.gr - www.dpa.gr 9 the scope or purpose of the processing in question, as well as the number of data subjects affected by the breach and the degree of damage suffered by them, and in particular: i. the fact that the controller has infringed the obligations laid down in Article 5(5)(a) and (b); 1(a) of the GDPR, the principles of legality, objectivity and transparency and, in addition, the principle of purpose limitation under Article 5(1)(a) of the GDPR. 1(b) and the obligation (principle) of accountability under Article 5(1)(b). 2 of the GDPR, that is to say, it has infringed the fundamental principles of the GDPR on the protection of personal data, ii. the fact that compliance with the principles laid down by the provisions of Article 5(5)(a)(ii) of the Directive. 1(a) and (b). 2 of the GDPR are of fundamental importance, first and foremost the principle of lawfulness, objectivity and transparency, so that if that principle is lacking, the processing becomes unlawful in principle, even if the other processing principles have been complied with. Similarly, both the purpose limitation principle and the principle of accountability in the context of the new compliance model introduced by the GDPR, where the burden of compliance and responsibility lies with the controller, who has been provided by the GDPR with the necessary compliance tools, iii. the fact that the controller has failed to comply with the requirements of the processing principles in Article 5(5); 1(a) and (b) of the GDPR and, in addition, failed to document in the context of compliance the lawfulness of the video surveillance system, iv. the fact that the infringement of the above principles is subject to the provisions of Article 83 para. 5(a) of the GDPR to the highest category provided for in the system of graduated administrative fines, v. the fact that, from the information brought to the attention of the Authority, no material damage to the data subjects has occurred, vi. the fact that the infringement of the principles of Article 5(5)(b) of the ECHR is not justified. 1(a), (b) and (c). 2 of the GDPR did not apply, on the basis of the evidence brought to the Authority's attention, Ave. Kifissias 1-3, 11523 Athens, Greece, T: 210 6475 600 - E: contact@dpa.gr - www.dpa.gr 10 personal data under Articles 9 and 10 of the GDPR, but concerns children, who require specific protection with regard to personal data (recital 38 and Article 6(1)(f) of the GDPR). vii. the fact that the system and the cameras in question had been installed and operated illegally since 2007, while even after the application of the GDPR no compliance action was found until the Authority's intervention; b) the degree of fault of the controller. The installation and operation of the video surveillance system in violation of the principles of legality, objectivity and transparency, purpose limitation as well as accountability was the result of insufficient knowledge and application of the provisions of the GDPR attributable to negligence and therefore mitigating circumstances are taken into account in relation to the possibility that it may have occurred fraudulently. (c) any actions taken by the controller to mitigate the damage suffered by data subjects and the extent of cooperation with the Authority to remedy the breach and mitigate its possible adverse effects. The complainant took steps to document the processing and comply with the GDPR after the hearing and its cooperation with the Authority has been satisfactory. (d) any relevant previous infringements by the controller. An audit shows that the complainant company has not yet been subject to an administrative sanction by the Authority. (e) the categories of personal data affected by the breach. It is not personal data within the meaning of Articles 9 and 10 of the GDPR, according to the information brought to the attention of the Authority, but it concerns children, who require specific protection with regard to personal data (recital 38 and Article 6(1)(f) of the GDPR). (f) the size of the company. In the light of the above, the Authority unanimously considers that the following should be imposed on Ave. Kifissias 1-3, 11523 Athens, Greece, T: 210 6475 600 - E: contact@dpa.gr - www.dpa.gr 11 the complainant company as controller, the administrative penalty referred to in the operative part of the decision, which shall be proportionate to the gravity of the infringement. FOR THESE REASONS The Authori ty Α. Instructs the complainant company named "Iordanakeion Modern Schools SA" as the controller, to uninstall the cameras within one (1) month from the receipt of this notice and to inform the Authority in writing. Β. Impose on the complainant company named "Iordanakion Modern Educational Schools SA" the effective, proportionate and deterrent administrative fine appropriate in this case, according to the specific circumstances of this, amounting to fifteen thousand (15.000,00) euros for the above violations of Articles 5 par. 1(a), 5 par. 1(b) and 5(1)(b) and 5(b). 2, and Articles 6, 12, 13 and 30 of the GDPR.
