APD/GBA (Belgium) - 138/2022
From GDPRhub
| APD/GBA - Decision 138-2022 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 5(2) GDPR Article 6(1)(f) GDPR Article 24(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 01.07.2021 |
| Decided: | 27.09.2022 |
| Published: | 02.10.2022 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Decision 138-2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Dutch |
| Original Source: | GBA (in NL) |
| Initial Contributor: | n/a |
The Belgian DPA gave a controller a warning for violating Articles 5(1)(a), 5(1)(b), 5(1)(c), 5(2) and 24(1) GDPR by recording the private space of its neighbours with a security camera.
English Summary
Facts
This decision concerns the use of a surveillance camera which partly pointed at the living space and garden of some neighbors (the data subjects). The controller stated that the purpose of the cameras was to protect its collection of high value motorcycles and that it had never been its intention to violate someone else's privacy. The data subjects filed separate complaints at the DPA which were combined in a single procedure. One of the data subjects also went to the police, which resulted in a police investigation at the controller’s place at 27 October 2022. The police came to several conclusions, amongst others the fact that the controller didn't register the purpose of the video surveilance before he placed the security camera. The police also found that the controller didn't notify the police about the placement of the surveillance camera, despite the fact that this was a legal obligation under national law (Article 7(2)(2) Camerawet). The DPA conducted an investigation into the controller. The investigations unit held that the controller violated Articles 5(1)(a), 5(1)(b), 5(1)(c), 5(2) and 24(1) GDPR. The investigations unit also held that the controller violated several local legislations, specifically Article 5 Camerawet, Article 3 Koninklijk Besluit 10 February 2008 and Articles 7, 8, 9 Camerabesluit.
Holding
The DPA held that it had the jurisdiction to decide this complaint. First, the recordings of natural persons with surveillance cameras are personal data. Second, the fact that the controller placed the cameras on his own property does not trigger the "household exemption" under Article 2(2)(c) GDPR. When the cameras also record, as in this case, public or private spaces, this provisions doesn’t apply. Therefore, the GDPR was applicable.
The DPA held the controller had violated the principle of lawfulness, fairness and transparency under Article 5(1)(a). For instance, had not installed a public sign signalling a video recording was taking place as required among the others by Article 7(2)(6) Camerawet.
The DPA held that the controller did not comply with the legal obligation to register the purpose of video surveillance at the local police office. Therefore, the controller violated Article 5(1)(b) GDPR. The DPA also held that a late registration would not remedy the initial violation.
The DPA held that the controller violated the "data minimisation" principle under Article 5(1)(c) GDPR because the camera used to record more than the controller's private premises. The SA confirmed the violation even if the controller had corrected the camera's orientation during the proceedings by making sure the surveillance cameras only recorded his own backyard. The controller stated that the camera had a ‘moving function’, where the camera could automatically chance the angle to get a different view. The controller disabled this function at the advice of the police.
The DPA held that the controller violated the accountability principle (Article 5(2) GDPR and Article 24(1) GDPR) on two grounds. The first ground was the fact that the controller was unable to show how data subjects were informed in a transparent and fair way, unable to show that the data was processed with specified, explicit and legitimate purposes and unable to show that not more personal data was processed than what was necessary for the purposes pursued by the controller. The second ground was the fact that the controller also didn’t have a registry for video footage and for activities altering this footage. This was however an obligation for the controller according to Article 7(2)(5) Camerawet and Articles 7, 8 and 9 Camerabesluit.
The DPA held that it had to be assessed whether or not the controller could use legitimate interests as a legal ground for processing (Article 6(1)(f) GDPR). Following the CJEU's case law, there must be a legitimate interest, the processing must be necessary for this interest and a balancing test has to take place of the legitimate interest of the controller/third party against the interests and fundamental rights of data subjects. The DPA held that preventing burglary, vandalism or theft can be seen as a legitimate interest, with a reference to the EDPB Guidelines 3/2019. The DPA held that the necessity-test should be assessed with the data-minimisation principle (Article 5(1)(c) GDPR ) in mind, which states that processing must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. It was already decided that the controller had violated this principle. The constant recording of neighbours private premises cannot be seen ‘relevant’, so processing could certainly not be ‘necessary’ for the legitimate interest of the controller. The DPA also held that the legitimate interest in question failed the balancing test. It held that the constant recording of the data subjects was a serious infringement on their fundamental rights. There was also a less intrusive option available in the form of putting a casing around the camera to obstruct part of its view. The DPA also considered it a factor that it was beyond the objective expectations of the data subjects that the surveillance camera was positioned in a way such as in this decision.
The DPA gave the controller a warning.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/14
Dispute room
Decision on the merits 138/2022 of 27 September 2022
File number : DOS-2021-50008
Subject : Complaint regarding camera surveillance
The Dispute Chamber of the Data Protection Authority, composed of Mr Hielke
Hijmans, chairman, and Messrs Romain Robert and Jelle Stassijns, members.
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data and revocation of
Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR;
In view of the law of 3 December 2017 establishing the Data Protection Authority,
hereinafter WOG;
Having regard to the internal rules of procedure, as approved by the Chamber of
Representatives on 20 December 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Having regard to the documents in the file;
Has made the following decision regarding:
The complainants: 1. Mr X1, “Complainant 1”
2. Mr X2, hereinafter referred to as “complainant 2”
hereinafter jointly referred to as “the complainants”:
The defendant: Mr Y, hereinafter referred to as “the defendant”. Decision on the merits 138/2022 - 2/14
I. Facts procedure
1. On 1 July 2021, the complainants shall file each separate complaint against the defendant with the
Data Protection Authority. These complaints have the same object.
2. The subject of the complaints concerns the installation of a surveillance camera by the
defendant, the complainants' rear neighbor with adjacent gardens. The complainants argue that
this camera is located in a location that allows you to view the garden and living space of
to capture the complainants. Complainant 2 has already reported this to the local authorities
police zone Assenede-Evergeminthe framework of which a check has taken place on
October 27, 2022 by these competent police forces.
3. On August 17, 2021, the complaints will be merged by the Frontline Service (hereinafter
so called “complaint”) and declared admissible on the basis of articles 58 and 60 WOG
and the complaint is submitted to the Disputes Chamber pursuant to Article 62, § 1 WOG.
4. On 15 September 2021, in accordance with Article 96, § 1 WOG, the request of the
Disputes room until an investigation is submitted to the Inspectorate,
together with the complaint and the inventory of the documents.
5. The inspection will be completed by the Inspectorate on 26 November 2021
report attached to the file and the file is reviewed by the Inspector General
submitted to the Chairman of the Disputes Chamber (Article 91, § 1 and § 2 WOG).
6. On 9 December 2021, in accordance with Article 96, §2, the request of the
Dispute chamber to conduct an additional investigation transferred to the
inspection service.
7. The additional investigation by the Inspectorate will be completed on January 6, 2022
the report attached to the file and forwarded by the Inspector General to the
Chairman of the Disputes Chamber (article 91, § 1 and § 2 WOG).
The report contains findings with regard to the subject matter of the complaint and decision
that there is:
- an infringement of Article 5 (1) a), b) and c) and (2) of the GDPR and Article 24 (1) of the
GDPR; and
- an infringement of article 8 of the law of 21 March 2007 regulating the placement and
the use of surveillance cameras (hereinafter: “Camera Act”), on Article 3 of the
Royal Decree of 10 February 2008 establishing the manner in which
indicated that camera surveillance takes place (hereinafter: “RD of 10 February 2008”) and 2
1Law of 21/03/2007 regulating the installation and use of surveillance cameras, BS May 31, 2007.
2Royal Decree of 10/02/2008 establishing the manner in which it is indicated that camera surveillance
takes place, BS 21 February 2008. Decision on the merits 138/2022 - 3/14
on Article 7, Article 8 and Article 9 of the Royal Decree on the declarations of
the installation and use of surveillance cameras and the register of the
image processing activities of surveillance cameras (hereinafter: “Camera Decree”) . 3
8. On January 17, 2022, the Disputes Chamber will decide on the basis of Article 95, § 1, 1° and Article 98
WOG that the file is ready for treatment on the merits.
9. On January 17, 2022, the concerned parties will be notified by email of the
provisions as stated in Article 95, § 2, as well as of these in Article 98 WOG. Also
they are informed, pursuant to Article 99 of the WOG, of the deadlines for their
to file defences.
The deadline for receipt of the defendant's response was
laid down on 28 February 2022, this for the complainant's reply on 21
March 2022 and finally this for the statement of reply of the defendant on April 11
2022.
10. On January 17, 2022, the defendant accepts the electronic communication regarding the
matter.
11. On January 17, 2022, the complainants accept electronic communication regarding the case.
12. On February 28, the Disputes Chamber receives a request to extend the claim periods
extend. On 28 February, the Disputes Chamber will announce the adjusted conclusion terms.
The deadline for receipt of the defendant's response was
laid down on March 2, 2022, this for the statement of reply of the complainant on March 23
2022 and finally those for the defendant's rejoinder on April 13, 2022.
13. On 2 March 2022, the Disputes Chamber will receive the statement of defense from the
defendant with regard to the findings with regard to the subject-matter of the
complaint.
14. The Disputes Chamber has no conclusion from the complainant's reply and conclusion from the rejoinder
received from the defendant.
II. Justification
II.1. Jurisdiction of the Dispute Chamber
15. Article 4, §1, first paragraph WOG states:
“The Data Protection Authority is responsible for supervising the
compliance with the basic principles of the protection of personal data, in
3Royal Decree of 8 May 2018 on the declarations of the installation and use of surveillance cameras and
concerning the register of the image processing activities of surveillance cameras, BS 15 April 2019. Decision on the merits 138/2022 - 4/14
within the framework of this law and of the laws containing provisions on the
protection of personal data.”
16. Article 4, §2, second paragraph WOG also states:
“The Data Protection Authority is the competent supervisory authority
when no other law provides otherwise.”
17. The Court of Justice has previously confirmed that capturing images of persons
with surveillance cameras falls under the term 'personal data' within the meaning of the
European law standards on data protection. The monitoring using
video recording of persons being captured (stored) is an automated
processing of personal data within the meaning of Article 2(1) of the GDPR. The processing of
personal data in that context should therefore also enjoy direct protection
under the GDPR.
18. The surveillance cameras that are the subject of this complaint have been
defendant placed on private property (i.e. the property of the defendant). For the
application of the GDPR, it can be pointed out that the installation of surveillance cameras on
private domain, and the use of those surveillance cameras with which persons are
image, do not necessarily mean that this is a “purely personal or
household activity” within the meaning of Article 2(2)(c) GDPR.
19. When, for example, the video surveillance system enters the public space or private domain
of others, even in part, and thereby out of the private sphere of
those who process data through the system, this cannot be considered as
an activity performed solely for personal or household purposes
7
executed. This makes it possible to make images of natural persons
8
and identify them. This is the case here. The Disputes Chamber can therefore fully
proceed to exercise its powers and assess the facts.
20. The legal assessment of this file will therefore in the first instance take place at the
according to the provisions of the GDPR. The question arises to what extent the processing
4JudgmentCJEU of11December2014,FrantišekRynešt.Úřadproochranuosobníchúdajů,C-212/13,ECLI:EU:C:2014:2428
(hereinafter: Ryneš judgment), para. 22.
5Compare the analysis in the Ryneš judgment of the superseded legal norm mutatis mutandis, par. 25.
6
A private domain is a 'closed place not accessible to the public' within the meaning of article 2,3° Camera Act. The article
reads as follows: "enclosed place not accessible to the public: any building or any enclosed area"
place intended for use by the public where services can be provided to the public”.
7Compare with the Ryneš judgment, para.32.
8
Compare with judgment of the CJEU of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Credito and
Federación de Comercio Electronico y Marketing Directo t. Administración des Estado, C-468-9/10, ECLI:EU:C:2011:777
(hereinafter: JudgmentAsociaciónNacional), para. 35 Decision on the substance 138/2022 - 5/14
of personal data took place lawfully, in accordance with, among other things, Articles 5
and 6 of the GDPR.
21. In addition, the Camera Act and two royal decrees also contain additional
obligations imposed relevant for a number of aspects for the treatment of
present dossier.However, the Dispute Chamber emphasizes that the application of the AVGGals
Regulation of the European Union takes precedence over the aforementioned national legislation because of
of its direct effect and primacy within the European legal order. 9
II.2. Article 5, paragraph 1, a) and paragraph 2 of the GDPR and Article 24, paragraph 1 of the GDPR and the
Belgian legislation on camera surveillance
22. Above, the Disputes Chamber already emphasized that a video surveillance system under the
provisions of the GDPR, when the equipment used makes it possible to
register and store personal data. In this sense, the processing of
personal data are at all times in accordance with the provisions referred to in Article 5 of the GDPR
principles of personal data processing.
23. In its Inspection Report, the Inspection Service establishes that the defendant has
has installed a security camera at his home without taking into account all the principles regarding
processing of data in Article 5(1) of the GDPR and all obligations of the
to respect surveillance camera legislation. More specifically, the
Inspectorate concludes that the defendant has not complied with the provisions of
Article 5 (1) a), b) and c) GDPR.
Article 5 (1) a) GDPR - principle of "lawfulness, fairness and transparency"
24. The basic principle of article 5, paragraph 1, a) AVG is that personal data only in a lawful manner
may be processed. This means that a legal ground for processing
personal data as referred to in Article 6(1) of the GDPR must be present. For what
concerns the assessment of the lawfulness of the processing of personal data,
the Disputes Chamber refers to section II.3.
25. The processing of personal data must also be done properly. Finally must
be clear for which purposes personal data is processed and how this is done
(“transparency”).
26. In implementation of these principles, article 8 of the Camera Act prohibits any secret use of
surveillance cameras:
9ie inter alia Judgment of the CJEU of 5 February 1963, NV General Transport and Expeditie Onderneming van Gend & Loos t.
Dutch Tax Administration, C-26-62, ECLI:EU:C:1963:1; Judgment of the CJEU of 15 July 1964, Flaminio Costa v.
E.N.E.L.,C-6-64,ECLI:EU:C:1964:66;onthelegalprotectionofcitizenson the basis oftheunionrightsprinciples
of 'direct effect' and 'primality', see C.BARNARD, TheSubstantiveLawoftheEU:TheFourFreedoms,Oxford(5deed.),
2016, 17. Decision on the merits 138/2022 - 6/14
“Considered surreptitious, any use of surveillance cameras without prior notice
permission of the filmed person. Entering a place where an icon
indicates that camera surveillance is taking place, counts as prior permission”.
27. Article 7, §2, sixth paragraph of the Camera Act prescribes that the controller
place a pictogram at the entrance to the closed areas not accessible to the public
place that indicates that camera surveillance is taking place. So the icon has a
information role and is mandatory with a view to transparent processing of
personal data. With regard to the pictogram itself, the Camera Act provides for a
uniform model, so that it is always clear to the person involved that he is being filmed.Article 3of
the Royal Decree of 10 February 2008 Article 3 of the Royal Decree of 10 February
2008 establishing the manner in which it is indicated that camera surveillance
10
takes place(hereafter: “RD of 10 February 2008”) determines the requirements that thisicon meets
must comply. For example, the pictogram must be placed at the entrance of a non-pre
publicly accessible enclosed place, such as a family home. Stand on this icon
a number of mandatory information such as, among other things, the identity of the
controller. In this way, the data subject has access to this
information about the processing and the controller.
28. The Inspectorate establishes in its Inspection Report that the parties involved, in this case the neighbours,
were not properly and transparently informed about the processing of their
personal data via the defendant's surveillance camera. The Assenede police zone
After all, Evergem has established that the required pictogram, with the required
entries was not made. After the control of the local police forces, the
defendant purchased a pictogram to comply with this obligation. The
However, the inspection service determines based on photos that were transferred by the
defendant that the pictogram placed was incorrect, which was not in accordance
is with Article 3 of the Royal Decree of February 10, 2008. Consequently, those involved,
including the complainants, was not properly and transparently informed about the disputed
processing their personal data.
29. In its submissions, the defendant argues that when the surveillance camera was installed,
was not aware of the obligation to affix the required pictogram at the entrance
from a place not accessible to the public, in case you own his property
was informed by the local police services during the aforementioned check, has
the complainant ordered an icon online. However, it was determined that the ordered
pictogram did not meet the requirements as stipulated in the Royal Decree of 10 February 2008.
10Royal Decree of 10/02/2008 establishing the manner in which it is indicated that camera surveillance
takes place, BS February 21, 2008. Judgment on the merits 138/2022 - 7/14
When the defendant has been informed of this, he has the correct
icon placed. The defendant makes two photos of this.
30. From the findings of the local police services and the Inspectorate, the
Litigation Chamber that the requirements of transparency and fairness have not been met
data processing, as understood in Article 5 (1) a) GDPR since in the first instance
no pictogram was provided, and afterwards a wrong pictogram in the second instance
was applied. The Disputes Chamber therefore concludes that there has been an infringement
was on Article 5 (1) a) GDPR, but that this has been rectified in the meantime.
31. Abundantly, the Disputes Chamber still points to Article 14 of the GDPR, which determines what information
must be provided by the controller when the
personal data has not been obtained from the data subject. Pursuant to Article 12(7) of the
GDPR this information may be provided through standardized icons,
like the above icon. The Disputes Chamber does not have this aspect any further
examined, as it does not form part of the present dispute.
Article 5, 1, b) GDPR - “purpose limitation” principle
32. In accordance with Article 5(1)(b) of the GDPR, personal data must be collected for specific,
expressly defined and specified purposes are collected.
33. The Inspection Report establishes that there has been an infringement of the above
principle of “purpose limitation” since during the aforementioned check by the Police Zone
Assenede-Evergem showed that no camera surveillance objective was
registered by the controller. Also Article 7, §2, second paragraph of
the Camera Act requires that the controller makes the decision to place
of one or more surveillance cameras in an enclosed area not accessible to the public
place to the police, at the latest the day before that on which the
security camera is put into use.
34. During the inspection by the Inspectorate, the controller has
informed that the purpose of the processing is as follows:
“Initially I bought this camera in 2019 to protect my
backyard and certainly my carport / garage in which there are 2 motorcycles with a value
above 40,000 Euros.”
35. The defendant argues that the camera surveillance was placed with the intention of
securing his own backyard with a carport where motor vehicles with a high
value. The defendant hereby emphasizes that he was not aware of the
mandatory registration and that it was also not his intention to infringe the privacy of his
violating neighbors. The necessary registration of the camera surveillance was arranged after
the aforementioned control by the local police services. Decision on the merits 138/2022 - 8/14
36. The Disputes Chamber establishes that the necessary registration of the purpose of the camera surveillance
was not carried out in a timely manner at the competent local police services, as a result of which it is not possible
it can be assumed that the data was processed for a specific, explicit
defined and specific purpose. Consequently, there is an infringement of Article 5,
paragraph 1, b) GDPR. On the basis of the documents submitted by the defendant, the
Dispute chamber has established that the camera surveillance has meanwhile been registered with the local authorities
police forces with the aim of securing his own backyard with a carport where
high value motor vehicles.
Article 5(1)(c) GDPR - “minimum data processing” principle
37. The principle of data minimum processing as set out in Article 5(1)(c) GDPR states
that the processed data must be adequate, relevant and limited to
what is necessary for the purposes for which they are processed. It follows that the
personal data may only be processed if the purpose of the processing is not
could reasonably be achieved by other means.
38. The Inspectorate refers in its report to the statement of the defendant during the
research. In this statement, the defendant states that the camera has a motion function
has, but that this functionality was turned off on the advice of the local police forces
during the aforementioned on-the-spot check. The Inspectorate believes that in the period before
locking the movement function more personal data was processed, or
could be processed than was necessary, which means that the principle of "minimum"
data processing” was not respected.
39. Defendant submits photographs of a casing that was
made around the surveillance camera, so that at least only part of the own
garden and garage can be filmed. The defendant also makes photos that show
that the security camera can now only film the defendant's own garden. In view of the
above, the defendant also decides that there are
conclusions, there can no longer be a violation of Article 5(1)(c) GDPR.
40. The Disputes Chamber establishes that from the Inspectorate and from the conclusions of the
Defendant turns out that the security camera was able to film more than the garage/carport of the
defendant which constitutes an infringement of Article 5(1)(c) GDPR. Based on
documents submitted by the defendant, the Disputes Chamber determines that these
infringement has since been rectified.
Article 5, paragraph 2 j° Article 24, paragraph 1 GDPR - accountability
41. In view of the violations of the above principles, the Inspectorate notes that the
the defendant fails to demonstrate the following elements:
- how those involved were properly and transparently informed; Decision on the merits 138/2022 - 9/14
- that the processing of personal data via the defendant's surveillance camera
is done for specified, explicit and legitimate purposes;
- that the defendant's surveillance camera does not process more data than
those personal data that are sufficient, relevant and sufficient for the purpose of
purposes for which they are processed.
42. Consequently, the Inspectorate concludes that there is also an infringement of
the accountability obligation as defined in Article 5, paragraph 2, in conjunction with Article 24, paragraph 1 of the GDPR.
43. In addition, the Inspectorate also finds an infringement of Articles 7, 8 and 9 of the
Camera decision as the defendant has not provided a copy of the register of
image processing activities, despite the request of the Inspectorate.
44. In its submissions, the defendant has submitted some of the foregoing by the
Inspectorate want to clarify established infringements. With regard to the
dated register of image processing activities, the defendant states that he had
learned that he did not need to keep such a register because the camera was on a
confined place installed, the images are kept for a maximum of one month.
In the meantime, he is aware that this obligation does apply and in the period
between the completion of the Inspection Report and the submission of the conclusions, the
defendant has drawn up an abbreviated register of image processing activities, of which he
also send photos.
45. The Disputes Chamber recalls that each controller
basic principles of data protection, as provided for in Article 5(1) of the GDPR,
comply and must be able to demonstrate this. This results from the accountability obligation in article
5, paragraph 2 of the GDPR in conjunction with Article 24, paragraph 1 of the GDPR.
46. Based on Article 7, §2, fifth paragraph of the Camera Act and Articles 7, 8 and 9 of the Royal Decree of
8may2018concerningthedeclarationsoftheplacementstheuseofsurveillancecameras
and concerning the register of image processing activities of surveillance cameras 11
(hereinafter: “Camera Decree”), the controller must keep a register of
keep surveillance camera image processing activities as long as it is with
surveillance cameras perform image processing. The aforementioned register must be up to date
are held by the controller, in case the defendant. This register
includes, among other things, the name and contact details of the person responsible, the precise
purposes of the processing, the categories of the recipients, any transfer to
third countries, the retention period, a description of the security measures and also a
number of typical information elements specific to camera use, such as the
indication of the type of place. The Disputes Chamber points out that keeping
11
BS 23 May 2018 Judgment on the merits 138/2022 - 10/14
such register of image processing activities provides a basis for the
data controller to comply with the accountability obligations set out in
Article 5 (2) and Article 24 (1) GDPR).
47. The Disputes Chamber establishes that at the time of the Inspection investigation the requirement
register of image processing activities was not established and maintained by the
defendant, which constitutes an infringement of Article 5(2) and Article 24(1) GDPR. on
based on the documents submitted by the defendant, the Disputes Chamber determines
that this infringement has meanwhile been rectified.
48. Unnecessarily, the Disputes Chamber also points out that in the light of the provisions in
Article 30(5) of the GDPR, which contains an exception to the obligation to also
maintain a processing register directly on the basis of the GDPR, not the register
assessed on the basis of Article 30(1) of the GDPR.
II.3. Article 6(1)(f) of the GDPR
49. Above, the Disputes Chamber already emphasized that a video surveillance system under the
provisions of the GDPR, when the equipment used makes it possible to
register and store personal data. In this sense, the processing of
personal data meet one of the conditions for a lawful
processing under Article 6 GDPR.
50. As explained above, the processing of personal data is only lawful
if it is based on one of the legal grounds as listed in Article 6, paragraph 1 of
the AVG. Since the processing of personal data via a camera takes place in this case
for the protection of an interest of the controller will have to
be tested to what extent the requirements of article 6, paragraph 1, f) of the GDPR are met
(“legitimate interest”).
12
51. According to the case law of the Court of Justice, this test involves three steps:
The controllers must demonstrate that:
1) the interests they pursue with the processing can be justified as legitimate
recognized (the “target test”);
2) the intended processing is necessary for the realization of those interests (the
“necessity test”); and
3) balancing those interests against the interests, fundamental freedoms and
fundamental rights of data subjects weighs in favor of the
controllers or a third party (the “balancing test”).
12
See also Judgment Asociación Nacional, 24 November 2011, C-468/10 Judgment on the merits 138/2022 - 11/14
Target key
According to Recital 47 of the GDPR, “a careful assessment is required to
to determine whether there is a legitimate interest, as well as to determine whether a
data subject at the time and in the context of the collection of the personal data
may reasonably expect that processing can take place for that purpose.”
52. In the present file, the defendant has a surveillance camera as a private person
installed.The interests that the defendant is pursuing in this context he has defined
as follows:
“Initially I bought this camera in 2019 to protect my
backyard and certainly my carport / garage in which there are 2 motorcycles with a value
above 40,000 Euros.”
53. The European Data Protection Board (hereinafter: the EDPB ) has previously
indicated that burglary, vandalism or theft are examples of situations that
justify video surveillance. In the given situation, it is established for the Disputes Chamber
that the processing of data for the purpose of monitoring the garage/carport is a
justifiable purpose.
Necessity test
54. The Court of Justice has underlined in the context of CCTV systems that
this necessity condition must be examined in conjunction with
the principle of "minimum data processing", currently enshrined in Article 5,
14
paragraph 1, point c) GDPR. Personal data must be adequate, relevant and limited
to what is necessary for the purposes for which they are processed.
As established above, the Inspection Report and the conclusions of the
defendant that not only the defendant's garage/carport was filmed, but also
parts of the complainants' private property. Such an arrangement of a
surveillance camera can hardly meet the principle of minimum
data processing. The Disputes Chamber establishes that constant filming of (part of)
thegardens(part of)thehouseofthelagersasneighboursofthedefendantcannotsee
be regarded as "relevant", let alone "necessary" for the defendant to
legitimate interest mentioned above. That there is a cover
was wrapped around the camera, does not detract from the initial infringement.
13Guidelines EDPB 3/2019, par.1
14JudgmentAsociación Nacional 24 November 2011, C-468/10, para. 48. Judgment on the merits 138/2022 - 12/14
balancing test
55. Although failing the 'necessity test' is already sufficient to establish
argue that the processing of personal data through the surveillance camera
took place unlawfully, the Disputes Chamber investigates to the extent necessary
or the existence of fundamental rights and freedoms of data protection
persons involved (plaintiffs) whether or not they prevail over the legitimate interests
of the defendant.
56. That balancing act depends on the particular circumstances of a particular case and the
rights of the complainants concerned under articles 7 and 8 of the European Charter
Union with regard to the protection of privacy and
data protection. 15In this sense, account can be taken of the seriousness of the
infringement of the complainants' rights and freedoms as an essential part of the analysis.
It should be noted that the continuous mapping of private
neighbor's property constitutes a serious infringement of these fundamental rights. This is all the more
the case when another, less invasive treatment has proved possible, i.e.
providing the cover around the surveillance camera. It can also be noted that
it is beyond the objective expectations of those involved that the surveillance camera is on
is positioned in such a way that it is constantly a part of the private domain of
17
the complainants. This is the case, among other things, because the surveillance camera was not
placed in accordance with the provisions governing the arrangement of
surveillance cameras under national law (the Camera Act), as set out in Section
II.2ofthisdecision.Consequently,theDisputesroomdeterminesthattheprocessinginquestion
was not foreseeable to the complainants.
57. Consequently, in the given circumstances, there is also an infringement of Article6,
para. 1, f) GDPR, as the surveillance camera stores images containing personal data
has unlawfully processed. Although legitimate interests exist for
the defendant within the meaning of point f) of Article 6(1) of the GDPR, i.e. concrete processing operations not
necessary to safeguard those interests, and the fundamental rights and
fundamental freedoms of the complainants and other involved parties outweigh those interests.
II.4. Breaches
58. On the basis of the documents in the file, the Disputes Chamber establishes that there was
an infringement of article 5, paragraph 1, a), b) and c) and paragraph 2, article 6, paragraph 1, f) and article 24 paragraph 1 of the GDPR.
15JudgmentAsociación Nacional November 24, 2011, C-468/10; par. 52; EDPB Guidelines 3/2019, par. 32-35.
16JudgmentAsociación Nacional 24 November 2011, C-468/10, para. 56.
1 Regarding these ‘objective expectations’, see EDPB Guidelines 3/2019, para. 36 Decision on the substance 138/2022 - 13/14
Although the defendant has remedied these infringements, it is established that infringements
on the right to data protection. When determining the
sanction, the Disputes Chamber takes into account the fact that the defendant has already
rectified and submit supporting documents. The Disputes Chamber therefore decides
that in the concrete factual circumstances of this case, a reprimand for the aforementioned
infringements is sufficient. The seriousness of the infringement is not such that an administrative fine
should be imposed.
III. Publication of the decision
59. In view of the importance of transparency with regard to the decision-making of the
Litigation Chamber, this decision is published on the website of the
Data Protection Authority. However, it is not necessary for the
identifiers of the parties are disclosed directly.
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority decides, after deliberation, to:
- To formulate a reprimand on the basis of Article 100, §1, 5 WOG.
Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the
notice against this decision, an appeal may be lodged with the Marktenhof (court of
profession Brussels), with the Data Protection Authority as defendant.
Such an appeal may be lodged by means of an adversarial petition that the
must contain the mentions listed in Article 1034ter of the Judicial Code . It
18The application states, on pain of nullity:
1° the day, month and year;
2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
company number;
3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
summoned;
4° the subject matter and the brief summary of the grounds of the claim;
5° the court before whom the claim is brought;
6° the signature of the applicant or of his lawyer. Decision on the merits 138/2022 - 14/14
adversarial petition must be submitted to the registry of the Marktenhof
19
in accordance with article 1034quinquies of the Ger.W. , or via the e-Deposit
IT system of Justice (Article 32ter of the Ger.W.).
(get). Hielke H IJMANS
Chairman of the Disputes Chamber
19The application with its annex, in as many copies as there are interested parties, shall be sent by registered letter
sent to the clerk of the court or deposited at the clerk's office.
