Persónuvernd - 2020010710
From GDPRhub
| Persónuvernd - 2020010710 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 5 GDPR Article 6(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 19.03.2021 |
| Published: | 06.04.2021 |
| Fine: | None |
| Parties: | Reykjavík Health Inspectorate |
| National Case Number/Name: | 2020010710 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Icelandic |
| Original Source: | Personuvernd (in IS) |
| Initial Contributor: | n/a |
The Icelandic DPA held that Reykjavík Health Inspectorate had a right to enter and take photos of the complainant's property while enforcing the Icelandic laws on hygiene and pollution prevention.
English Summary
Facts
The DPA received the complaint that representatives of the Reykjavík Health Inspectorate (HER) entered the complainant's private property without notifying him and took photographs of his property and belongings without permission. He also argues that during the visit, HER employees did not maintain proportionality and violated his privacy.
HER explained that according to Icelandic laws on hygiene and pollution prevention, landowners are obliged to keep their properties clean and tidy and to properly arrange waste treatment. The Inspectorate received a complaint that there was an accumulation of car wrecks and other waste on the complainant's yard. Hence, HER decided to take 23 photographs of the scene as evidence, as there was a certain risk of a pollution accident.
Dispute
Was the Reykjavík Health Inspectorate (HER) allowed to process the complainant's data?
Holding
The DPA confirmed that HER works on behalf of the Reykjavík City Health Committee and is responsible for enforcing the Icelandic laws on hygiene and pollution prevention. The processing of personal data covered by the complaint relied on an authorization according to specific provisions of the Icelandic law that allow HER workers to take photos while performing their job.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Ruling on the processing of personal information by the Reykjavík Health Inspectorate
Case no. 2020010710
6.4.2021
The Data Protection Authority has ruled in a case where a complaint was made about the processing of personal information in connection with inspections by the Reykjavík Health Inspectorate. The ruling concludes that the Health Inspectorate's processing of the complainant's personal data was in accordance with the Act on Personal Data Protection and the Processing of Personal Data.
Ruling
On 19 March 2020, the Data Protection Authority issued a ruling in case no. 2020010710:
I.
Procedure
1.
Outline of case
On 19 December 2019, the Data Protection Authority received a complaint from [A] (hereinafter referred to as the "complainant") regarding the processing of personal information by the Reykjavík Health Inspectorate (HER). The complaint was accompanied by a notification from the HER regarding a complaint received by the Agency regarding waste on the complainant's land that had been received by the Health Inspectorate, together with a copy of its inspection report.
More specifically, it is complained that representatives of the HERE entered the complainant's private property without notifying him and took photographs of the property and his belongings and the guest without permission. The complaint was accompanied by two documents in this regard. On the one hand, there was the Army's notification to the complainant, dated. December 3, 2019, on the aforementioned complaint that HER had received regarding him. On the other hand, this was an HER report from 14 October 2019 on an inspection trip due to the complaint, but HER had sent the complainant the report on 11 December 2019.
2.
Correspondence
By letter to the complainant, dated 6 May 2020, the Data Protection Authority reviewed the powers of the HER according to Act no. 7/1998 on hygiene and pollution prevention in connection with the processing of personal data, including provisions on investigative authority and supervisory duty. The Data Protection Authority's letter also discussed the military's powers to access, inspect and monitor, e.g. á m. taking photographs and taking photographs , to all the places where Act no. 7/1998, regulations and articles of association cover, as well as the military's authorization to seek police assistance if necessary. In the letter in question, the complainant's position was requested as to whether he still requested a substantive resolution of his complaint.
Privacy received the complainant's reply letter, dated 26 May 2020, requesting a substantive resolution of the Agency's complaint.
By letter dated On November 4, 2020, the HERE was invited to provide explanations regarding the complaint. The answer was by letter dated. 25. sm
All the above documents have been taken into account in resolving the case, although not all of them are specifically described in the following ruling.
This case has been delayed due to work by the Data Protection Authority.
3.
The complainant's views
The complainant bases his complaint on the fact that HER employees entered his private property, and took photographs of real estate and movable property there without permission. They did not show up, despite the fact that the complainant was at home at the time, nor did they request escort around the area. Among other things, photographs were taken of the guest's cars where the number of the cars was visible. The window of the complainant's residential building was also seen. The complainant also argues that during the visit and data collection in question, HER employees did not maintain proportionality and that the visit involved an invasion of his privacy.
4.
The views of the Reykjavík Health Inspectorate
HER refers to the role of, among other things, to carry out hygiene, food and pollution prevention inspections in Reykjavík and to promote strong environmental monitoring and education for the public in the city. HER is a professionally independent administrative institution with an operational connection to the City of Reykjavík and complies with the provisions of the Administrative Procedure Act no. 37/1993. According to laws and regulations on hygiene and pollution prevention, landowners are obliged to keep plots clean and tidy and to arrange waste treatment so that uncleanliness and inconvenience do not result. It is then forbidden to leave, transport, distribute or store waste in such a way that it can cause damage, pollution or blemishes to the environment. This applies equally to smaller and larger items.
The HERE's answers state that all complaints received by the agency must be dealt with and investigated, cf. Article 10 administrative law. HER has received a complaint about car wrecks and waste to […]. A preliminary survey in the city's web browser had confirmed that there was an accumulation of car wrecks and other waste and that there was every reason for a representative of the HERE to look into the situation in more detail due to the complaint. A site survey has confirmed that a number of cars, car wrecks and cans that could contain hazardous waste as well as other waste were at and near the residential building and other buildings to [...]. It was deemed necessary to take 23 photographs of the scene as evidence, as there was a certain risk of a pollution accident. When an HER health representative goes to the scene and takes pictures due to a complaint received by the inspectorate, are the images among the data used to analyze whether there is a violation of laws and regulations that HER works by as a supervisory body. The purpose of the HERE with the field survey and photography in question was therefore to fulfill the legal obligation that rests with the institution. The information obtained is used solely for that purpose.
The HERE's response also states that health representatives who go on site inspections are bound by confidentiality regarding their work and that the data is stored in access-controlled folders. When requesting case documents on the basis of the Information Act, identification, including car number and other personally identifiable information, is crossed out. It also states that the processing takes place in accordance with Article 8. Act no. 90/2018, but among other things, if the complaint is directed to a notification of the complaint after completion of the inspection together with an inspection report written following the on-site inspection, the objective purpose of the processing is to fulfill the statutory inspection obligation resting with the Army and no more data is collected . It is important that the authority dealing with such investigative powers in question secures evidence against both the complainant and the complainant; and can show that action has been taken due to incoming cases, especially where a risk may arise, such as a risk of pollution, as was considered in the case in question. The procedure is also important to ensure that the decisions of the HER surveillance are in such a way that it is clear what the outcome of the case is based on.
II.
Assumptions and conclusion
1.
Scope - Responsible party
Scope of Act no. 90/2018, on personal data protection and the processing of personal data, and Regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thereby the authority of the Data Protection Authority, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partly or wholly automatic and the processing by other methods than automatic of personal data that are or are to become part of a file.
Personal information includes information about a person who is personally identifiable or personally identifiable, and an individual is considered personally identifiable if it is possible to identify him / her, directly or indirectly, with reference to his or her identity or one or more factors that are characteristic of him or her, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation.
Processing refers to an operation or series of operations in which personal information is processed, whether the processing is automatic or not, cf. Number 4 Article 3 of the Act and point 2. Article 4 Regulation (EU) 2016/679.
If it is possible to link liquidity to an individual, for example on the basis of the registration number of a car of which he is the registered owner, information about this can be considered personal information, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation. The same goes for real estate information.
Photography of real estate and movable property, incl. á m. vehicles, may therefore involve the processing of personal data that falls within the scope of the Personal Data Protection Act. This case concerns a photograph taken on the complainant's site of real estate and movable property, including the complainant's cars and his guests so that the registration number can be seen, as well as the registration of information in this connection due to a visit by a health representative.
In this respect and in view of the above provisions, this case concerns the processing of personal data which falls within the competence of the Data Protection Authority.
The person responsible for the processing of personal information complies with Act no. 90/2018 is named the responsible party. According to point 6. Article 3 of the Act refers to an individual, legal entity, government authority or other party who decides alone or in collaboration with other purposes and methods of processing personal information, cf. 7. tölul. Article 4 Regulation (EU) 2016/679.
HER works on behalf of the Reykjavík City Health Committee and is responsible for enforcing the Act on Hygiene and Pollution Prevention no. 7/1998, Act on Food no. 93/1995 and other laws and regulations that apply to the activities. All municipalities in the country are obliged to run health inspections, which are professionally independent administrative institutions with an operational connection to the municipalities. As such, the Reykjavík Health Inspectorate is therefore considered responsible for the processing in question.
2.
Legality of processing
All processing of personal data must be subject to one of the authorization provisions of Article 9. Act no. 90/2018. It may be mentioned that personal information may be processed if it is necessary to fulfill a legal obligation that rests with the responsible party, cf. 3. tölul. Article 9 of the Act and point c of the first paragraph. Article 6 Regulation (EU) 2016/679. Processing is also permitted if it is necessary for work carried out in the public interest or for the exercise of public authority by the responsible party, cf. 5. tölul. Article 9 of the Act and item e of the first paragraph. Article 6 of the Regulation.
In addition to the authorization according to the above, the processing of personal information must satisfy all the basic requirements of the first paragraph. Article 8 Act no. 90/2018, Coll. Article 5 Regulation (EU) 2016/679. Among other things, it stipulates that personal information shall be processed in a lawful, fair and transparent manner towards the data subject (point 1); that they shall be obtained for clearly defined, legitimate and objective purposes and not further processed for other and incompatible purposes (paragraph 2); and that they shall be sufficient, appropriate and not in excess of what is necessary for the purpose of the processing (point 3).
In assessing whether the requirements of Articles 8 and 9 are met. Act no. 90/2018, Coll. corresponding provisions of Regulation (EU) 2016/679, must also take into account provisions in other applicable laws at any given time, e.g. á m. of the provisions under which the Army operates. Tries there on law no. 7/1998 on hygiene and pollution prevention, but in the first paragraph. Article 62 of the Act lays down the authority of health committees and health representatives who work for them to have access to all the places covered by the Act, regulations and articles of association for the purpose of inspection and supervision, e.g. á m. taking pictures and taking pictures. It also states that it is permissible to seek the assistance of the police if necessary.
According to the explanations received from the HERE, the processing in question in this case was due to an examination of whether Regulation no. 737/2003 on waste treatment, but that regulation is based on, among other things, Articles 4 and 5. Act no. 7/1998. In this connection, the Army deals with comments that had been received in certain circumstances on the complainant's site, which were considered to call for an examination in the light of the rules set out in paragraphs 3 and 4. Article 11 and the first paragraph. Article 16 of the Regulation. It is also stated that due to the investigation of the case, the remedies specified in the aforementioned provision of the second paragraph have been applied. Article 62 Act no. 7/1998, i.e. on-site inspection and photography. In particular, it is examined whether the complainant needed to be provided with education, cf. the aforementioned requirement for transparency according to point 1. Paragraph 1 Article 8 Act no. 90/2018, Coll. also provisions on information to be provided to the data subject on processing in accordance with Articles 13 and 14. of Regulation (EU) 2016/679, cf. Paragraph 2 Article 17 Act no. 90/2018. These provisions apply on the one hand when personal information is obtained from the data subject himself and on the other hand when it is obtained from someone other than the data subject. As previously stated, during the inspection in question by HER, photographs were taken on the complainant's plot of real estate and movable property, e.g. á m. vehicles so that the registration number was visible, and information in this regard recorded As previously stated, during the inspection in question by HER, photographs were taken on the complainant's plot of real estate and movable property, e.g. á m. vehicles so that the registration number was visible, and information in this regard recorded As previously stated, during the inspection in question by HER, photographs were taken on the complainant's plot of real estate and movable property, e.g. á m. vehicles so that the registration number was visible, and information in this regard recorded.
In III. Chapter I of Regulation (EU) 2016/679 deals, among other things, with the rights of a registered individual and lays down rules so that he can exercise his rights. According to Art. of the Regulation, certain educational obligations take effect when personal information has not been obtained from the data subject himself. The Data Protection Authority is of the opinion that the above-mentioned circumstances that could activate the obligation to provide education according to the provision do not apply in the case.
On the other hand, when collecting personal information from a registered individual, the responsible party's educational obligation, cf. Article 13 of the Regulation, take effect. In assessing whether the above-mentioned educational obligation applies, some kind of involvement of the data subject in such disclosure must be taken into account. Photographing of objects owned by individuals that are visible to the outside world and the registration of information about them by a third party does not involve the involvement of the data subject. In this respect, the Data Protection Authority considers it clear that the photography and registration in question does not involve the collection of personal information from the data subject himself, so that the obligation to provide education in this connection works.
Of the general transparency requirement of point 1. Paragraph 1 Article 8 Act no. 90/2018 may lead to the need to provide education when the cases covered by Articles 13 and 14 Regulation (EU) 2016/679 releases. In assessing whether a special educational obligation applies according to the general transparency requirement, it may be relevant, among other things, whether there are urgent reasons for the government to exercise initiative control without being informed in advance. Assessment in these matters is subject to the general rules of administrative law, cf. including the investigative rule of Article 10. of the Administrative Procedure Act no. 37/1993 and the principle of proportionality in Article 13. the same law. The Data Protection Authority does not consider itself, at present, to be able to reconsider the HERE's assessment that surveillance was required in the case in question without prior notification to the complainant in the light of considerations under data protection legislation.
In light of the above, the Data Protection Authority considers that the processing of personal information about the complainant by the Reykjavík Health Inspectorate, which this complaint covers, has relied on an authorization according to points 3 and 5. Article 9 Act no. 90/2018. It will not be seen that the basic requirements of the first paragraph have been violated. Article 8 of the same Act, nor other provisions of the Act, and the processing is therefore deemed to have complied with them.
Ú r s k u r ð a r o r ð:
The Reykjavík Health Inspectorate's processing of personal information on [A] for the purpose of monitoring hygiene and pollution prevention in the city complied with Act no. 90/2018, on personal protection and processing of personal information.
In Privacy, March 19, 2020
Helga Þórisdóttir Þórður Sveinsson
