OVG Rheinland-Pfalz - 10 A 10302/21
| OVG Rheinland-Pfalz - 10 A 10302/21 | |
|---|---|
 | |
| Court: | OVG Rheinland-Pfalz (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 4(2) GDPR Article 58(2)(f) GDPR Article 58(6) GDPR Article 28(3) Directive 95/46/EC § 38(5)(2) BDSG a.F. |
| Decided: | 25.06.2021 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 10 A 10302/21 |
| European Case Law Identifier: | ECLI:DE:OVGRLP:2021:0625.10A10302.21.00 |
| Appeal from: | VG Mainz 1 K 584/19.MZ |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Landesrecht online Rheinland-Pfalz (in German) |
| Initial Contributor: | n/a |
A German Higher Administrative Court found that a switched-off surveillance camera does not fall within the scope of the GDPR. Furthermore, Article 58(2)(f) GDPR does not authorise a DPA to order the removal of a (switched off) camera.
English Summary
Facts
The controller erected an LED billboard on a private car park. As there had been regular vandalism there in the past, the controller set up various cameras that operated around the clock and partially recorded the public traffic area. The DPA ordered, among other things, that the data processing by one of the cameras be stopped and that this camera be dismantled.
The controller objected to this order, among others. The court of first instance (VG Mainz - 1 K 584/19.MZ) ruled that the discontinuation order was lawful, but that the dismantling order was unlawful. The controller accepted this decision and, in particular, accepted that he would no longer be allowed to switch on the camera.
In contrast, the defendant appealed against the annulment of the dismantling order.
Dispute
Holding
The appeal was unsuccessful.
The Higher Administrative Court of Rhineland-Palatinate (OVG Rheinland-Pfalz) ruled that, firstly, the scope of application of the GDPR was not opened for the switched-off camera. Secondly, Article 58(2)(f) GDPR does not authorise the ordering of the dismantling of a (decommissioned) camera.
Scope of Application of the GDPR not Opened
In the court's opinion, the scope of application of the GDPR is not opened. There was no processing within the meaning of Article 4(2) GDPR.
Video recordings and their temporary storage are indisputably data processing, but a deactivated camera does not process data (any longer). In the second instance, the operator of the LED board no longer objected to the order of discontinuance. The order has become unappealable. In the absence of any indications of continued operation contrary to the order, the court held that it was to be assumed that the camera was and remained deactivated.
No Authorisation Under Article 58(2)(f) GDPR
Pursuant to Art. 58(2)(f) GDPR, the supervisory authority has all corrective powers allowing it to impose a temporary or definitive limitation on processing, including a ban. The DPA made use of this power by ordering to deactivate the camera and therefore to stop the processing. Article 58(2)(f) GDPR does not establish a further-reaching power to also order the dismantling of the camera.
According to its unambiguous wording, the norm only authorises the supervisory authority to temporarily or definitively limit or prohibit processing. Just like the prohibition in the predecessor provision of § 38 (5)(2) the old version of the German Data Protection Act (BDSG a.F.), the restriction or prohibition refers to a behaviour - the data processing - but does not extend to the removal of the associated hardware. In addition to the wording, the court also cites Recital 129 GDPR, according to which a ban may only be imposed in application of the principle of proportionality if less drastic measures do not promise success. In this respect, the ban represents the ultima ratio of corrective measures. In this respect, a broadening interpretation of the concept of prohibition is not possible. This also results from a comparison with the other measures provided for in Article 58(2) GDPR: Reprimands (lit. b)) and instructions according to lit. (d) show that the ban is one of the most burdensome measures for controllers anyway.
The court also rejected the DPA’s view that Article 58(2)(f) GDPR empowers the ordering of mining as a "technical and organisational measure in the processing environment". In this respect, Articles 24(1), 25(1) and 32(1) GDPR do not establish isolated obligations, but always refer to a data processing operation. This is not the case with a deactivated camera.
A authorisation does also not follow from the principle of effet utile under EU law. The court states that it cannot be inferred from the legislative history of Article 58(2)(f) GDPR that an unwritten authorisation that goes beyond the standardised powers is required for the full effectiveness of the processing ban. Whereas the predecessor provision of Article 28(3) Directive 95/46/EC still provided for relatively broad powers of investigation and interference, which were then open to implementation by the individual Member States, Article 58 GDPR contains 26 concrete powers of investigation, redress and authorisation. In this respect, it cannot be assumed that the legislator deliberately did not include a power that is also the most intrusive. Nor can anything to the contrary be inferred from the explanatory memorandum to the GDPR. In particular, there are no indications that a corrective power in the form of a command to act was to be created in addition to the corrective powers previously provided exclusively as prohibitions.
The fact that the deactivated camera exerts a so-called "surveillance pressure" (as in the case of a camera dummy) does not constitute an authorisation. At most, this represents a violation of the general personal rights of the individual, which must be asserted in civil law with claims for defence, injunctive relief and damages.
The decision was also not precluded by the fact that the camera could be put back into operation at any time. Germany has not made use of the opening clause provided for in Article 58(6)(1) GDPR to establish additional powers for the supervisory authority.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
