DSB (Austria) - 2020-0.759.615
From GDPRhub
| DSB (Austria) - 2020-0.759.615 | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 6(1)(f) GDPR Article 9(1) GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 07.01.2020 |
| Decided: | 23.11.2020 |
| Published: | 11.04.2022 |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 2020-0.759.615 |
| European Case Law Identifier: | ECLI:AT:DSB:2020:2020.0.759.615 |
| Appeal: | n/a |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in DE) |
| Initial Contributor: | Heiko Hanusch |
The Austrian DPA held that a ski lift operator is allowed to take pictures of its customers each time they are passing access controls to manually check whether customers illegitimately transfer their tickets to third persons.
English Summary
Facts
The controller runs the ski lift service in a ski resort (name is not known). When a day ticket or multi-day ticker holder passes through the access controls the first time, the controller takes a first photo of the user. After that, each time the user passes an access point, another photo is taken and compared with the first one by an authorised employee to check whether the ticket holder transferred their ticket to a third person, which is prohibited according to the terms and conditions of the service. The first photo is deleted after the ticket is expired while the other(s) after 30 minutes the user has passed a certain control point. The data subject used the controller's service from 27 to 29 December 2019. On 7 January 2020, he lodged a complaint with the Austrian DPA (Datenschutzbehörde - DSB) alleging that the controller's conduct was unlawful since no consent had ever been provided by the user. The controller counterargued that it did not rely on consent but rather on its legitimate interest to check whether a customer violates the terms and conditions by transferring the ticket to a third person.
Holding
The DSB rejected the complaint because the controller's conduct was justified under Article 6(1)(f) GDPR. It reasoned that the controller's interest to check whether the data subject violated the terms and conditions was legitimate and that it was not overridden by the data subject's interest to privacy. By referring to sentence 3 of Recital 51 GDPR, the DSB found that the pictures taken from the data subject did not constitute biometric data according to Article 9(1) GDPR because they did not result from "specific technical processing", as required by Article 4(14) GDPR, but are rather used to manually check the identity of the customer. It then held that the measures taken by the controller are not unusual nowadays and, therefore, the data subject could have reasonably expected them (first sentence of Recital 47 GDPR).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
GZ: 2020-0.759.615 from November 23, 2020 (case number: DSB-D124.1978)
[Note editor: Names and companies, legal forms and product names,
Addresses (incl. URLs, IP and email addresses), file numbers (and the like), etc., as well as
their initials and abbreviations may be abbreviated for reasons of pseudonymization
and/or changed. Obvious spelling, grammar and punctuation errors
have been corrected.]
NOTICE
S P R U C H
Data Protection Authority decides on Robert A***'s privacy complaint
(complainant) of January 7, 2020 against N*** Lift GmbH (respondent),
represented by the lawyers Dr. Rudolph L*** & Dr. Sebastian L***, due to injury in
Right to confidentiality as follows:
- The complaint is dismissed as unsubstantiated.
Legal basis: Sections 1 (1), 18 (1) and 24 (1) and (5) of the
Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended; Art. 4 nos. 1 and 2, Art. 5 para. 1 lit. c,
Article 6 paragraph 1, Article 51 paragraph 1, Article 57 paragraph 1 letter f and Article 77 paragraph 1 of the Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of
4.5.2016 p. 1.
REASON
A. Submissions of the parties and course of the proceedings
1. With a procedural submission dated January 7, 2020, the complainant submitted that
the Respondent is the sole operator of the lift system on the Z***berg. find there
In addition to checking the validity of the lift ticket for access control, a photo is also taken
and a comparison of this photo with a previously stored reference photo takes place. Without
A lift ticket cannot be purchased with this automatic photo comparison, as is the
Consent to take photos linked to the use of the lift ticket. Don't agree
on, the lift system cannot be used. About this automated photo processing
no further information could be found. The complainant means that here an opt-in
Procedure analogous to e-mail addresses would have to be applied. Of the
Complainant used this lift from December 27, 2019 to December 29, 2019. December 2019
used.
As attachments, the complainant sent various photos, screenshots and e-mail
traffic.,2. With a statement dated March 6, 2020, the Respondent, represented by counsel, led
that it is correct that, for the purpose of access control, a reference photo of the
Lift ticket holder when first stepping through the equipped with a camera
Turnstile at the valley station of the Z***bergbahn I and at the valley station of the *** gondola
will be made. In the general tariff regulations, which are in the checkout area
were posted and on the homepage it was pointed out that a
photographic capture, storage and processing for control purposes to avoid
of improper use of the card. These dates will expire at the end of each year
the period of validity of a ski pass is deleted.
This access control is permissible, especially since it is only at special entry points, namely the
already described turnstiles, successes. There is at the valley station of the Z***bergbahn I
Furthermore, two access areas, one north-west and one east, whereby the
Reference photo only when passing through the north-west access system. be this
announced by appropriate stickers and information signs. It suits every ski guest
free to traverse one of the two areas. At the mountain station, the skier
In addition to the *** gondola, ten other lifts are available as an alternative, with neither one
Reference- another control photo to be taken. Furthermore, there is the possibility
to purchase hourly tickets for which no reference photo is taken. Sohin be the
Use of the lift system not linked to the respective consent.
The image files would be encrypted automatically. The inspector who makes the comparison
To do this, you have to log into the system with a password. Sohin succeeds
Control not automated, but based solely on the personal
Perception of the authorized employee on the screen. A control photo will
deleted within 30 minutes after passing through the turnstile.
As a result, access control with image comparison protects those who are authorized
Respondent's interests in delaying misuse of the
Lift tickets, which is why there are no violations of the GDPR or the DSG.
3. With a statement dated April 15, 2020, the complainant - if
relevant to the procedure - from the fact that in the best case it would require twice the financial effort,
to cover a day's skiing with hourly tickets, which is why the complainant did not
recognize proportionality. It can also be expected from the classic skier that this
spend at least one day on the slopes. The references given are only at or
shortly before passing through the relevant turnstile. Because of the big
Andrangs it is then no longer possible to decide otherwise and is not one of them
It can be assumed that no photo capture will take place at other turnstiles. Be on the trail map
not shown at which points a photo was taken. The use of the ski area is also possible without the *** gondola lift as the central connection point of the ski
area impractical. The complainant denied that the access controls with
Image comparison supported the predominantly legitimate interests of the respondent, this
may be given for multi-day tickets. Based on an email from an employee
Furthermore, it was to be assumed that use without a photo ID would not be possible
would have been.
B. Subject of Complaint
Based on the submissions of the complainant, the object of the complaint is whether
the Respondent informed the complainant by processing his image data for the
Purpose of access control to cable car and ski lift systems in the period from 27. to
December 29, 2019 violated his basic right to secrecy according to § 1 paragraph 1 DSG
Has.
C. Findings of Facts
1. The Respondent operates a cable car and ski lift company in *3 St. U*** am
Z***berg. There it becomes more abusive for the purpose of access control or delaying
Use of ski passes (unauthorized transfer of ski pass) a reference photo of a
every lift ticket holder when crossing the turnstile for the first time
north-western access to the valley station of the Z***bergbahn I and at the valley station of the
*** Gondola made and subsequently a control photo. ski passes are
according to point. * of the Respondent's general tariff provisions
transferable. The image capture is through appropriate stickers as well as information signs respectively
marked.
The position of the turnstiles with image control is as follows:
[Editor's note: the graphic file (piste map) was removed because it was not in the RIS
can be represented.]
Evidence assessment: The findings made are based on the credibly presented
Respondent's statements. The General Tariff Conditions
Respondent and the piste map including the marked turnstiles
submitted by the respondent. That stickers as well as information signs in front of
Appropriate image capturing is installed at the turnstiles
Complainant confirms, even if he complains, that after viewing this
Due to the large crowds, it was not possible to turn back.
2. The complainant has for the period from December 27 to 29, 2019
Purchased ski day tickets from the Respondent for the Z***berg and the facilities of
Respondent used. On the respective day ticket - in accordance with the tariff provisions of the Respondent - there is a note that the ski pass is not
is transferrable. Furthermore, there is a reference on the ski pass that the
Tariff regulations as posted apply.
This information is shown as follows (excerpts) on the ski pass:
[Editor's note: the graphic file (photograph of the ski pass) was removed because it
cannot be represented in the RIS.]
As described above, a reference photo was taken for the purpose of access control
as well as subsequently control photos of the complainant to the appropriate
turnstiles made. The reference and control photos were compared using a
Control person who had to log in to a password-protected system.
The reference photo was used until the ski pass expired
saved. The respective control photo was taken within 30 minutes after walking through
of the turnstile deleted.
Assessment of evidence: The findings that the complainant is the subject
has used the facility and that the ski passes are not transferable are based on the
undisputed information provided by the complainant and the submitted photos of the ski passes
from December 27th and 28th, 2019 and the ski pass number from December 29th
2019. The findings made on the handling of the control and reference photos
based on the credibly presented statements of the Respondent.
D. In legal terms it follows that:
1. § 1 para. 1 DSG stipulates that everyone, in particular with regard to respect
of his private and family life, right to secrecy of those concerning him
personal data, insofar as there is a legitimate interest in it.
The affected data of the complainant (photographs) are undisputed
personal data.
However, the fundamental right to data protection is not absolute, but may be
permissible interventions are restricted.
According to § 1 para. 2 DSG, a restriction of the right to secrecy in
vital interest of the person concerned or with his consent, otherwise
only to protect overriding legitimate interests of another, namely at
Interventions by a state authority only on the basis of laws resulting from the provisions of Art. 8 Para. 2
ECHR reasons are necessary.,The GDPR and in particular the principles enshrined therein are also
Interpretation of the right to secrecy must be taken into account in any case (cf. the
Notice of July 4, 2019, GZ: DSB-D123.652/0001-DSB/2019).
2. The complainant sometimes justified his complaint with the fact that he had no free
would have had a choice and to use the appendices of the Respondent in the
had to consent to data processing. He also explained that, as with e-mail
Registrations, an “opt-in procedure” is used. That's what he's pointing to
Complainant states that consent to data processing within the meaning of Article 6 Paragraph 1 lit
DSGVO has not occurred voluntarily or can never occur voluntarily, since the
Use of the facilities is linked to the consent. According to recital 42 of
DSGVO should only then be assumed that consent is voluntary
considered if the data subject has a genuine and free choice and is able
to refuse consent without suffering any detriment. On this subject has
the OGH with a decision of August 31, 2018, according to which the coupling of the
consent to the processing of non-contractual personal data
the conclusion of a contract, the consent is generally not voluntary, unless in individual cases
special circumstances speak for their voluntariness (cf. OGH 31.8.2018, 6 Ob 140/18h,
RS0132251).
However, these considerations can be left aside, especially since the Respondent
The data processing in question expressly does not rely on the consent of the
supports those affected.
3. The Respondent submits that the data on the basis of their predominant
to process legitimate interests, which is why the existence of this intervention
iSd Art. 6 Para. 1 lit. f GDPR must be checked. Sohin has an assessment of the legitimate
To take place in the interests of the complainant and if these are in line with the legitimate interests of the
confront the respondent and third parties. As part of this
Balancing interests, it must be taken into account that there are two cumulative requirements
must be, so that the Respondent can rely on this legal basis
can:
On the one hand, the processing must be carried out to protect the legitimate interests of the
Controller or a third party may be required, on the other hand, fundamental rights and
Fundamental freedoms of the data subject, which require the protection of personal data,
do not predominate (cf. on Art. 7 lit. f of Directive 95/46/EC the judgment of the ECJ of
24 November 2011, C-468/10 and C-469/10 [ASNEF and FECEMD] para. 38) (cf. the
Notice of the DSB from 4.7.2019, GZ: DSB-D123.652/0001-DSB/2019, RIS,
license plate recognition).,4. In this context it should be noted that the present
Data processing system essentially the same as those under the designation
"PHOTOCOMPARE - access control in connection with the use of personal (image) data
of ski lift card users” by the Data Protection Authority until the end of May 25, 2018 in
Data processing register in accordance with §§ 17 ff in conjunction with §§ 8 Para. 1 Z 4 (mainly authorized
interests), 8 Para. 3 Z 4 (performance of contract), 6 Para. 1 Z 5 and § 24 DSG 2000 registered
became.
In the course of these registrations, the existence of overriding legitimate interests
of those responsible affirmed, which is why the complainant's complaint is already settled
for this reason proves to be unfounded.
5. The details are as follows:
On the one hand, the complainant has a legitimate interest in keeping his information secret
to concede data, specifically his photograph. If the complainant submits
that sensitive personal data are affected by the image recording is dem
to counter that the processing of photographs only has a special category
of personal data if this differs from the definition of the term
"biometric data" is collected; in other words, if those with special technical
Means are processed that uniquely identify or authenticate a
natural person (DSGVO recital 51, see also Guidelines 3/2019 on
processing of personal data through video devices of the European
Data Protection Committee, version 2.0, page 17 para. 62). A simple digital photo that like
stored here for visual comparison purposes only and displayed on a screen
without being subjected to "special technical processes" therefore does not meet any
Fact of the processing of special data categories according to Art. 9 Para. 1 DSGVO.
On the other hand, the Respondent has a legitimate interest in it
recognize that their contractual partners behave in accordance with the contract and are therefore in their own interest
that compliance with the tariff conditions is monitored by controls in order to
unauthorized transfer of the ski pass, which - as stated - is expressly prohibited
will to hold out. This not least, especially since day passes or multi-day passes - like the
Complainant recognizes - are more cost-effective than hourly tickets. Is to
It should be noted that with hourly tickets there is a risk of unauthorized disclosure
is to be regarded as more negligible due to the shorter period of validity than with (multiple)
day tickets. Accordingly, the complainant's argument that no
Proportionality is given, especially since almost twice the financial effort is required
be, to cover a day's skiing with hourly tickets, into emptiness. That from the
The system implemented by the Respondent is quite suitable to ensure effective access control and therefore to fulfill its purpose. Due to the
established facts that the acquisition of reference or control images only
two important hubs of the system takes place as well as the storage period only in this way
long as necessary, the measures taken turn out to be not
overly intrusive. Furthermore, the control is carried out exclusively by authorized persons
Employees, which is why the respective photographs do not have a significant group of recipients
get.
It must also be taken into account that according to recital 47 first sentence GDPR
reasonable expectations of a data subject regarding the use of their
data is to be considered as an important factor when weighing up interests
(cf. Heberlein in Ehmann/Selmayr, General Data Protection Regulation Commentary [2018] Art. 6
para. 28). It should be noted that access control systems, such as those used by the Respondent
starts, at least – like the numerous registrations mentioned above in the former
data processing register - are now not uncommon (cf. the
Considerations of the data protection authority in the decision of July 4th, 2019 already cited, GZ: DSB-
D123.652/0001-DSB/2019, number plate recognition). In addition, the complainant had
Knowledge of access control and expected in advance. This can sometimes be the result
infer that the complainant had already sent an email dated December 24, 2019 - hence
before using the Respondent's facilities - inquired whether the acquisition of a
ski pass without image capture is possible. If the complainant submits that
The answer given by the Respondent's employee was incorrect, since it was obviously possible
insisted on purchasing hourly tickets for which no photographs were taken
to counter that this was not part of the complainant's request.
Apparently he had only asked about ski passes and not about hourly tickets.
6. Based on the above, the Data Protection Authority concludes that
here the legitimate interests of the respondent are those of the complainant
predominate, which is why the Respondent is right to rely on its legitimate
Interests as the basis for the lawfulness of the processing in accordance with Art. 6 Para. 1
lit. f GDPR. The Respondent therefore does not have the Appellant in its
violated the right to secrecy.
It had to be decided accordingly.
