HDPA (Greece) - 30/2020
The HDPA of Greece examined a complaint of four data subjects (namely, the two owners of the property, a Private Company [P.C.] - renter of the property for the purposes of completing the ongoing on-site construction work , and the legal representative of said company) against a data processor regarding the violation of their right to protect their personal data and of their privacy. The case revolved around the latter person’s action of installing and making use of a video surveillance system including two cameras within their own property, but whose area of surveillance included the complainants’ property and public street. The HDPA, after addressing the meaning of the data processing principles (Article 5 GDPR) and the details of data processing via video surveillance, it made use of its corrective powers (Article 58(2) GDPR) in order for the violation of Article 5 GDPR to be restored, as well as of its authority to impose an administrative fine that amounted to 8,000 EUR.
English Summary
Facts
The complainants claimed that the respondent's installed and operational video surveillance system (that includes two cameras, one at the entrance of the latter's property and one on one of the corners of its roof) illegally includes in its area of surveillance the complainants' property (meaning both the property's ground and the construction workers working on-site) and the public side street, while they also claimed that there were no necessary warning signs that underlined that the area of surveillance also included outdoor areas of the respondent's property. The respondent underlined that the camera placed at their property's entrance was not operational, but it was installed only for preventive purposes, and that the street in front of their entrance is not public but rather a part of their own property for which a right of passage/way has been granted to the complainants' in order to facilitate their access to their own property. The respondent also argued that the camera on the rooftop of their property does face the complainants' property, since this is where possible trespassers can come from. On his part, the complainant claimed that he had managed to secure a positive ruling on their suspension request for the construction work taking place at the complainants' property on the basis of its possible continuation having a negative effect on the regions' environment. The complainants argued that the purpose of the cameras' instalment was for the respondent to use the illegally obtained video surveillance material as evidence to support their ongoing legal dispute (regarding the so-called illegal continuation of the construction work at the complainants' property) started promiscuously by the respondent, whilst the respondent underlined that he installed the system in order to protect their property from being targeted by criminals, especially after having taken into account that they constitute a valuable target due to their professional achievements and that the soon-to-be abandoned construction site on the complainants' property constituted an easy passage for burglars. Additionally, the complainants presented as supporting elements to their complaints the statements of the respondents' lawyer regarding the installation of the cameras and its purpose. Nonetheless, the complainant submitted the photos as evidence for the said case, but underlined that their blurriness makes it impossible for the people or their bodies present at the complainants' property to be identified, while they also underlined that at the moment of the cameras' installation there was no construction work going on and, after all, no construction work was permitted to be taking place (due to said suspension requests/decisions). The complainants filed a warning notice against the respondent in order for the illegal video surveillance to stop via the minimising of the one camera's area of surveillance and via the taking down of the other camera and for warning signs to be placed on-site. According to the complainants the respondent only proceeded with the placing of one warning sign for the one camera, while the respondent claimed that he ordered his technician to alter the area of surveillance of the two cameras so as for the complainants' property to not be included in it. Addressing the complainants' claim that the cameras were still operational at the time of the complaint's examination, the respondent underlined that not only did they have placed a warning sign but that they had also turned both cameras off until the respective legal battle was over.
Dispute
The HDPA considered the following legal issues;
How can a natural person/data subject be identified or identifiable, directly and indirectly, so as for the information under question to be considered personal data under Article 4(1) GDPR?
Does the installation of video surveillance systems, the taking of photos, and the saving of these photos to the system's surveillance memory constitute acts of data processing, acts interfering with the right to privacy and the right to protects one's personal data?
Does the fulfilment of the principles relating to data processing under Article 5(1) GDPR constitute a prerequisite for the legality of data processing? What is the meaning of the data processor's accountability under Article 5(2) GDPR? Did the data processor under question violate Article 5(1) and 5(2) GDPR?
Does the existence of a basis for lawfulness of processing under Article 6 GDPR renders the fulfilment of Article 5 GDPR's principles relating to data processing non-necessary for the data processor? How did this affect the specific case under question?
Does the warning by the data processor of the data subject that their data are to be processed constitute a prerequisite for the legality of data processing? How did this affect the specific case under question?
What is the meaning of the purely personal or household activity (Article 2(2)(c) GDPR) regarding video surveillance? How does the principle of proportionality and the data processor's purposes and motives affect the legality of data processing via means of video surveillance, especially under HDPA Order 1/2011 on the use of video surveillance systems for the purposes of the protection of people and goods? Was the case's data processor acting on a purely personal or household level and how was the principle of proportionality implemented in the specific case under question?
Holding
The HDPA focused on the meaning of the definition of personal data under Article 4(1) GDPR, a definition that refers to information relating to an identified or identifiable, directly or indirectly, natural person. The HDPA argued that in order to identify - especially indirectly - a natural person one has to take into consideration all the means that could possibly be used by the data processor or by a third person (see also HDPA Decision 41/2017) and all the specific circumstances of each case (for example, a photo taken from high altitude renders direct identification almost impossible, but the height, clothing, body shape, and actual position of a person depicted in the photo may lead to its indirect identification). This also means that the same elements/means that cannot lead to the identification of a person within a larger social environment or group may be (more than) enough to identify a person within a smaller social environment or group.
The HDPA underlined that photos from video surveillance systems constitute personal data from the moment that the people depicted in them are identified or identifiable, while the installing and operation of video surveillance systems, the recording and storing of images, even from public spaces, constitute acts of data processing and acts of interference with the right to privacy and to the right to protection of one's personal data (Articles 9 & 9A Greek Constitution, Article 8 ECHR, Articles 7 & 8 CFREU). Thus, in order for lawful and legal data processing to be taking place in such a video surveillance scenario, it is necessary for the principles relating to the data processing (Artcile 5(1) GDPR) and the content of Article 6 GDPR and the provisions of the HDPA Order 1/2011 to be fulfilled and implemented. But, the HDPA noted that the existence of a basis of lawfulness of processing under Article 6 GDPR does not relieve the data processor from their responsibility to fulfil the prerequisites that Article 5(1) GDPR sets out. This way, if there is a violation of any of the Article 5 principles, there is no use in examining the existence of any basis of lawfulness of data processing, since the latter cannot surpass the former.
The HDPA, after making a reference to the CJEU Decisions on Case C-201/14 and on C-496/17, held that the data processor has a responsibility to warn data subjects about the fact that their data are to be processed in a legal and transparent way, so as for the prerequisite of the legality of this data processing to be fulfilled, as well as a responsibility to be prepared at all times to prove - under the principle of accountability of Article 5(2), 24(1) & 32 GDPR - that a legal and transparent data processing is in fact taking place. With this last regulation, the "burden of proof" is transported to the data processor who is now responsible to prove the legality of their act of data processing, an action (the proof) that, regarding video surveillance systems, needs to be made prior to the installation and commencement of operation of the system (see also HDPA Decision 43/2019).
Furthermore, the HDPA underlined that the transmittal of the video surveillance footage constitutes a separate and new act of data processing and, thus, the prerequisites of Articles 5 and 6 GDPR (including the possibility of a change in the purpose for which data are being processed) have to be met once in relation to this new act. The HDPA, though, underlined the obvious remark that if the initial gathering of data was illegal, then the further processing of these data is obviously illegal as well due to the violation of Article 5(1) GDPR, even in cases where the prerequisites of Article 6 GDPR were met, since, as already mentioned, the latter cannot overcome the violation of the former.
Moving on, the HDPA addressed the meaning of the purely personal or household activity under Article 2(2)(c) GDPR and explained that, regarding video surveillance, if the area of a surveillance system installed within a private property includes only private spaces, then this activity falls under the category of purely personal or household activities. On the contrary, should the area of surveillance include outdoor public or communal spaces or spaces that belong to other private individuals, then the principles of the protection of personal data are being implemented (see also CJEU Decision on Case C-212/13). Adding to that, the HDPA proceeded with the explanation of its Order 1/2011 according to which the legality of the use of video surveillance systems for the purposes of protecting goods and people is examined within the context of the data processor's purpose and the context of the principle of proportionality (the use of the systems must constitute an appropriate and necessary measure, while the purpose must not have been able to be accomplished via a more mild measure - the area of surveillance must be limited only to that needed for the purpose to be met and not to gather more personal data than necessary for the purpose). The HDPA's Order prohibits the surveillance of public side streets and sidewalks, of neighbouring entrances or the interior of neighbouring properties or other spaces, of places of work, while the use of cameras that have the ability to rotate and focus is only allowed for real-time surveillance and under specific technical circumstances. The Order itself also underlines the responsibility of the data processor to warn passersby in a visible and understandable way that they are about to enter the area of surveillance, on who's behalf the surveillance is taking place (the data processor), as well as who can they contact in order to exercise their rights as data subjects awarded to them via the GDPR.
Taking all the above in to consideration, the HDPA held that the respondent, even though they had the responsibility of accountability based on Article 5(2) GDPR, they did not manage to prove the legality of the installation and operation of the video surveillance system, since they did not provide the HDPA with the necessary documents proving the fulfilment of Articles 5 & 6 GDPR or of the HDPA Order 1/2011 requirements prior to the installation of the system, while they also failed to provide proof for the exact moment of the system's purchase, installation and operation. The HDPA characterised the respondent's activity as not being purely personal or household activity (Article 2(2)(c) GDPR), since - as seen from their statement as well - they had directed the camera's area of surveillance towards the property of the complainants. The HDPA further held that the legal dispute between the two parties concerning the illegal or not construction work does not fall under its jurisdiction, and that, in all cases, it does not fulfil the responsibility of accountability (Aritcle 5(2) GDPR) and, after all, the existence of a basis for the lawfulness of data processing (Article 6 GDPR) does not overcome the violation of the principles of data processing based on Article 5(1) GDPR. The HDPA further underlined that the identity of the people portrayed in the images is identifiable, either directly (as is the case for the complainants/owners of the property that are known to the respondent) or indirectly, as mentioned above. Thus, the HDPA concluded that the respondent illegally installed and operated the video surveillance system, thus violating the principles of lawfulness, fairness and transparency (Article 5(1)(a) GDPR), something that renders unnecessary the examination of the possible violation of the rest of the principles relating to data processing, the implementation of the principle of proportionality, as well as the examination of the existence of a basis for the lawfulness of data processing. This way, the HDPA decided to make use of its corrective powers under Article 58(2) GDPR and impose on the respondent the responsibility to restore the fulfilment of Article 5(1)(a) GDPR and of Article 5(1)(b-f) GDPR, as well as to render the operation of their surveillance system in accordance with the provisions of the HDPA Order 1/2011 (mostly via the alteration of the cameras' area of surveillance), within one month from the receipt of the Decision itself. But, given that the HDPA did not consider the above measure as adequate, it also made use of its power to impose an administrative fine (Articles 58(2)(i) GDPR) & 83 GDPR) and, after having taken into consideration Article 83(2) GDPR's fine measuring principles and ARTICLE 29 Data Protection Working Party's Guidelines on the application and setting of administrative fines (wp253), it imposed on the respondent the effective, proportional, and preventive administrative fine of 8,000 EUR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
