| APD/GBA - 74/2020 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 6(1)(f) GDPR Article 25(1) GDPR Law of 21 March 2007 regulating the positioning and use of video surveillance cameras |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 24.11.2020 |
| Published: | 24.11.2020 |
| Fine: | 1500 EUR |
| Parties: | n/a |
| National Case Number/Name: | 74/2020 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Data Protection Authority (in NL) |
| Initial Contributor: | n/a |
The Belgian DPA (APD/GBA) imposed a fine of € 1500 on a private individual for the unlawful filming of public roads and private property of third parties with surveillance cameras, and for illegally sharing images taken from this system in breach of Article 6(1)(f) GDPR.
There were legitimate interests for the defendants to install surveillance cameras to protect their own private property. But the way those surveillance cameras were positioned and the fact that they were constantly monitoring was not deemed necessary to safeguard those legitimate interests. The DPA moreover found the interests of the defendants to process personal data through the surveillance cameras to be overridden by the interests of the complainants and other data subjects.
On the contrary, the taking of a one-off photograph with a smartphone, as a direct response to seeing an alleged offence, was seen as constituting a lawful processing within the meaning of Article 6(1)(f) of the GDPR.
English Summary
Facts
A couple has installed a video surveillance system on their property. The couple's neighbors lodged a complaint because some of the cameras were placed in such a way that they were filming part of the public road as well as their private property, and had filmed the complainants while driving on the public road or entering private property of their own. The complainants asked that the video surveillance system would be taken down.
The complainants also opposed the further use of the recordings made by the video surveillance system, which were subsequently shared by the defendants with an expert in the context of another (environmental law) dispute between the defendants and the complainants.
The defendants took a photograph of the complainants with a smartphone, to establish an alleged breach of environmental law. The complainants also fought the making of such photograph and the further processing thereof.
Dispute
Is the processing of personal data included in photographs and camera images lawful under Article 6(1)(f) of the GDPR?
Holding
First of all, the DPA recalls that:
- a video surveillance system falls under the provisions of the GDPR when the equipment used makes it possible to collect and store personal data;
- such processing of personal data must at all times be consistent with the principles of data protection found in Article 5 of the GDPR, and fulfill one of the lawful bases for processing as set out in Article 6 of the GDPR.
Recording and use of images from the surveillance cameras
As the complainants had not given their consent to the processing of their personal data, no other condition for the lawfulness of processing was possible in this context, except the "legitimate interests" under Article 6(1)(f) of the GDPR.
The Belgian DPA therefore conducts a "legitimate interests assessment" by following the three-part test:
Purpose test
Is there a legitimate interest behind the processing?
The DPA found that the defendants had a legitimate interest in placing the surveillance cameras in order to ensure the protection of their property and fight burglary, vandalism or theft. The damages caused to the goods belonging to the defendants in the period prior to the installation of the surveillance cameras show that the legitimate interest on the part of the defendants was moreover real and currently existing (and therefore not a purely hypothetical).
Necessity test
Is the processing necessary?
The DPA found that some surveillance cameras were set up in a way that cannot be regarded as necessary and in accordance with the data minimisation principle. The extensive and constant filming of the public highway cannot indeed be regarded as 'relevant', let alone 'necessary', for the defendants to safeguard their legitimate interests.
Balancing test
Is the legitimate interest overridden by the fundamental rights and freedoms of the data subject?
The surveillance cameras also did not withstand the weighting test, considering the seriousness of the infringement of the rights and freedoms of the complainants.
To come to this conclusion, the DPA pointed out that:
- Continuous monitoring of the public highway, i.e. 24 hours a day, 7 days a week, constitutes a serious breach of the fundamental rights of the complainants. This also applies to the continuous monitoring of private domains of the complainants.
- This is all the more true when other less intrusive processing proves possible, by adjusting the position of the surveillance cameras.
- The rights of many other people were violated, such as the complainants’ children, or drivers of vehicles passing by on public roads in front of the defendants’ homes.
- It is beyond the objective expectations of the data subjects concerned by the surveillance cameras.
- The surveillance cameras were not installed in accordance with the provisions on the installation of security cameras under national law (law of 21 March 2007 regulating the positioning and use of video surveillance cameras).
The DPA Litigation Chamber therefore upheld that the images made by the surveillance cameras were not processed in a lawful way under Article 6(1)(f) GDPR. Those unlawful processing operations were, by their very nature, sufficient in themselves to show that insufficient measures have been taken by the defendants to respect the data protection principles of the GDPR, and therefore also constitute an infringement of Article 25(1) of the GDPR.
Transmission of the images to third parties
According to the DPA, the transmission of the images made by the surveillance cameras in the context of the environmental law litigation also constituted a breach of article 6.1(f) of the GDPR, as the images were unlawfully made in the first place, thus constituting unlawful processing impacting the further processing.
Taking of photographs in the event of an (alleged) offence
On the other hand, the making of a picture and the further processing thereof, was judged lawful under Article 6(1)(f) of the GDPR, as the processing was necessary for the defendants to safeguard a legitimate interests (i.e. to collect evidence of an infringement and bring this to the attention of the competent authorities), and did not appear to be so intrusive for the fundamental rights of the data subjects to outweigh the legitimate interests of the defendants. The taking of the photograph therefore withstood the assessment test.
The DPA Litigation Chamber therefore imposed a fine of € 1500 for the infringements of Article 6 of the GDPR. In addition, it issued a reprimand to the defendants for not respecting article 25.1 of the GDPR while placing their video surveillance system.
Comment
This fine is a reminder that the GDPR does not only apply to companies, but also to citizens who process personal data outside the strictly domestic context.
The defendants claimed that they had engaged the services of a security firm specialized in placing of surveillance cameras, but the DPA pointed out that the defendants remain however responsible for the processing operations for which they determine the purpose and means. The way in which the company (incorrectly) installs the surveillance cameras is a contractual matter that does not oppose the application of the GDPR and the associated responsibilities of the data controller.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Litigation chamber
Decision on the merits 74/2020 of 24 November
2020
File number: DOS-2019-04412
Subject: Complaint for unlawful filming of the public road and private domain
of third parties with surveillance cameras.
The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke
Hijmans, chairman and Messrs. Dirk Van Der Kelen and Frank De Smet, members;
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data and repealing Directive
95/46 / EC (General Data Protection Regulation), hereinafter GDPR;
In view of the law of 3 December 2017 establishing the Data Protection Authority, hereinafter
WOG;
Having regard to the rules of internal procedure, as approved by the Chamber of
Representatives on December 20, 2018 and published in the Belgian Official Gazette on
January 15, 2019;
Considering the documents in the file;
.
.
. 2
has taken the following decision regarding:
- X1, hereinafter referred to as “the first complainant”, and X2, hereinafter referred to as “the second complainant”,
both natural persons domiciled in […] and hereinafter jointly referred to as “the
complainers ”, and,
- Y1, hereinafter referred to as “the first defendant” and Y2, hereinafter referred to as “the second
defendant ”, both residing in […] and hereinafter jointly referred to as“ the defendants ”.
1. Facts and procedure
1. On August 26, 2019, the complainants file a complaint with the Data Protection Authority.
2. The complaint can be summarized as follows. According to the complainants, three surveillance cameras are filming
of the defendants, the “entire domain” of the complainants. One camera would also “it
full street scene ”. In the context of environmental law proceedings between the
the complainants and the defendants, in particular in the context of an application for regularization by the
complainants, images from the defendants' surveillance cameras were brought to the notice of the
complainants brought in by a third party, expert engineer Z. Those images were, according to
the complainants not only provide evidence for unlawful filming of public and private roads
property of third parties, but also of the unlawful transmission of the recordings of those
images to unauthorized third parties.
The environmental law procedure at the Environment Department that followed from the dispute
regarding the regularization application, is hereinafter referred to as “the Environmental Procedure”.
The expert engineer Z appointed in the context of the Environmental Procedure is hereafter
Called “the Traffic Expert”.
3. The complaint also mentions that a complaint was made to the local police about the same
facts.
4. In accordance with Article 58 of the WOG, the Primary Service of the
Data Protection Authority on September 6, 2019 the complaint admissible. On the basis of
Article 62, §1 of the WOG, the complaint is subsequently transferred to the Disputes Chamber.
5. By registered letter dated September 24, 2019, the complainants and defendants will be notified of the
informed of the decision of the Disputes Chamber to close the file in accordance with 3
treat article 95, §1, 1 ° WOG on the merits. In the registered letter are also
the closing deadlines communicated to the parties in accordance with Articles 98 and 99 WOG.
Conclusion of the defendants' reply
6. The defendants point out that the way in which the surveillance cameras are filming, “was instituted
by the company that installed the cameras. ” According to the defendants, the aim was purely
securing their property, “and not the public domain nor the property of it
to target the applicants. "
7. The defendants insert screenshots of the video images captured by the said
surveillance cameras at their conclusion. The images predate the adjustments of the
state of the surveillance cameras that the police officer had asked to make.
8. The surveillance cameras have different names.
9. First, there is a security camera "front shed", which according to the defendants is only
a limited part of the property of the complainants is filmed, but not the home of the complainants
self.
10. Second, the security camera "front facade" films the front garden, part of the facade and
part of the public road. On the image added by the defendants
more than a third of the security camera image is taken up by the public road
which is before the defendants' house. The defendants cite that the bottom line
more this security camera was changed after the visit of a local police officer, after which the
camera image - at least on the basis of the still image added by the defendants - for
more than half only depict the wall of the facade, only a limited part
of the defendants' front yard and porch, and in no way the public road
pictures. By adjusting the position of this security camera after the visit
of a local police officer, are the images that are captured in the dark by the reflection
of the light from the "night mechanism" of the security camera, de facto useless, said
the defendants.
11. Third, there is the security camera "street side". The defendants argue: “de haag die for
the camera is placed on the street side prevents this camera from filming on the street. ”
Again, the security camera would, after resetting the position of the
security camera, de facto become unusable at night, because more than half of 4
what is portrayed concerns the brick facade, which is the light from it
night mechanism of the surveillance camera is reflected in the lens.
12. The photo attached to their complaint by the complainants with the mention "camera
garages', according to the defendants, is not an image of a security camera, but a photo
taken with a smartphone.
13. The defendants also argue that they are “installing and using the
camera surveillance system indicated [have] electronically via the e-counter for
the declaration of surveillance cameras by the Federal Public Service Internal Affairs
is made available. "
14. The defendants also argue that the designation of the controller,
according to the Camera Act, 1 clearly happened. The camera images, according to the
defendants, would be erased after one month. However, “the images that the
mobility impairments were saved and deleted after they were transferred
to the traffic expert. ” The Traffic Expert used the images in the context of
the analysis of any nuisance related to environmental law (mobility and other)
by the complainants, and this in the context of the Environmental procedure. The Traffic Expert
compiled the images, along with the report of his analysis, in the course of the
Environment procedure available to the parties and the Environment Department.
15. With regard to the images made available by the Traffic Expert
in the context of his environmental report on the mobility situation, the defendants argue
incidentally, that the council of mayor and aldermen of the municipality where the
the complainants and defendants are resident, as well as the Environment Department as competent
government appealed, the images were sent via a "SharePoint" web link.
The defendants state in this regard: “The sharepoint in the
management of the authorized traffic expert […] ”
And further: “The images were erased by the [defendants] after they were presented to the expert
handed over. ”
The defendants also add that the Traffic Expert is now, “in response
of the end of the administrative procedure [the Environmental procedure], the Sharepoint
offline [has]. ”
1
Law of 21 March 2007 regulating the installation and use of surveillance cameras, Belgian Official Journal 31 May 2007, hereinafter "Law
Camera surveillance'. 5
16. As already mentioned, the defendants argue that the image attached to the complaint and
according to the complainants, a camera image of the position is "garages", it was a photo
was taken with a smartphone. The photo was taken by the defendants in their own words
made to record a breach of environmental law: “a […] is considered
as a […] that cannot just be dragged across the street and the sewage well, which the
photo shows that this is happening. ”
17. Finally, the defendants raise that, in the context of another environmental law
dispute, the complainants themselves are unauthorized and possibly illegal (camera) images and / or photos
turned the property of the defendants.
Reply of the complainants' reply
18. In this Opinion, the complainants state that - by the defendants in the present
procedure - another image was sent, this time to the Federal Agency
for the Safety of the Food Chain and the “Cell Environmental Enforcement”. There is not
specified what is meant by the latter.
19. The complainants point out that there is indeed a camera "garages" and add
conclusion photos of the defendants' home showing a camera above one
garage door can be seen, which apparently does not replace the other three
cameras.
20. In addition, the complainants argue that the surveillance camera "street side" is indeed part of
filmed the property of the complainants. Also with regard to the surveillance cameras 'front facade'
and "front shed", according to the complainants, there is a breach of the law, just because the
images were used in the Traffic Expert's investigation - following the
Environmental procedure - which related to the mobility situation on public roads and
access to the complainants' property by themselves or any visitors.
21. In addition, the complainants point out that the retention periods have not been respected
certain images used in the Environmental Procedure date from 11 November 2018, and only
months later would have been passed on to the Traffic Expert. The complainers point out
in addition, note that the Traffic Expert is not part of the police forces or
judicial authorities. 6
22. Finally, the complainants will discuss the Environmental Procedure, but the factual explanation is
of no importance for the further handling of the complaint for the
Data protection authority, and will not be included in this decision.
Statement of reply of the defendants
23. The defendants' reply confirms, on the one hand, the content of the first
conclusion of reply, but on the other hand introduces some new elements.
24. First of all, the defendants argue that there were indeed five surveillance cameras
registered via the e-counter of the FPS Home Affairs. According to the defendants
the two other surveillance cameras not mentioned in the original complaint, and therefore not
addressed in the reply conclusion. This specifically concerns a security camera
"Back of shed" and a security camera "garage".
25. The surveillance camera "garage" again films part of the front facade of the house, just
such as security camera "facade". The defendants add a picture to their conclusion that
according to them predates the adjustment of the positions of the surveillance cameras after
a visit by the local police officer, involving a limited part (less than a third) of the image
of the security camera filming the public road.
26. The defendants do not get any picture of the surveillance camera "rear of the shed"
transferred, because according to them the position of this surveillance camera is not a problem,
neither for the property of the complainants, nor for the public road.
27. According to the defendants, only images of the
security camera "front facade" and security camera "front shed" transferred. This one
After all, according to the defendants, images were relevant to certain mobility situations,
relevant to the Environmental Procedure.
28. The defendants emphasize that the company that installed the surveillance cameras
security cameras so tried to establish the property of the defendants
"Maximum security."
29. The defendants also emphasize that the images from, among other things, the surveillance cameras that
were handed over to the Traffic Expert, were indeed important to him
report, and that this report was indeed used in the deliberations of the
competent authority in the decision of the Environmental Procedure. 7
Hearing
30. On November 12, 2019, the defendants, through their counsel, had requested
to be heard.
31. By Ministerial Decree of June 30, 2020 containing urgent measures to prevent the dissemination
of the coronavirus COVID - 19 (Belgian Official Journal 06/30/2020), as amended by Ministerial
Decree of August 22, 2020 (Belgian Official Journal 08/22/2020) was decided by the federal government to
a number of coercive measures that made it difficult to hold a hearing in the
normal setup.
The Disputes Chamber therefore offered the parties the opportunity to attend the hearing, where the
defendant in its claim asked to take place electronically.
Both parties agreed and confirmed their presence.
32. A hearing will take place on September 7, 2020, with the complainants and defendants present
as well as counsel for the defendants.
33. The details and additions were made in the minutes of the hearing
adopted that are not a mere repetition of elements that recur in the
previous documents, and in particular the claims of the parties, of the file.
34. For example, the defendants have pointed out that they make the Traffic Expert an actor
deem that falls under "judicial authorities" as referred to in the Camera Act.
35. The defendants further argue that the offer to change the positioning of the
the disputed security cameras had clearly been requested before the defendants were informed
about the existence of a complaint to the GBA.
36. As usual, the Disputes Chamber invited both parties to submit comments
to have the report of the hearing added as an attachment to that report,
without this implying a reopening of the debates. Both sides have responded to
that invitation, and the responses and accompanying documents were attached to the trial
verbally added to the file. 8
2. Justification
2.1 The scope of the proceedings on the merits before the Disputes Chamber
a. The submission of new defenses and documents by the parties
after the close of the debates
37. The Disputes Chamber finds that both parties have extensive additions and documents to it
in response to the invitation of the Disputes Chamber for any
to make comments on the official report.
38. The Disputes Chamber underlines that the aforementioned invitation was clearly worded,
in the sense that the comments should not constitute a reopening of the debates. The
invitation merely offers the parties the opportunity to provide factual comments on
what is formulated in the official report.
39. Article 98, 3 ° of the WOG ensures the possibility for the parties to “retrieve all documents that they are useful
consider to be added to the file. " A thorough course of the procedure in the light of a
due process by the Data Protection Authority within the meaning of Article 58 (4)
GDPR, requires that at some point, notably after the end of the hearing, the
debates are closed without yet another round of exchange of
to allow defenses.
40. Admitting new documents, without defendant means on the part of the other party, would
violate the opposing party's right to object.
41. For the above reasons, the Disputes Chamber rejects the documents that both parties as
"Comments" on the minutes of the hearing have been forwarded to the
Disputes Chamber, from the debates.
b. Elements in defenses and documents outside the scope of the
procedure
42. The Disputes Chamber finds that the defendants describe facts in their response statement
on account of the complainants who allegedly infringe the same provisions that it
be the subject of this complaint. 9
43. Without declaring the merits of those allegations made by the defendants, will
the Disputes Chamber will only assess the facts as they are in the complaint
suggested. After all, the Disputes Chamber is only involved in this matter for the handling of
that complaint, in accordance with Article 92, 1 ° WOG.
44. In addition, the Disputes Chamber points out that pending proceedings before the Disputes Chamber
does not justify that parties to the dispute themselves - in the context of affixing
documents or evidence - carrying out unlawful processing of personal data, or on
otherwise the protection of the privacy of the other party in particular
misunderstand. The Disputes Chamber reiterates, however, that in this regard it is only concerned with the
handling of a complaint in accordance with Article 92, 1 ° WOG.
45. Naturally, any citizen, including the defendants, is free to lodge a complaint with the
Data protection authority regarding facts regarding (possible) infringements of the
regulations on personal data protection.
2.2 Jurisdiction of the Disputes Chamber (Article 100 WOG)
46. Although the actual events leading up to the Environmental Proceedings, en
consequently to the procedure before the Data Protection Authority (hereinafter: GBA), in detail
are set out by the complainants and defendants, they have no immediate
relevance to the analysis by the Dispute Chamber.
47. The Disputes Chamber considers it important to have some fundamental aspects with regard to
to explain camera surveillance in underlying decision.
48. Article 4, §1, first paragraph of the WOG states:
“The Data Protection Authority is responsible for overseeing the
compliance with the basic principles of the protection of personal data, in
under this Act and the laws containing provisions on the
protection of personal data. "
Article 4, §2, second paragraph of the WOG also states:
“The Data Protection Authority is the competent supervisory authority
when no other law provides otherwise. " 10
49. The legal assessment of this file will therefore be based in the first place
of the provisions of the GDPR. The question arises here to what extent the processing of
personal data took place lawfully, in accordance with Articles 5 and 6 of
the GDPR.
50. In addition, the CCTV Act - as a national law that contains provisions regarding the
protection of personal data - relevant for some interpretative aspects for
the handling of this complaint and, by extension, the present file.
51. However, the Disputes Chamber emphasizes that the application of the GDPR as a regulation of the
European Union takes precedence over the aforementioned national legislation because of its direct effect
and its excellence within the European legal order. 2
52. This also applies in particular to circumstances in which an interpretation is given to
3
the data protection law concept of "legitimate interest". This is the case here,
given that it concerns processing operations set up as a result of the private interests of citizens (see
infra, part 2.4. with regard to the lawfulness of the processing).
53. The Court of Justice has previously confirmed that capturing images of people with
surveillance cameras fall under the concept of "personal data" in the sense of the
4
European law standards on data protection. The surveillance using
video recordings of persons that are captured (saved) is an automated one
processing of personal data within the meaning of Article 2 (1) GDPR. The processing of
personal data in that context should therefore also enjoy direct protection under
the GDPR.
2 See, inter alia, CJEU judgment of 5 February 1963, NV Algemene Transport- en Expeditie Onderneming van Gend & Loos v.
Dutch Administration of Taxes, C-26-62, ECLI: EU: C: 1963: 1; CJEU judgment of 15 July 1964, Flaminio Costa v.
E.N.E.L., C-6-64, ECLI: EU: C: 1964: 66; on the legal protection of citizens based on EU law and the principles
of "direct effect" and "prima facieity", see C. BARNARD, The Substantive Law of the EU: The Four Freedoms, ed.), rd (5
2016, 17.
3
Compare CJEU judgment of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Credito and Federación
the Comercio Electrónico y Marketing Directo t. Administración des Estado, C-468-9 / 10, ECLI: EU: C: 2011: 777 (hereinafter: Judgment
Asociación Nacional), par 39: “It follows that, with regard to the processing of personal data, Article 7 (f) of
Directive 95/46 precludes any national legislation which, in the absence of the consent of the data subject, in addition
the two cumulative conditions referred to in the preceding paragraph imposes additional requirements. ”; ibid., par. 52: “established
Article 7 (f) […] must be sufficiently precise to be invoked by an individual and by the
national courts [and imposes] an unconditional obligation. ”
4 CJEU judgment of 11 December 2014, František Ryneš v. Úřad pro ochranu osobních údajů, C-212/13, ECLI: EU: C: 2014: 2428
(hereinafter: Ryneš judgment), par. 22.
5 Compare the analysis in Ryneš of the superseded legal norm mutatis mutandis, par. 25. 11
54. The surveillance cameras that are the objects of this complaint are by the defendants
placed on private domain (i.e. the property of the defendants). For the purposes of the
AVG can be pointed out that placing security cameras on private domain, and the
use of those surveillance cameras with which people are recorded on images, not per
definition mean that this is a “purely personal or household activity” in the
sentence of Article 2 (2) point c) GDPR.
55. When the video surveillance system, for example, the public space or private domain of
covers others, even in part, and thereby moves out of the private sphere of those
processing data through the system, this cannot be considered an activity
performed exclusively for personal or household purposes. because of this
After all, it will be possible to make and record images of natural persons
identify. This is the case here.
56. Finally, it can be established that there is no risk that the Disputes Chamber will proceed to a
parallel assessment - alongside any other authority - of the facts surrounding the use
video surveillance, and thus violate the ne bis in idem principle of law, given the
other procedures mentioned in the file concern related,
yet legally distinct facts that do not relate to the
protection of personal data. The Disputes Chamber can therefore proceed in full to the
record its powers and assess the facts.
2.3. The controller (s)
57. In accordance with Article 4 (7) GDPR, the controller is:
“A natural or legal person, a public authority, a serving or a
other body that, alone or together with others, has the purpose of and means
for the processing of personal data; when the objective of and
the means of such processing become Union or Member State law
6 A private domain is a "closed place not accessible to the public" within the meaning of Article 2, 3 ° Camera Act. The article
sounds like this:
“Enclosed space not accessible to the public: any building or any place delimited by an enclosure intended for
the use by the public where services can be provided to the public ”.
7
Compare with Ryneš judgment, par. 32.
8 Compare with Asociación Nacional, para. 35. 12
may determine who the controller is or
according to which criteria it is designated ”
58. It is fundamental that the core concepts of privacy and
data protection can be interpreted uniformly, to ensure legal certainty for citizens
to provide. The concept of "controller" within the meaning of the Camera Act,
and the GDPR respectively, should therefore be interpreted in the same way.
59. There are a number of elements in the file which indicate that both defendants themselves as
joint controller within the meaning of Article 26 GDPR.
2.3.1. Placing surveillance cameras and registering and storing camera images from
surveillance cameras that may or may not contain personal data
60. In this respect it can be established that the defendants have both taken actions in
the context of placing the surveillance cameras and determining the position of them
cameras. The defendants both reside in the home where the security cameras
were placed, they both gave instructions to the firm that issued the
has installed security cameras and they have both jointly defended
all the elements in the file, without distinguishing between them
persons.
61. It must be said that within the meaning of Article 7 CCTV Act the first defendant in his
name has done the registration at the e-counter of the FPS Home Affairs, but on
other places in this application, the name of the second defendant is stated. She is
in particular to request the contact person to access the images. Also the e-mail address for
mentions the contact with the controller in the application at the e-counter
the first respondent's first name.
62. The Court of Justice has confirmed that for the identification of the
controller (s) there must be a factual assessment of which natural
person or legal entity, resp. natural or legal persons, “the purpose” and “the
means ”of the processing, whereby for the protection of data subjects a wide
definition is given to the term. 9 The Court has also held that a
natural person who, for reasons of his own, influences the processing of
9
CJEU judgment of 13 May 2014, Google Spain and Google, C-131/12, ECLI: EU: C: 2014: 317, par. 34; CJEU judgment of 5 June
2018, Wirtschaftsakademie Schleswig-Holstein, C-210/16, ECLI: EU: C: 2018: 388, par. 28. 13
personal data and thereby participate in determining the purpose of and the
means of this processing can be considered to be a controller.
10
63. It is therefore not because under national law a person (the first defendant)
has made a formal request as a controller that that person (the
is the sole) controller within the meaning of European law. This also has
the second defendant thus behave as controller in the
European law sense.
64. In the context of installing surveillance cameras and registering and storing them
of the images recorded by those cameras, including the second respondent
had a decisive influence, 11 thus appears to be joint processing responsibility
of the defendants.
2.3.2. Handing over camera images and photos to the Traffic Expert
65. It appears from the defendants' defense that the camera images were recorded by both
defendants were referred to the Traffic Expert in the context of the
12
Environmental procedure. With regard to such transfer as processing, the
defendants identified as joint controllers in accordance with
Article 26 GDPR, given the choice of transferring these images ("the purpose"), as well as the
way ("the means"), was made by both defendants.
2.3.3. The use of camera images by the Traffic Expert in an expert report, and
making camera images of the disputed security cameras available via a
SharePoint link by that Traffic Expert
66. In the context of the Environmental Procedure, a Traffic Expert was approached by
both defendants, in order to prepare an expert report, in particular on the
mobility situation in the immediate vicinity of the complainants' private domains, and consequently
10 Judgment of the CJEU of 10 July 2018, Weersan todistajat, C-25/17, ECLI: EU: C: 2018: 551, par. 65.
11 Regarding the role of the "decisive influence", cf. CJEU judgment of 29 July 2019, Fashion ID t. Verbraucherzentrale NRW, C-
40/17, ECLI: EU: C: 2019: 629, par. 70.
12
Conclusion of the reply of the defendants dated. November 27, 2019 (Document 10), mid p. 5: “The conclusions [defendants] have to
the dangerous traffic situation recognized by both the city […] and the department of surroundings images preserved and
handed over to the [Traffic expert] to address these nuisance aspects that violate spatial planning,
public order. ” 14
near the home of the defendants, given the parties on both sides of
the same road borders with their property.
67. From the circumstances described in the decision of the Environment Department in the
Environmental procedure, as well as from the expert report itself, shows a certain
independence from the Traffic Expert.
68. In that sense, it has also not been proven that the defendants transmitted any instructions to
the Traffic Expert with regard to the further distribution of the images with
personal data that the defendants transferred to the Traffic Expert. Even more,
according to the defendants, the Traffic Expert was only charged with the
map the mobility situation using the images. The defendants would claim the
Traffic experts also requested that the images be removed via the Sharepoint link.
69. In any case, the defendants cannot be regarded as (joint)
controllers for the further distribution of the camera images via a
Sharepoint link by the Traffic Expert, not just because concrete instructions
are lacking in this respect, but also because the defendants did not "determine the means"
with which the Traffic Expert had drawn up his expert report, the choice to use the
used images with personal data (the vehicles and images of various
persons are presented), including the full report. This one
resources were determined by the Traffic Expert.
70. The complainants' complaint is addressed to the defendants in this file. To the course of a
to safeguard a thorough procedure as well as the correct contradiction, the Disputes Chamber decides
not to involve the Traffic Expert in this file.
71. The Disputes Chamber underlines that the fact that a third party - not involved in this
procedure - the controller is or would be for subsequent processing of a
transfer that is initially the responsibility of (one of) the defendants, not
means that the initial transfer was therefore lawful. This aspect, applied to the
disputed facts, the Disputes Chamber will deal with below. 15
2.4. The lawfulness of the processing (Article 6 GDPR)
2.4.1. Registering, storing and otherwise using images that are
contain personal data and originate from the disputed security cameras
72. Based on the images available in the file, as well as the indications given by the complainants
and the defendants of the location of the surveillance cameras on maps and aerial photographs, can
determined that all surveillance cameras were attached to either the control panel
main building of the defendants' property (hereinafter: the dwelling) or the secondary
building on the property of the defendants (hereinafter: the barn).
73. In addition, it can be established from the same images and indications that the
house and barn do not directly adjoin the public road or private areas of
third parties, but enclosed by pieces of land belonging to the defendants themselves.
74. In the present file, the defendants have five as private persons in their private domain
surveillance cameras installed. Under section 2.2. and 2.3. of the present decision,
the Disputes Chamber already stressed that a video surveillance system under the provisions
of the GDPR, when the equipment used makes it possible to collect personal data
register and save. In this sense, the processing of personal data must be at all
in accordance with the principles set out in Article 5 GDPR regarding
personal data processing and meet one of the conditions for a
lawful processing under Article 6 GDPR.
75. The complainants have not in any way consented to the processing of their
personal data within the meaning of Article 6 (1) point a) GDPR; this is also not claimed by
the defendants. No other condition for the lawfulness of the processing
in Article 6 (1) GDPR is possible in this context, unless point f) of that provision.
76. In particular, it should be emphasized that Article 6 (1) (e) GDPR in the present case is not
application. After all, none of the defendants had any obligation whatsoever
to exercise a task in the public interest, let alone give the defendants a task in the
within the framework of the exercise of official authority. In other words: the
defendants did not have any task in the public interest that made it necessary
13 For an analysis of the possible processing bases in the context of video surveillance systems, see EDBP
Guidelines 3/2019 (version 2.0) as adopted on January 29, 2020, Guidelines 3/2019 on the processing of
personal data through video equipment available at: https://edpb.europa.eu/our-work-tools/our-
documents / guidelines / guidelines-32019-processing-personal-data-through-video_en (hereinafter: Guidelines EDPB 3/2019),
10 et seq. 16
to place surveillance cameras, and the images with personal data that the
register surveillance cameras.
77. For the sake of completeness, it can also be pointed out that Article 6 (1) (c) GDPR is mutatis mutandis
mutandis does not apply, as there is no legal obligation on the defendants
to i.a. to install the surveillance cameras and to process personal data in this way.
78. The Court of Justice has confirmed that, in the absence of any
consent or any other legal basis, the
legitimate basis "legitimate interest" on the basis of Article 6 (1) point f) GDPR. 4
Specifically, the Court of Justice states with regard to that ground of lawfulness under the
previous European Directive on personal data protection:
“In this context, there are three cumulative in Article 7 (f) of Directive 95/46
conditions that must be met in order for the processing of
personal data is lawful, namely, in the first place, the promotion of
a legitimate interest of the controller or of the
third parties to whom the data are disclosed, in the second place, the
necessity of the processing of personal data for the purpose of processing
of the legitimate interest and, thirdly, the fact that the fundamental
rights and freedoms of the person involved in data protection
prevail (judgment of 4 May 2017, Rigas satiksme, C-13/16, EU: C: 2017: 336, paragraph
28). ”15
79. In other words, data controllers must demonstrate that:
1) the interests that they pursue with the processing can be justified
recognized (the “target test”);
2) the intended processing is necessary for the realization of those interests (the
“Necessity test”); and
3) the balancing of those interests against the interests, fundamental freedoms and
fundamental rights of data subjects weighs in favor of the
controllers or of a third party (the “balancing test”).
14 Compare the analysis of the former Directive mutatis mutandis with the GDPR in Asociación Nacional, para. 40 and 42.
15
Ibid., Par. 40. 17
1. The target test
80. The Disputes Chamber can determine that the defendants are in concrete terms justified
had an interest in placing the surveillance cameras on their private domain in order to prevent the
protection of the property, health and life of the defendants and their
family members or other third parties.
81. The European Data Protection Board (hereinafter: the EDPB) has indicated earlier
that burglary, vandalism or theft are examples of situations requiring video surveillance
16
justify. The legitimate interest of the defendants must be
are real and relate to a current problem. 17 The damage to the
property of the defendants in the period before the installation of the surveillance cameras,
show in themselves that this is a current and existing - and therefore not a purely hypothetical -
interest.
2. The necessity test
82. In the context of camera surveillance systems, the Court of Justice has underlined that these
condition must be examined in conjunction with the principle of “minimal
data processing ”, which is currently stipulated in Article 5 (1) point c) GDPR. 18
Personal data must be adequate, relevant and limited to what is necessary
is for the purposes for which they are processed.
83. The Disputes Chamber now proceeds to the analysis per disputed security camera in order to establish
whether or not the processing of the personal data by means of those cameras is considered
can be considered necessary.
a) Camera facade
84. First, on a still image in the camera's complaint, there is "facade" a piece of land
can be seen next to the garden at the front of the defendants that constitutes the "front garden". On a
camera image that the complainants transferred to the Dispute Chamber, it can be seen that the
security camera was aimed so that about a third of the image is on the public road
16 Guidelines EDPB 3/2019, par. 19.
17
Guidelines EDPB 3/2019, par. 20.
18 Judgment Asociación Nacional, para. 48. 18
(as an unenclosed place). This can also be seen in the still images in the complaint and the
statement of reply of the defendants. This at the time before the positioning of the
surveillance cameras were changed by the defendants.
85. The Disputes Chamber finds that the extensive and constant filming of the public road is not
can be seen as “relevant”, let alone “necessary” for the defendants to
safeguard their legitimate interests mentioned above.
86. Such an arrangement of a surveillance camera can hardly correspond to the
principle of minimal data processing. The defendants argue that the
turning the surveillance camera results in a reflection of the image, “so
a large part of the camera surveillance misses its target, especially at night […] From the images that
before, it appears that the company [X] 9 has set the cameras to be owned by
conclusions was maximally secured. ” 20
87. That the surveillance cameras are set up in a way that is not as necessary and in
compliance with the principle of data minimization
remains the responsibility of the defendants as
controllers. A technically unpleasant consequence is therefore not possible here
Form "escape route" to obtain lawful processing. Such a route is also
not provided by any legislator.
88. How the company [X] installs the surveillance cameras and, if necessary, incorrectly
is a contractual matter that does not preclude the application of the
GDPR and the associated consequences and responsibilities of the
controllers.
89. That the surveillance cameras were adjusted after the visit of the police officer, does not matter
prejudice the initial infringement. Incidentally, the Disputes Chamber does not rule on the
accuracy of the statements of the police officer; it only checks the provisions of the law
(in this case the GDPR) to the actions of the controller.
90. In any case, with the wrong placement of the camera, the first defendant has "facade"
undisputedly the personal data of, in particular, the first complainant processed by them
register and store, as well as pass on this personal data to the
Traffic expert.
19D.i. the company that installed all surveillance cameras for the defendants.
20
Statement of reply of the defendants, document 10. 19
91. For the sake of completeness, it can also be noted that Article 8/2 of the CCTV Act is the King
allows to establish places where surveillance cameras may be aimed at the
perimeter directly around a given place.
92. The Royal Decree of 6 December 2018 determining the places where the
controller can direct his surveillance cameras at the perimeter
directly around the place, the images from the surveillance cameras for three months
can save and give real-time access to the images to the police forces (B.S.
December 18, 2018, hereinafter Royal Decree Extended Perimeter) determines in Article 2 in which
Fallen security cameras can be aimed at the perimeter around the site.
93. The Royal Decree Extended Perimeter does not offer the defendants the opportunity to submit their
surveillance cameras on the perimeter (i.e. not the private domain of the defendants) around the
instead of aiming the cameras. The places specified in the Royal Decree are
often places that pose a risk and where the filming of the extended perimeter de
public safety or public interest (and a contrario, not purely private interests).
94. In this sense, it can be such extensive and constant filming of the public road, as shown
the images in the file presented by the defendants themselves are not regarded as
necessary for the processing of personal data when using the
surveillance cameras.
b) Shed front camera
95. According to the defendants, the camera "front shed" films a "limited part of the
owned by [the complainers], more precisely the driveway and part of the large automatic
gate. ” This at the time before the positioning of the surveillance cameras became
amended by the defendants.
96. The national legislature (in Article 7 of the Camera Act) has installed these for the surveillance cameras
in "closed places not accessible to the public" a provision is provided for that
filming a "non-enclosed place" or a "publicly accessible enclosed place"
subject to stringent conditions in accordance with the principle of minimal
data processing. In this sense it can be assumed in an a fortiori line of reasoning
property of private persons or private companies should in any case not be filmed
turn into. 20
97. Here too, Article 8/2 Camera Act cannot be applied, for the same reasons as above
set forth under the analysis of necessity for camera "facade".
98. The Disputes Chamber does not rule out this in certain - very exceptional - cases
property of third parties could be lawfully filmed within the meaning of Article 6,
paragraph 1 GDPR. More specifically, situations in which the third party owns the
private domain gives her or his permission to install a security camera that
films her or his property, when the person who installs the security camera at no
can protect its property in some effective way without entering another private domain
image.
99. In this case, there is no such consent; the complaint proves the contrary. Moreover
none of the documents in the file appears to have any other necessary reason,
for filming parts of the complainants' property.
100. Indeed, the 'front shed' camera films only a very limited part of the property
of the complainants, it appears from the images submitted by the defendants, which predate
the adjustment of the position of the surveillance cameras. That is why it can be questioned
be why it would be somewhat necessary to have this limited portion of the property
of the complainants was portrayed.
101. In this sense it can be - albeit limited but constant - filming of the private domains of the
complainants, as is apparent from the images in the file presented by the defendants themselves, where
personal data are processed, are not seen as necessary for the processing
of personal data when using the surveillance cameras
c) Other surveillance cameras
102. The complainants did not produce any documents with regard to the other surveillance cameras
submitted in the complaint. However, in the reply of the defendants
images taken from before the repositioning of the surveillance cameras, from which not
can be determined that these surveillance cameras are slightly different places than it
private domain of the defendants themselves. It's about the
surveillance cameras "street side", "garage" and "rear shed". 21
3. The balancing test
103. Although not passing the "necessity test" is already sufficient to establish
state that the processing of personal data by means of the surveillance cameras 'facade'
and "front shed" took place unlawfully, the Disputes Chamber is investigating unnecessarily
or the existence of fundamental rights and freedoms in data protection
the persons concerned (the complainants) may or may not prevail over the legitimate interests
of the defendants.
104. That balance depends on the particular circumstances of a particular case and the
rights of the complainants concerned under Articles 7 and 8 of the Charter of the European
Union with regard to the protection of privacy and
21
data protection.
105. In that sense, the seriousness of the infringement of rights and
freedoms of the complainants as an essential part of the analysis. 22 In doing so can be
noted that the continuous mapping of the public road, this is 24 hours a day
hours and 7 days out of 7 days, constitutes a serious violation of these fundamental rights. This applies
at least equally for the private domains of the complainants and is all the more the case when a
other, less intrusive processing appears to be possible, given the adjustment of the position of
the surveillance cameras.
106. In addition, there are also many others involved, such as the children of the complainants, or
drivers of vehicles passing on the public road in front of the house
defendants, whose rights are also being violated in this regard.
107. It can also be pointed out that it is beyond the objective expectations of those involved
it falls that the two aforementioned surveillance cameras are positioned in such a way,
constantly filming part of the public road and the private domain of the complainants. 23
This is the case, among other things, because the surveillance cameras are not in accordance with the
provisions regarding the installation of surveillance cameras under national law (de
Camera Act) were placed.
108. For all these reasons, the security cameras "front facade" and "front shed" also withstand
the balancing test is not.
21 Judgment Asociación Nacional, par. 52; Guidelines EDPB 3/2019, par. 32-35.
22 Ibid., Par. 56.
23 With regard to these "objective expectations", see EDPB Guidelines 3/2019, par. 36. 22
4. Conclusion
109. The security cameras "front facade" and "front shed" have images with
unlawfully processes personal data, which constitutes an infringement of Article 6,
paragraph 1 GDPR, now that there are legitimate interests for the defendants within the meaning of
point f) of that standard, but the concrete processing operations are not necessary for the
safeguarding those interests, and the fundamental rights and freedoms of the complainants
and other stakeholders outweigh those interests.
2.4.2. The transfer of the camera images with personal data to the
Traffic expert
110. As in section 2.3. already determined by the Disputes Chamber, are for this transfer
the defendants are responsible as joint controller in their view
both act as parties to the Environmental Proceedings, and they say together the
Have addressed a traffic expert and transferred the images in this context
(supra).
111. At the hearing, defense counsel argues that, in the context of
the Environmental Procedure, camera images were allowed to be transferred to the Traffic Expert
, given that Traffic Expert can be seen as part of the
"Judicial authorities" within the meaning of Article 9, paragraph 1, fourth paragraph, 1 ° Camera Act.
112. Article 9 CCTV Act does not apply in this situation.
113. Contrary to what the defendants argue, the Traffic Expert is not involved
out of the "judicial authorities," as he was appointed by order of the
defendants themselves, and this moreover in the context of an administrative appeal procedure.
114. The question remains - partly in view of the inapplicability of Article 9 of the CCTV Act - whether in
the defendants nevertheless have a legitimate interest in the images
to pass on to the Traffic Expert with the aim of visualizing the
mobility situation in the immediate vicinity of the property of the complainants under
the Environmental Procedure.
115. Now the Disputes Chamber in section 2.4.1. has come to the conclusion that the images
made with the surveillance cameras "front facade" and "front shed" illegal
processing of personal data, it appears in itself that these images are not 23
could be submitted to the Traffic Expert. After all, this transfer is then also
unlawful within the meaning of Article 6 (1) GDPR.
116. The assignment that the Traffic Expert received from the defendants showed the
transfer moreover just around the images - and the associated processing of
personal data - that were made from public roads, albeit the
private domains of the complainants.
117. The transmission of the images made with the surveillance cameras to the Traffic Expert
by the defendants does not constitute lawful processing within the meaning of Art.6 para. 1 GDPR,
and therefore constitutes an infringement of that legal provision.
2.4.3. Taking pictures of the public road in case of an (alleged) crime
is committed, or when a mistake is made in any other way that causes nuisance
flows
118. In the complaint, an image is added that from the private domain of the defendants
portrays the public road and the private domain of the complainants, the former
the complainant is visible while apparently carrying a […].
119. The complainants believe that this is a screenshot of an image taken with one
of the defendants' surveillance cameras, but the latter deny this. They argue
that this image was taken with a smartphone from the home on the private domain of the
defendants by one of them. The technical framing by the defendants appears in this regard
to be correct.
120. Then the question remains whether the making of such an image constitutes a lawful processing
within the meaning of Article 6 (1) GDPR.
121. The defendants believe that the photo could be taken as they believe it
transporting a […] possibly constitutes an (environmental) crime. The defendants are of the opinion
it is necessary to collect evidence of an infringement (suspected or otherwise)
to report this to the competent services, authorities or judicial authorities or
complain. The defendants appear to have done this in the present case by notifying the
Federal Agency for the Safety of the Food Chain (FASFC), which is also a
investigation started. 24
122. In the context of safeguarding public and private security, the
defendants therefore have a legitimate interest within the meaning of Art.6 para. 1 lit.f GDPR
to take the picture. After all, they assumed in good faith that the transport of
a […] does indeed constitute an (environmental) crime, which is why their notification to the FASFC
illustrates.
123. Although the Dispute Chamber refers to public safety in this regard, it should
be emphasized that this in no way means that Article 6 (1) (e) GDPR in the present case
would find application. After all, none of the defendants had any obligation whatsoever
to exercise a task in the public interest, let alone give the defendants a task in the
within the framework of the exercise of official authority. In other words: the
defendants were under no obligation to provide evidence of the (alleged) environmental crime
by taking a picture and processing it accordingly
personal data; this would be different in the case of judicial authorities or others
competent authorities provide evidence, through images that
contain, collect and further process personal data.
124. The damage resulting from such a crime (i.e. environmental pollution) would not only affect the
society, but also directly affect the private interests of the defendants, in their view
reside next to the complainants, including the first complainant transports it […]. In that sense
was taking the photo as processing of personal data (of the first complainant)
also necessary for safeguarding those legitimate interests of the
complainant because it may serve as evidence of the alleged crime.
125. Finally, it can also be mentioned that taking that photo does not seem so intrusive
for the interests or fundamental rights and freedoms of the first complainant,
that these outweigh the legitimate interests of the defendants holding the
photo, as the defendants had a good faith belief that there was a crime
was committed. Moreover, the position of the camera that took the image was such
aimed at visualizing only the (alleged) crime on the public road. It
taking the photo as processing of personal data therefore also passes the
balancing test.
126. For all the foregoing reasons, taking a one-time photo was with a
smartphone, as shown in the complaint and where the first complainant is visible,
as a direct response to seeing an alleged crime (as opposed to the constant
filming by surveillance cameras of part of the public road or private domain), a
lawful processing within the meaning of Article 6 (1) point f GDPR, and none of the 25
defendants commit an infringement of this article in relation to this fact.
2.5. Data protection by design (Article 25 GDPR)
127. In the GDPR, the European legislator has provided an article 25, containing the concepts
"Data protection by design" and "data protection by default" ("DPbDD"), in Dutch
respectively "data protection by design" and "data protection by
standard settings'. The Disputes Chamber hereafter uses the abbreviation DPbDD when the
deals with both concepts at the same time.
128. Article 25 GDPR reads:
“1. Taking into account the state of the art, the implementation costs, and the
nature, scope, context and purpose of the processing as well as the qua
likelihood and severity varying risks to the rights and freedoms of
natural persons associated with the processing, the
controller, both in determining the processing means and
in the processing itself, appropriate technical and organizational measures, such as
pseudonymisation, which are created with the aim of the
data protection principles, such as data minimization, on one
effective manner and put in place the necessary safeguards in the processing
construction to comply with the requirements of this Regulation and for protection
of the rights of the data subjects.
2. The controller takes appropriate technical and organizational
measures to ensure that, in principle, only personal data are made
that are necessary for each specific purpose of the processing. That
obligation applies to the amount of personal data collected, the extent to which
they are processed, the period for which they are stored and the
accessibility thereof. In particular, these measures ensure that
personal data in principle not without human intervention for one
unlimited number of natural persons are made accessible.
3. A certification mechanism approved in accordance with Article 42 may
used as an element to demonstrate compliance with the requirements of paragraphs 1 26
and 2 of this article have been met. ” 24
129. The EDPB has guidelines on DPbDD in accordance with Article 70 (1) (e) GDPR
25
issued.
130. Data protection by default refers, according to the guidelines, to the
terminology used in computer science, and refers to a pre-existing one
or pre-selected value of an adjustable setting within a software
26
application.
131. To the situation in this file with regard to the placement and positioning of the
surveillance cameras, data protection by design should be considered.
132. The purpose of data protection by design, according to the EDPB, is to protect
of the rights of data subjects and ensure the protection of their
27
personal data ("built-in") is specific to the processing. It is important here that the
"Appropriate measures" that a controller must take are intended
that data protection principles are effectively built in so that
the risks of violations of the rights and freedoms of data subjects are limited. 28
133. It is important to note that for the purposes of the
data protection by design does not require actual processing to take place.
However, it is the specific nature of installing surveillance cameras and filming with
those surveillance cameras, which requires taking appropriate technical and organizational
measures with the aim, inter alia, of data protection principles effectively
to apply, as well as to ensure the protection of potential data subjects, would be one
processing of personal data.
24 See also recital 78 GDPR in this regard.
25EDBP Guidelines 4/2019 of 13 November 2019, Guidelines on Article 25 Data Protection by Design and by Default,
available via:
https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_201904_dataprotection_by_design_and_by_default.pdf
(hereinafter: EDPB Guidelines 4/2019).
2EDPB Guidelines 4/2019, par. 39. See also ibid., Par. 40: “Hence, 'data protection by default' refers to he choices made by
a controller regarding any pre-existing configuration value or processing option that is assigned in a software application,
computer program or device that the effect of adjusting, in particular but not limited to, the amount of personal data collected,
the extent of their processing, the period of their storage and their accessibility. ”
27EDPB Guidelines 4/2019, par. 7.
28EDPB Guidelines 4/2019, par. 14 et seq. 27
134. In this sense, there will also be at least one controller for, among other things, the
placing the surveillance cameras, and providing data protection by design
cfr. Article 25 (1) GDPR by that controller, regardless of whether the posting of
which results in surveillance cameras in the processing of personal data. To be these
both defendants are joint controllers within the meaning of Article 26 GDPR,
as determined in section 2.3.
135. The legal provision on data protection by design, Article 25 GDPR, states
expressly the importance of taking effective measures to give effect to
the principle of minimal data processing. The controller must
after all, checking whether there is a need to process personal data. 29
136. When filming the public road and private domains, there is almost absolute certainty
that personal data, and probably a large number of personal data, will become
processed. This is also evident from the fact that the defendants in the Environmental Procedure the
have used camera images from, among other things, the camera 'front facade' to vehicles and
visualize their behavior. The same risk applies to private domain filming
(like that of the complainants), which happens with the camera 'front shed'.
137. In section 2.4. of the present decision, the Disputes Chamber concluded that
unlawful processing took place because of the position of certain
surveillance cameras. By their nature, these unlawful processing operations are sufficient in themselves
indicates that insufficient measures have been taken by the defendants to take the necessary
take measures to comply with the data protection principles of the GDPR, and
thus constitutes an infringement of Article 25 (1) GDPR.
138. It is of the utmost importance that the continuous filming of such places (cf. par. 136)
is done with due care and restraint and in accordance with the
legal provisions in this regard, which is not the case in this case.
139. For all of the above reasons, the defendants infringed Article 25 (1) GDPR by the
placement of the surveillance cameras "front facade" and "front shed".
29
EDPB Guidelines 4/2019, par. 69. 28
2.6. Sanctioning the infringements
140. The Disputes Chamber finds the following infringements on the part of the defendants:
a.Article 6 (1) GDPR, in view of the processing of personal data, and more the
determines the personal data of the first complainant in the present case, using the
security camera "front facade" 30 and security camera "front shed", at 31
happened unlawfully, where personal data was collected at the
filming of public road 32 and filming of private property 33 of third
natural persons;
b. Article 6 (1) GDPR, given the defendants unlawful image material
pass it on to the Traffic Expert, in the context of the Environmental Procedure between
the complainants and the defendants, in particular the personal data of the former
the complainant were processed unlawfully, after which that material with
personal data of the first complainant was provided by the Traffic Expert
made available through an online platform;
c. Article 25 (1) GDPR, given that the defendants do not have adequate measures
affected when installing their surveillance cameras, especially the cameras
"Front facade" and "shed front", so that these are the data protection principles, and
in particular data minimization, compliance, to protect the rights of
involved.
141. The Disputes Chamber notes that the current positioning of the said
security cameras has stopped the violations, and therefore decides only one
reprimand and impose an administrative fine for the aforementioned infringements
(infra).
30 The name of the surveillance cameras is the same as that used by the defendants in their statement of reply dated. 27
November 2019, first indicated at the bottom of page 6.
31
Ibid.
32 Compare: the public road as an "open space" within the meaning of Article 2, 1 ° of the Law of 21 March 2007 regulating
of the placement and use of surveillance cameras (Belgian Official Gazette 21 May 2007), hereinafter the Camera Act.
33 Compare: private property as "closed place not accessible to the public" within the meaning of Article 2, 3 ° CCTV Act. 29
34
142. Taking into account article 83 GDPR and the case law of the Marktenhof, the
Dispute Resolution Chamber imposing an administrative sanction for the two infringements
Article 6 (1) GDPR in concrete terms:
Duration
The fact that from the initial placement of the surveillance cameras to changing the
position of the surveillance cameras continuously unlawfully personal data
were processed with the two mentioned surveillance cameras, that implies the infringements
have taken place over many months. 35
As for the transmission of the footage from the two surveillance cameras to the
Traffic expert, images taken in November 2018 appear to be used
by the defendants in the context of the Environmental Procedure. The phase of the
However, the environmental procedure in which the Traffic Expert was appointed dates back to
not until April 12, 2019, more than five months after the images were taken. The fact that
the footage was kept for so long, and then further processed, also points out
here on a term of preservation of unlawfully made images, which apparently
is excessive, while those images in the first place have already been made unlawfully
became.
Ernst
The violated provisions are at the heart of the General Regulation
Data protection, in particular the lawfulness of the processing.
The defendants say they used a firm specialized in installation
surveillance cameras - however, the defendants themselves remain responsible for the
processing operations for which they determine the purpose and means on the basis of Article 5 (2) and
article 24 GDPR.
The defendants and the complainants are engaged in different disputes before different ones
government agencies, with the defendants arguing that the complainants also determined
have committed personal data breaches - this justifies, however
34
Brussels Court of Appeal (section Marktenhof), X t. GBA, Judgment 2020/1471 of 19 February 2020.
35 The surveillance cameras were installed, according to the defense statement of the defendants, p. 6, “in the autumn of 2018” -
the registration of the surveillance cameras in the e-counter of the FPS Home Affairs dates from October 2018; the
repositioning of the surveillance cameras was reported by the defendants to the police officer in November 2019, according to the
complainants at the end of September 2019.30
by no means own violations of laws and regulations, let alone impunity
implies by the supervisory authority.
The defendants have already set up several of their surveillance cameras
changed, after an intervention of the community police officer, thus changing the current arrangement of the
surveillance cameras (including the two where violations are detected) less risk
implies for the interests, freedoms and fundamental rights of third natural persons who
could be filmed.
The Disputes Chamber also takes into account that the defendants are private citizens
are apparently not pursuing commercial interests in the processing of the
personal data.
Violations of Article 6 GDPR give rise to the highest fines in Article 83 (5)
AVG.
With regard to the setup of the surveillance cameras and the personal data processing
with those cameras, the Disputes Chamber takes into account what the defendants say
regarding compliance by them with national legislation (in particular the Camera Act) and the
advice from the security firm as a contractual partner.
The defendants themselves argue that the cameras were set up in such a way that it was owned by
[defendants] was given maximum protection. ” 36
However, it is apparent from all the elements of the file that sufficient account was not taken
with the implications of CCTV for personal data protection
third parties involved, the complainants.
Number of people involved
With regard to the number of parties involved, the Disputes Chamber wishes to remind you that
misplacing surveillance cameras, and subsequent processing of
personal data through the images of such cameras, when on public roads or
private domains are mapped, a large number of data subjects are affected by their rights.
Children can also be involved in this, something where the GDPR, inter alia in Article 6 (1),
point f) GDPR, paid additional attention.
36
Reply statement of the defendants dated. November 27, 2019, p. 3; the Disputes Chamber underlines. 31
It is important the personal data of such a large number (for the defendants
perhaps unknown number) to process data subjects with the greatest caution, and ten
at least in accordance with data protection regulations.
Sufficient deterrent effect
An administrative fine of EUR 1,500 is sufficient for the Disputes Chamber
deterrent amount to prevent further breaches, given the response to it
penalty form of the defendants dated. November 17, 2020.
143. The Disputes Chamber points out that the other criteria of art. 83.2. AVG in this case not
nature that they lead to an administrative fine other than that which the
Dispute Resolution Chamber has established within the framework of this decision.
144. On October 27, 2020, the Disputes Chamber filed a form for response against
intended fine to the defendants, which was notified to the defendants
that the Disputes Chamber intended to impose a fine of 2,000 on them
EUR. The elements that the defendant subsequently put forward in its response to this form,
are included in the deliberations by the Dispute Chamber. In addition, the
take particular account of the defendant's financial strength.
145. Given the importance of transparency with regard to the decision-making of the
Disputes Chamber, this decision is made in accordance with Article 100, §1, 16 ° WOG
published on the website of the Data Protection Authority with the omission of the
identification data of the parties, given that identification data is not necessary and
relevant in the publication of the decision. 32
FOR THESE REASONS,
the Disputes Chamber of the Data Protection Authority will, after deliberation, decide to issue the
defendants:
on the basis of Article 58, paragraph 2, point b) GDPR and Article 100, §1, 5 ° WOG
to be reprimanded for the infringement of Article 25 (1) GDPR;
b. on the basis of Article 83 GDPR and Articles 100, 13 ° and 101 WOG an administrative one
a fine of EUR 1,500 to be imposed on the defendants for the infringements of
article 6 GDPR. The defendants are jointly and severally liable to pay the aforementioned
amount.
Against this decision on the basis of art. 108, §1 WOG, appeals are lodged within one
term of thirty days, from the notification, at the Marktenhof, with the
Data protection authority as defendant.
(get.) Hielke Hijmans
Chairman of the Disputes Chamber
