APD/GBA (Belgium) - 138/2022

From GDPRhub
Revision as of 15:14, 4 October 2022 by Kv (talk | contribs)
APD/GBA - Decision 138-2022
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 5(1)(a) GDPR
Article 5(1)(b) GDPR
Article 5(1)(c) GDPR
Article 5(2) GDPR
Article 6(1)(f) GDPR
Article 24(1) GDPR
Type: Complaint
Outcome: Upheld
Started: 01.07.2021
Decided: 27.09.2022
Published: 02.10.2022
Fine: n/a
Parties: n/a
National Case Number/Name: Decision 138-2022
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Dutch
Original Source: GBA (in NL)
Initial Contributor: n/a

The Belgian DPA gave the controller a warning after violating Articles 5(1)(a), 5(1)(b), 5(1)(c), 5(2) and 24(1) GDPR, by placing a security camera which also recorded private space of its neighbours.

English Summary

Facts

This decision concerns a controller who placed a surveillance camera. The controller and the data subjects were neighbours. The data subjects claimed that the surveillance cameras of the controller made it possible to capture their living space and garden. The controller stated that the purpose of the cameras was to protect its collection of high value motorcycles and that it had never been his intention to violate the privacy of its neighbours. The data subjects filed separate complaints at the DPA which were later combined in a single complaint. One of the data subjects also went to the police, which resulted in a police investigation at the controller’s place at 27 October 2022.

The DPA conducted an investigation into the controller. The investigations unit held that the controller violated Articles 5(1)(a), 5(1)(b), 5(1)(c), 5(2) and 24(1) GDPR. The investigations unit also held that the controller violated several local legislations, specifically Article 5 Camerawet, Article 3 Koninklijk Besluit 10 February 2008 and Articles 7, 8, 9 Camerabesluit.


Holding

The DPA held that it had the jurisdiction to decide this complaint. The DPA stated that the CJEU had confirmed earlier that the recordings of natural persons with surveillance cameras were in fact personal data. The fact that the controller placed the cameras on his own property didn’t mean that the GDPR was not applicable because of Article 2(2)(c) GDPR, which states that the GDPR is not applicable when the processing of personal data is done by a natural person in the course of a purely personal or household activity. When the cameras also record (parts of) public space or the private space of someone else this provisions doesn’t apply. The surveillance camera also recorded footage of the data subject’s premises. Therefore, the GDPR was applicable. Article 5(1)(a) GDPR

The DPA held that the controller had violated the principle of lawfulness, fairness and transparency (Article 5(1)(a) GDPR). The DPA stated that the controller didn’t inform the data subjects in a transparent and fair way about the processing of their data with the surveillance cameras.

It also held that the public sign, which was necessary to provide with the use of a security camera in a public space, was not provided by the controller (Article 7(2)(6) Camerawet). This sign is obligated for informational purposes, such as informing data subjects about the identity of the controller. After the police investigation of 27 October 2022, the controller applied a sign, but this sign didn’t meet the requirements of Article 3 KB 10 February 2008.

Article 5(1)(b) GDPR

The DPA held that the controller didn’t comply with the obligation to notify and register the surveillance cameras to the police. Therefore, the controller violated Article 5(1)(b) GDPR, despite the fact that it had registered his cameras at the time of this decision.

Article 5(1)(c) GDPR

The DPA held that the controller violated Article 5(1)(c) GDPR because his camera used to able to record more than his own private premises, despite the fact that the controller had corrected this at the time of the proceedings by making sure the surveillance cameras only recorded his own backyard. The controller stated that the camera had a ‘moving function’, where the camera could automatically chance the angle to get a different view. The controller disabled this function at the advice of the police.

Article 5(2) GDPR Article 24(1) GDPR

The DPA held that the controller violated the accountability principle (Article 5(2) and Article 24(1) GDPR). On two grounds. The first ground was the fact that the controller was unable to show how data subjects were informed in a transparent and fair way, unable to show that the data was processed with specified, explicit and legitimate purposes and unable to show that not more personal data was processed than what was necessary for the purposes used by the controller. The second ground was the fact that the controller also didn’t have a registry for video footage and for activities altering this footage. This was however an obligation for the controller according to Article 7(2)(5) Camerawet and Articles 7, 8 and 9 Camerabesluit.

Article 6(1)(f) GDPR

The DPA held that it had to be assessed whether or not the controller could use legitimate interests as a legal ground for processing (Article 6(1)(f) GDPR), since the processing with a surveillance camera was conducted for a legitimate interest of the controller. The DPA referred to the conditions for legitimate interest determined by the CJEU: There must be a legitimate interest, the processing must be necessary for this interest and a balancing test has to take place of the legitimate interest of the controller/third party against the interests and fundamental rights of data subjects.

The DPA held that preventing burglary, vandalism or theft can be seen as a legitimate interest, with a reference to the EDPB Guidelines 3/2019. The interest of the controller in this case, protecting his vehicles, could therefore be seen as legitimate.

The DPA held that the necessity-test should be assessed with the data-minimisation principle (Article 5(1)(c) GDPR) in mind, which states that processing must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. It was already decided that the controller had violated this principle. The constant recording of neighbours private premises cannot be seen ‘relevant’, so processing could certainly not be ‘necessary’ for the legitimate interest of the controller.

The DPA also held that the legitimate interest in question failed the balancing test. It held that the constant recording of the data subjects was a serious infringement on their fundamental rights. The was also a less intrusive option available in the form of putting a casing around the camera to obstruct part of its view. The DPA also considered it a factor that it was beyond the objective expectations of the data subjects that the surveillance camera was positioned in a way such as in this decision.

The DPA gave the controller a warning.


Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

                                                                                          1/14




                                                                           Dispute room


                                   Decision on the merits 138/2022 of 27 September 2022



File number : DOS-2021-50008


Subject : Complaint regarding camera surveillance



The Dispute Chamber of the Data Protection Authority, composed of Mr Hielke

Hijmans, chairman, and Messrs Romain Robert and Jelle Stassijns, members.


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data and revocation of

Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR;


In view of the law of 3 December 2017 establishing the Data Protection Authority,

hereinafter WOG;

Having regard to the internal rules of procedure, as approved by the Chamber of

Representatives on 20 December 2018 and published in the Belgian Official Gazette on

January 15, 2019;


Having regard to the documents in the file;


Has made the following decision regarding:



The complainants: 1. Mr X1, “Complainant 1”

                   2. Mr X2, hereinafter referred to as “complainant 2”
                   hereinafter jointly referred to as “the complainants”:


The defendant: Mr Y, hereinafter referred to as “the defendant”. Decision on the merits 138/2022 - 2/14



I. Facts procedure

 1. On 1 July 2021, the complainants shall file each separate complaint against the defendant with the

       Data Protection Authority. These complaints have the same object.


 2. The subject of the complaints concerns the installation of a surveillance camera by the

       defendant, the complainants' rear neighbor with adjacent gardens. The complainants argue that

       this camera is located in a location that allows you to view the garden and living space of

       to capture the complainants. Complainant 2 has already reported this to the local authorities

       police zone Assenede-Evergeminthe framework of which a check has taken place on
       October 27, 2022 by these competent police forces.


 3. On August 17, 2021, the complaints will be merged by the Frontline Service (hereinafter

       so called “complaint”) and declared admissible on the basis of articles 58 and 60 WOG

       and the complaint is submitted to the Disputes Chamber pursuant to Article 62, § 1 WOG.

 4. On 15 September 2021, in accordance with Article 96, § 1 WOG, the request of the

       Disputes room until an investigation is submitted to the Inspectorate,

       together with the complaint and the inventory of the documents.


 5. The inspection will be completed by the Inspectorate on 26 November 2021
       report attached to the file and the file is reviewed by the Inspector General

       submitted to the Chairman of the Disputes Chamber (Article 91, § 1 and § 2 WOG).


 6. On 9 December 2021, in accordance with Article 96, §2, the request of the

       Dispute chamber to conduct an additional investigation transferred to the

       inspection service.

 7. The additional investigation by the Inspectorate will be completed on January 6, 2022

       the report attached to the file and forwarded by the Inspector General to the

       Chairman of the Disputes Chamber (article 91, § 1 and § 2 WOG).


       The report contains findings with regard to the subject matter of the complaint and decision
       that there is:


       - an infringement of Article 5 (1) a), b) and c) and (2) of the GDPR and Article 24 (1) of the

           GDPR; and

       - an infringement of article 8 of the law of 21 March 2007 regulating the placement and

           the use of surveillance cameras (hereinafter: “Camera Act”), on Article 3 of the

           Royal Decree of 10 February 2008 establishing the manner in which

           indicated that camera surveillance takes place (hereinafter: “RD of 10 February 2008”) and 2



1Law of 21/03/2007 regulating the installation and use of surveillance cameras, BS May 31, 2007.
2Royal Decree of 10/02/2008 establishing the manner in which it is indicated that camera surveillance
takes place, BS 21 February 2008. Decision on the merits 138/2022 - 3/14


           on Article 7, Article 8 and Article 9 of the Royal Decree on the declarations of

           the installation and use of surveillance cameras and the register of the

           image processing activities of surveillance cameras (hereinafter: “Camera Decree”) . 3


 8. On January 17, 2022, the Disputes Chamber will decide on the basis of Article 95, § 1, 1° and Article 98
       WOG that the file is ready for treatment on the merits.


 9. On January 17, 2022, the concerned parties will be notified by email of the

       provisions as stated in Article 95, § 2, as well as of these in Article 98 WOG. Also

       they are informed, pursuant to Article 99 of the WOG, of the deadlines for their

       to file defences.

       The deadline for receipt of the defendant's response was

       laid down on 28 February 2022, this for the complainant's reply on 21

       March 2022 and finally this for the statement of reply of the defendant on April 11

       2022.

 10. On January 17, 2022, the defendant accepts the electronic communication regarding the

       matter.


 11. On January 17, 2022, the complainants accept electronic communication regarding the case.

 12. On February 28, the Disputes Chamber receives a request to extend the claim periods

       extend. On 28 February, the Disputes Chamber will announce the adjusted conclusion terms.

       The deadline for receipt of the defendant's response was

       laid down on March 2, 2022, this for the statement of reply of the complainant on March 23

       2022 and finally those for the defendant's rejoinder on April 13, 2022.


 13. On 2 March 2022, the Disputes Chamber will receive the statement of defense from the

       defendant with regard to the findings with regard to the subject-matter of the
       complaint.


 14. The Disputes Chamber has no conclusion from the complainant's reply and conclusion from the rejoinder

       received from the defendant.



II. Justification


        II.1. Jurisdiction of the Dispute Chamber


 15. Article 4, §1, first paragraph WOG states:

       “The Data Protection Authority is responsible for supervising the

       compliance with the basic principles of the protection of personal data, in


3Royal Decree of 8 May 2018 on the declarations of the installation and use of surveillance cameras and
concerning the register of the image processing activities of surveillance cameras, BS 15 April 2019. Decision on the merits 138/2022 - 4/14


       within the framework of this law and of the laws containing provisions on the

       protection of personal data.”


16. Article 4, §2, second paragraph WOG also states:

      “The Data Protection Authority is the competent supervisory authority

      when no other law provides otherwise.”


17. The Court of Justice has previously confirmed that capturing images of persons

      with surveillance cameras falls under the term 'personal data' within the meaning of the

      European law standards on data protection. The monitoring using

      video recording of persons being captured (stored) is an automated

      processing of personal data within the meaning of Article 2(1) of the GDPR. The processing of

      personal data in that context should therefore also enjoy direct protection

      under the GDPR.


18. The surveillance cameras that are the subject of this complaint have been

      defendant placed on private property (i.e. the property of the defendant). For the

      application of the GDPR, it can be pointed out that the installation of surveillance cameras on

      private domain, and the use of those surveillance cameras with which persons are

      image, do not necessarily mean that this is a “purely personal or

      household activity” within the meaning of Article 2(2)(c) GDPR.


19. When, for example, the video surveillance system enters the public space or private domain

      of others, even in part, and thereby out of the private sphere of

      those who process data through the system, this cannot be considered as

      an activity performed solely for personal or household purposes

                  7
      executed. This makes it possible to make images of natural persons
                                 8
      and identify them. This is the case here. The Disputes Chamber can therefore fully

      proceed to exercise its powers and assess the facts.

20. The legal assessment of this file will therefore in the first instance take place at the

      according to the provisions of the GDPR. The question arises to what extent the processing








4JudgmentCJEU of11December2014,FrantišekRynešt.Úřadproochranuosobníchúdajů,C-212/13,ECLI:EU:C:2014:2428

(hereinafter: Ryneš judgment), para. 22.
5Compare the analysis in the Ryneš judgment of the superseded legal norm mutatis mutandis, par. 25.
6
 A private domain is a 'closed place not accessible to the public' within the meaning of article 2,3° Camera Act. The article
reads as follows: "enclosed place not accessible to the public: any building or any enclosed area"
place intended for use by the public where services can be provided to the public”.

7Compare with the Ryneš judgment, para.32.
8
 Compare with judgment of the CJEU of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Credito and
Federación de Comercio Electronico y Marketing Directo t. Administración des Estado, C-468-9/10, ECLI:EU:C:2011:777
(hereinafter: JudgmentAsociaciónNacional), para. 35 Decision on the substance 138/2022 - 5/14


      of personal data took place lawfully, in accordance with, among other things, Articles 5

      and 6 of the GDPR.


21. In addition, the Camera Act and two royal decrees also contain additional

      obligations imposed relevant for a number of aspects for the treatment of
      present dossier.However, the Dispute Chamber emphasizes that the application of the AVGGals

      Regulation of the European Union takes precedence over the aforementioned national legislation because of

      of its direct effect and primacy within the European legal order. 9


        II.2. Article 5, paragraph 1, a) and paragraph 2 of the GDPR and Article 24, paragraph 1 of the GDPR and the
             Belgian legislation on camera surveillance


22. Above, the Disputes Chamber already emphasized that a video surveillance system under the

      provisions of the GDPR, when the equipment used makes it possible to

      register and store personal data. In this sense, the processing of

      personal data are at all times in accordance with the provisions referred to in Article 5 of the GDPR
      principles of personal data processing.


23. In its Inspection Report, the Inspection Service establishes that the defendant has

      has installed a security camera at his home without taking into account all the principles regarding

      processing of data in Article 5(1) of the GDPR and all obligations of the

      to respect surveillance camera legislation. More specifically, the
      Inspectorate concludes that the defendant has not complied with the provisions of

      Article 5 (1) a), b) and c) GDPR.


      Article 5 (1) a) GDPR - principle of "lawfulness, fairness and transparency"

24. The basic principle of article 5, paragraph 1, a) AVG is that personal data only in a lawful manner

      may be processed. This means that a legal ground for processing

      personal data as referred to in Article 6(1) of the GDPR must be present. For what

      concerns the assessment of the lawfulness of the processing of personal data,

      the Disputes Chamber refers to section II.3.

25. The processing of personal data must also be done properly. Finally must

      be clear for which purposes personal data is processed and how this is done

      (“transparency”).


26. In implementation of these principles, article 8 of the Camera Act prohibits any secret use of
      surveillance cameras:





9ie inter alia Judgment of the CJEU of 5 February 1963, NV General Transport and Expeditie Onderneming van Gend & Loos t.
Dutch Tax Administration, C-26-62, ECLI:EU:C:1963:1; Judgment of the CJEU of 15 July 1964, Flaminio Costa v.
E.N.E.L.,C-6-64,ECLI:EU:C:1964:66;onthelegalprotectionofcitizenson the basis oftheunionrightsprinciples
of 'direct effect' and 'primality', see C.BARNARD, TheSubstantiveLawoftheEU:TheFourFreedoms,Oxford(5deed.),
2016, 17. Decision on the merits 138/2022 - 6/14


      “Considered surreptitious, any use of surveillance cameras without prior notice

      permission of the filmed person. Entering a place where an icon

      indicates that camera surveillance is taking place, counts as prior permission”.


27. Article 7, §2, sixth paragraph of the Camera Act prescribes that the controller
      place a pictogram at the entrance to the closed areas not accessible to the public

      place that indicates that camera surveillance is taking place. So the icon has a

      information role and is mandatory with a view to transparent processing of

      personal data. With regard to the pictogram itself, the Camera Act provides for a

      uniform model, so that it is always clear to the person involved that he is being filmed.Article 3of

      the Royal Decree of 10 February 2008 Article 3 of the Royal Decree of 10 February

      2008 establishing the manner in which it is indicated that camera surveillance
                                                  10
      takes place(hereafter: “RD of 10 February 2008”) determines the requirements that thisicon meets
      must comply. For example, the pictogram must be placed at the entrance of a non-pre

      publicly accessible enclosed place, such as a family home. Stand on this icon

      a number of mandatory information such as, among other things, the identity of the

      controller. In this way, the data subject has access to this

      information about the processing and the controller.

28. The Inspectorate establishes in its Inspection Report that the parties involved, in this case the neighbours,

      were not properly and transparently informed about the processing of their

      personal data via the defendant's surveillance camera. The Assenede police zone

      After all, Evergem has established that the required pictogram, with the required

      entries was not made. After the control of the local police forces, the

      defendant purchased a pictogram to comply with this obligation. The

      However, the inspection service determines based on photos that were transferred by the

      defendant that the pictogram placed was incorrect, which was not in accordance

      is with Article 3 of the Royal Decree of February 10, 2008. Consequently, those involved,
      including the complainants, was not properly and transparently informed about the disputed

      processing their personal data.


29. In its submissions, the defendant argues that when the surveillance camera was installed,

      was not aware of the obligation to affix the required pictogram at the entrance

      from a place not accessible to the public, in case you own his property
      was informed by the local police services during the aforementioned check, has

      the complainant ordered an icon online. However, it was determined that the ordered

      pictogram did not meet the requirements as stipulated in the Royal Decree of 10 February 2008.





10Royal Decree of 10/02/2008 establishing the manner in which it is indicated that camera surveillance
takes place, BS February 21, 2008. Judgment on the merits 138/2022 - 7/14


      When the defendant has been informed of this, he has the correct

      icon placed. The defendant makes two photos of this.

30. From the findings of the local police services and the Inspectorate, the

      Litigation Chamber that the requirements of transparency and fairness have not been met

      data processing, as understood in Article 5 (1) a) GDPR since in the first instance

      no pictogram was provided, and afterwards a wrong pictogram in the second instance

      was applied. The Disputes Chamber therefore concludes that there has been an infringement

      was on Article 5 (1) a) GDPR, but that this has been rectified in the meantime.

31. Abundantly, the Disputes Chamber still points to Article 14 of the GDPR, which determines what information

      must be provided by the controller when the

      personal data has not been obtained from the data subject. Pursuant to Article 12(7) of the

      GDPR this information may be provided through standardized icons,
      like the above icon. The Disputes Chamber does not have this aspect any further

      examined, as it does not form part of the present dispute.


      Article 5, 1, b) GDPR - “purpose limitation” principle

32. In accordance with Article 5(1)(b) of the GDPR, personal data must be collected for specific,

      expressly defined and specified purposes are collected.

33. The Inspection Report establishes that there has been an infringement of the above

      principle of “purpose limitation” since during the aforementioned check by the Police Zone

      Assenede-Evergem showed that no camera surveillance objective was

      registered by the controller. Also Article 7, §2, second paragraph of

      the Camera Act requires that the controller makes the decision to place

      of one or more surveillance cameras in an enclosed area not accessible to the public
      place to the police, at the latest the day before that on which the

      security camera is put into use.


34. During the inspection by the Inspectorate, the controller has
      informed that the purpose of the processing is as follows:


      “Initially I bought this camera in 2019 to protect my

      backyard and certainly my carport / garage in which there are 2 motorcycles with a value

      above 40,000 Euros.”

35. The defendant argues that the camera surveillance was placed with the intention of

      securing his own backyard with a carport where motor vehicles with a high

      value. The defendant hereby emphasizes that he was not aware of the

      mandatory registration and that it was also not his intention to infringe the privacy of his
      violating neighbors. The necessary registration of the camera surveillance was arranged after

      the aforementioned control by the local police services. Decision on the merits 138/2022 - 8/14


36. The Disputes Chamber establishes that the necessary registration of the purpose of the camera surveillance

      was not carried out in a timely manner at the competent local police services, as a result of which it is not possible

      it can be assumed that the data was processed for a specific, explicit

      defined and specific purpose. Consequently, there is an infringement of Article 5,
      paragraph 1, b) GDPR. On the basis of the documents submitted by the defendant, the

      Dispute chamber has established that the camera surveillance has meanwhile been registered with the local authorities

      police forces with the aim of securing his own backyard with a carport where

      high value motor vehicles.

      Article 5(1)(c) GDPR - “minimum data processing” principle


37. The principle of data minimum processing as set out in Article 5(1)(c) GDPR states

      that the processed data must be adequate, relevant and limited to

      what is necessary for the purposes for which they are processed. It follows that the
      personal data may only be processed if the purpose of the processing is not

      could reasonably be achieved by other means.


38. The Inspectorate refers in its report to the statement of the defendant during the
      research. In this statement, the defendant states that the camera has a motion function

      has, but that this functionality was turned off on the advice of the local police forces

      during the aforementioned on-the-spot check. The Inspectorate believes that in the period before

      locking the movement function more personal data was processed, or

      could be processed than was necessary, which means that the principle of "minimum"

      data processing” was not respected.

39. Defendant submits photographs of a casing that was

      made around the surveillance camera, so that at least only part of the own

      garden and garage can be filmed. The defendant also makes photos that show

      that the security camera can now only film the defendant's own garden. In view of the
      above, the defendant also decides that there are

      conclusions, there can no longer be a violation of Article 5(1)(c) GDPR.


40. The Disputes Chamber establishes that from the Inspectorate and from the conclusions of the

      Defendant turns out that the security camera was able to film more than the garage/carport of the
      defendant which constitutes an infringement of Article 5(1)(c) GDPR. Based on

      documents submitted by the defendant, the Disputes Chamber determines that these

      infringement has since been rectified.

      Article 5, paragraph 2 j° Article 24, paragraph 1 GDPR - accountability


41. In view of the violations of the above principles, the Inspectorate notes that the

      the defendant fails to demonstrate the following elements:

      - how those involved were properly and transparently informed; Decision on the merits 138/2022 - 9/14


      - that the processing of personal data via the defendant's surveillance camera

          is done for specified, explicit and legitimate purposes;


      - that the defendant's surveillance camera does not process more data than
          those personal data that are sufficient, relevant and sufficient for the purpose of

          purposes for which they are processed.


42. Consequently, the Inspectorate concludes that there is also an infringement of

      the accountability obligation as defined in Article 5, paragraph 2, in conjunction with Article 24, paragraph 1 of the GDPR.

43. In addition, the Inspectorate also finds an infringement of Articles 7, 8 and 9 of the

      Camera decision as the defendant has not provided a copy of the register of

      image processing activities, despite the request of the Inspectorate.

44. In its submissions, the defendant has submitted some of the foregoing by the

      Inspectorate want to clarify established infringements. With regard to the

      dated register of image processing activities, the defendant states that he had

      learned that he did not need to keep such a register because the camera was on a

      confined place installed, the images are kept for a maximum of one month.

      In the meantime, he is aware that this obligation does apply and in the period
      between the completion of the Inspection Report and the submission of the conclusions, the

      defendant has drawn up an abbreviated register of image processing activities, of which he

      also send photos.


45. The Disputes Chamber recalls that each controller
      basic principles of data protection, as provided for in Article 5(1) of the GDPR,

      comply and must be able to demonstrate this. This results from the accountability obligation in article

      5, paragraph 2 of the GDPR in conjunction with Article 24, paragraph 1 of the GDPR.


46. Based on Article 7, §2, fifth paragraph of the Camera Act and Articles 7, 8 and 9 of the Royal Decree of
      8may2018concerningthedeclarationsoftheplacementstheuseofsurveillancecameras

      and concerning the register of image processing activities of surveillance cameras 11

      (hereinafter: “Camera Decree”), the controller must keep a register of

      keep surveillance camera image processing activities as long as it is with

      surveillance cameras perform image processing. The aforementioned register must be up to date

      are held by the controller, in case the defendant. This register

      includes, among other things, the name and contact details of the person responsible, the precise
      purposes of the processing, the categories of the recipients, any transfer to

      third countries, the retention period, a description of the security measures and also a

      number of typical information elements specific to camera use, such as the

      indication of the type of place. The Disputes Chamber points out that keeping


11
 BS 23 May 2018 Judgment on the merits 138/2022 - 10/14


      such register of image processing activities provides a basis for the

      data controller to comply with the accountability obligations set out in

      Article 5 (2) and Article 24 (1) GDPR).

47. The Disputes Chamber establishes that at the time of the Inspection investigation the requirement

      register of image processing activities was not established and maintained by the

      defendant, which constitutes an infringement of Article 5(2) and Article 24(1) GDPR. on

      based on the documents submitted by the defendant, the Disputes Chamber determines

      that this infringement has meanwhile been rectified.

48. Unnecessarily, the Disputes Chamber also points out that in the light of the provisions in

      Article 30(5) of the GDPR, which contains an exception to the obligation to also

      maintain a processing register directly on the basis of the GDPR, not the register

      assessed on the basis of Article 30(1) of the GDPR.

        II.3. Article 6(1)(f) of the GDPR



49. Above, the Disputes Chamber already emphasized that a video surveillance system under the

      provisions of the GDPR, when the equipment used makes it possible to

      register and store personal data. In this sense, the processing of
      personal data meet one of the conditions for a lawful

      processing under Article 6 GDPR.


50. As explained above, the processing of personal data is only lawful

      if it is based on one of the legal grounds as listed in Article 6, paragraph 1 of
      the AVG. Since the processing of personal data via a camera takes place in this case

      for the protection of an interest of the controller will have to

      be tested to what extent the requirements of article 6, paragraph 1, f) of the GDPR are met

      (“legitimate interest”).

                                                     12
51. According to the case law of the Court of Justice, this test involves three steps:

      The controllers must demonstrate that:

      1) the interests they pursue with the processing can be justified as legitimate

      recognized (the “target test”);

      2) the intended processing is necessary for the realization of those interests (the

      “necessity test”); and
      3) balancing those interests against the interests, fundamental freedoms and

      fundamental rights of data subjects weighs in favor of the

      controllers or a third party (the “balancing test”).




12
 See also Judgment Asociación Nacional, 24 November 2011, C-468/10 Judgment on the merits 138/2022 - 11/14


      Target key


      According to Recital 47 of the GDPR, “a careful assessment is required to

      to determine whether there is a legitimate interest, as well as to determine whether a

      data subject at the time and in the context of the collection of the personal data

      may reasonably expect that processing can take place for that purpose.”

52. In the present file, the defendant has a surveillance camera as a private person

      installed.The interests that the defendant is pursuing in this context he has defined

      as follows:


        “Initially I bought this camera in 2019 to protect my

        backyard and certainly my carport / garage in which there are 2 motorcycles with a value

        above 40,000 Euros.”


53. The European Data Protection Board (hereinafter: the EDPB ) has previously

      indicated that burglary, vandalism or theft are examples of situations that
      justify video surveillance. In the given situation, it is established for the Disputes Chamber

      that the processing of data for the purpose of monitoring the garage/carport is a

      justifiable purpose.


      Necessity test


54. The Court of Justice has underlined in the context of CCTV systems that

      this necessity condition must be examined in conjunction with

      the principle of "minimum data processing", currently enshrined in Article 5,
                       14
      paragraph 1, point c) GDPR. Personal data must be adequate, relevant and limited

      to what is necessary for the purposes for which they are processed.

      As established above, the Inspection Report and the conclusions of the

      defendant that not only the defendant's garage/carport was filmed, but also

      parts of the complainants' private property. Such an arrangement of a

      surveillance camera can hardly meet the principle of minimum

      data processing. The Disputes Chamber establishes that constant filming of (part of)

      thegardens(part of)thehouseofthelagersasneighboursofthedefendantcannotsee

      be regarded as "relevant", let alone "necessary" for the defendant to

      legitimate interest mentioned above. That there is a cover

      was wrapped around the camera, does not detract from the initial infringement.







13Guidelines EDPB 3/2019, par.1
14JudgmentAsociación Nacional 24 November 2011, C-468/10, para. 48. Judgment on the merits 138/2022 - 12/14



      balancing test

55. Although failing the 'necessity test' is already sufficient to establish

      argue that the processing of personal data through the surveillance camera

      took place unlawfully, the Disputes Chamber investigates to the extent necessary

      or the existence of fundamental rights and freedoms of data protection

      persons involved (plaintiffs) whether or not they prevail over the legitimate interests

      of the defendant.


56. That balancing act depends on the particular circumstances of a particular case and the

      rights of the complainants concerned under articles 7 and 8 of the European Charter
      Union with regard to the protection of privacy and

      data protection. 15In this sense, account can be taken of the seriousness of the

      infringement of the complainants' rights and freedoms as an essential part of the analysis.

      It should be noted that the continuous mapping of private

      neighbor's property constitutes a serious infringement of these fundamental rights. This is all the more

      the case when another, less invasive treatment has proved possible, i.e.

      providing the cover around the surveillance camera. It can also be noted that

      it is beyond the objective expectations of those involved that the surveillance camera is on

      is positioned in such a way that it is constantly a part of the private domain of
                       17
      the complainants. This is the case, among other things, because the surveillance camera was not

      placed in accordance with the provisions governing the arrangement of

      surveillance cameras under national law (the Camera Act), as set out in Section

      II.2ofthisdecision.Consequently,theDisputesroomdeterminesthattheprocessinginquestion
      was not foreseeable to the complainants.


57. Consequently, in the given circumstances, there is also an infringement of Article6,

      para. 1, f) GDPR, as the surveillance camera stores images containing personal data

      has unlawfully processed. Although legitimate interests exist for

      the defendant within the meaning of point f) of Article 6(1) of the GDPR, i.e. concrete processing operations not

      necessary to safeguard those interests, and the fundamental rights and

      fundamental freedoms of the complainants and other involved parties outweigh those interests.


    II.4. Breaches


58. On the basis of the documents in the file, the Disputes Chamber establishes that there was

      an infringement of article 5, paragraph 1, a), b) and c) and paragraph 2, article 6, paragraph 1, f) and article 24 paragraph 1 of the GDPR.




15JudgmentAsociación Nacional November 24, 2011, C-468/10; par. 52; EDPB Guidelines 3/2019, par. 32-35.

16JudgmentAsociación Nacional 24 November 2011, C-468/10, para. 56.
1 Regarding these ‘objective expectations’, see EDPB Guidelines 3/2019, para. 36 Decision on the substance 138/2022 - 13/14


      Although the defendant has remedied these infringements, it is established that infringements

      on the right to data protection. When determining the

      sanction, the Disputes Chamber takes into account the fact that the defendant has already

      rectified and submit supporting documents. The Disputes Chamber therefore decides

      that in the concrete factual circumstances of this case, a reprimand for the aforementioned

      infringements is sufficient. The seriousness of the infringement is not such that an administrative fine

      should be imposed.




III. Publication of the decision


 59. In view of the importance of transparency with regard to the decision-making of the

       Litigation Chamber, this decision is published on the website of the

       Data Protection Authority. However, it is not necessary for the

       identifiers of the parties are disclosed directly.




    FOR THESE REASONS,


    the Disputes Chamber of the Data Protection Authority decides, after deliberation, to:

    - To formulate a reprimand on the basis of Article 100, §1, 5 WOG.















Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the

notice against this decision, an appeal may be lodged with the Marktenhof (court of

profession Brussels), with the Data Protection Authority as defendant.


Such an appeal may be lodged by means of an adversarial petition that the
must contain the mentions listed in Article 1034ter of the Judicial Code . It




18The application states, on pain of nullity:
 1° the day, month and year;
 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or
    company number;
 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be
    summoned;
 4° the subject matter and the brief summary of the grounds of the claim;
 5° the court before whom the claim is brought;
 6° the signature of the applicant or of his lawyer. Decision on the merits 138/2022 - 14/14



adversarial petition must be submitted to the registry of the Marktenhof
                                                                      19
in accordance with article 1034quinquies of the Ger.W. , or via the e-Deposit

IT system of Justice (Article 32ter of the Ger.W.).






(get). Hielke H IJMANS


Chairman of the Disputes Chamber

































































19The application with its annex, in as many copies as there are interested parties, shall be sent by registered letter
sent to the clerk of the court or deposited at the clerk's office.