APD/GBA (Belgium) - Decision 138-2022
|APD/GBA - Decision 138-2022|
|Relevant Law:||Article 5(1)(a) GDPR|
Article 5(1)(b) GDPR
Article 5(1)(c) GDPR
Article 5(2) GDPR
Article 6(1)(f) GDPR
Article 24(1) GDPR
|National Case Number/Name:||Decision 138-2022|
|European Case Law Identifier:||n/a|
|Original Source:||GBA (in NL)|
The Belgian DPA gave a controller a warning for violating Articles 5(1)(a), 5(1)(b), 5(1)(c), 5(2) and 24(1) GDPR by recording the private space of its neighbours with a security camera.
English Summary[edit | edit source]
Facts[edit | edit source]
This decision concerns the use of a surveillance camera which partly pointed at the living space and garden of some neighbors (the data subjects). The controller stated that the purpose of the cameras was to protect its collection of high value motorcycles and that it had never been its intention to violate someone else's privacy. The data subjects filed separate complaints at the DPA which were combined in a single procedure. One of the data subjects also went to the police, which resulted in a police investigation at the controller’s place at 27 October 2022. The police came to several conclusions, amongst others the fact that the controller didn't register the purpose of the video surveilance before he placed the security camera. It was obligatory to register the purpose of camera surveilance to the police before the camera was placed. The police also found that the controller didn't notify the police about the placement of the surveillance camera, despite the fact that this was a legal obligation under national law (Article 7(2)(2) Camerawet). The DPA conducted an investigation into the controller. The investigations unit held that the controller violated Articles 5(1)(a), 5(1)(b), 5(1)(c), 5(2) and 24(1) GDPR. The investigations unit also held that the controller violated several local legislations, specifically Article 5 Camerawet, Article 3 Koninklijk Besluit 10 February 2008 and Articles 7, 8, 9 Camerabesluit.
Holding[edit | edit source]
The DPA held that it had the jurisdiction to decide this complaint. First, the recordings of natural persons with surveillance cameras are personal data. Second, the fact that the controller placed the cameras on his own property does not trigger the "household exemption" under Article 2(2)(c) GDPR. When the cameras also record, as in this case, public or private spaces, this provisions doesn’t apply. Therefore, the GDPR was applicable.
The DPA held the controller had violated the principle of lawfulness, fairness and transparency under Article 5(1)(a). For instance, had not installed a public sign signalling a video recording was taking place as required among the others by Article 7(2)(6) Camerawet.
The DPA held that the controller did not comply with the legal obligation to register the purpose of video surveillance at the local police office. Since it was obligatory to register the purpose of camera surveilance to the police, the controller violated Article 5(1)(b) GDPR. The DPA also held that a late registration would not remedy the initial violation.
The DPA held that the controller violated the "data minimisation" principle under Article 5(1)(c) GDPR because the camera used to record more than the controller's private premises. The SA confirmed the violation even if the controller had corrected the camera's orientation during the proceedings by making sure the surveillance cameras only recorded his own backyard. The controller stated that the camera had a ‘moving function’, where the camera could automatically chance the angle to get a different view. The controller disabled this function at the advice of the police.
The DPA held that the controller violated the accountability principle (Article 5(2) GDPR and Article 24(1) GDPR) on two grounds. The first ground was the fact that the controller was unable to show how data subjects were informed in a transparent and fair way, unable to show that the data was processed with specified, explicit and legitimate purposes and unable to show that not more personal data was processed than what was necessary for the purposes pursued by the controller. The second ground was the fact that the controller also didn’t have a registry for video footage and for activities altering this footage. This was however an obligation for the controller according to Article 7(2)(5) Camerawet and Articles 7, 8 and 9 Camerabesluit.
The DPA held that it had to be assessed whether or not the controller could use legitimate interests as a legal ground for processing (Article 6(1)(f) GDPR). Following the CJEU's case law, there must be a legitimate interest, the processing must be necessary for this interest and a balancing test has to take place of the legitimate interest of the controller/third party against the interests and fundamental rights of data subjects. The DPA held that preventing burglary, vandalism or theft can be seen as a legitimate interest, with a reference to the EDPB Guidelines 3/2019. The DPA held that the necessity-test should be assessed with the data-minimisation principle (Article 5(1)(c) GDPR ) in mind, which states that processing must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. It was already decided that the controller had violated this principle. The constant recording of neighbours private premises cannot be seen ‘relevant’, so processing could certainly not be ‘necessary’ for the legitimate interest of the controller. The DPA also held that the legitimate interest in question failed the balancing test. It held that the constant recording of the data subjects was a serious infringement on their fundamental rights. There was also a less intrusive option available in the form of putting a casing around the camera to obstruct part of its view. The DPA also considered it a factor that it was beyond the objective expectations of the data subjects that the surveillance camera was positioned in a way such as in this decision.
The DPA gave the controller a warning.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/14 Dispute room Decision on the merits 138/2022 of 27 September 2022 File number : DOS-2021-50008 Subject : Complaint regarding camera surveillance The Dispute Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans, chairman, and Messrs Romain Robert and Jelle Stassijns, members. Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and revocation of Directive 95/46/EC (General Data Protection Regulation), hereinafter GDPR; In view of the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG; Having regard to the internal rules of procedure, as approved by the Chamber of Representatives on 20 December 2018 and published in the Belgian Official Gazette on January 15, 2019; Having regard to the documents in the file; Has made the following decision regarding: The complainants: 1. Mr X1, “Complainant 1” 2. Mr X2, hereinafter referred to as “complainant 2” hereinafter jointly referred to as “the complainants”: The defendant: Mr Y, hereinafter referred to as “the defendant”. Decision on the merits 138/2022 - 2/14 I. Facts procedure 1. On 1 July 2021, the complainants shall file each separate complaint against the defendant with the Data Protection Authority. These complaints have the same object. 2. The subject of the complaints concerns the installation of a surveillance camera by the defendant, the complainants' rear neighbor with adjacent gardens. The complainants argue that this camera is located in a location that allows you to view the garden and living space of to capture the complainants. Complainant 2 has already reported this to the local authorities police zone Assenede-Evergeminthe framework of which a check has taken place on October 27, 2022 by these competent police forces. 3. On August 17, 2021, the complaints will be merged by the Frontline Service (hereinafter so called “complaint”) and declared admissible on the basis of articles 58 and 60 WOG and the complaint is submitted to the Disputes Chamber pursuant to Article 62, § 1 WOG. 4. On 15 September 2021, in accordance with Article 96, § 1 WOG, the request of the Disputes room until an investigation is submitted to the Inspectorate, together with the complaint and the inventory of the documents. 5. The inspection will be completed by the Inspectorate on 26 November 2021 report attached to the file and the file is reviewed by the Inspector General submitted to the Chairman of the Disputes Chamber (Article 91, § 1 and § 2 WOG). 6. On 9 December 2021, in accordance with Article 96, §2, the request of the Dispute chamber to conduct an additional investigation transferred to the inspection service. 7. The additional investigation by the Inspectorate will be completed on January 6, 2022 the report attached to the file and forwarded by the Inspector General to the Chairman of the Disputes Chamber (article 91, § 1 and § 2 WOG). The report contains findings with regard to the subject matter of the complaint and decision that there is: - an infringement of Article 5 (1) a), b) and c) and (2) of the GDPR and Article 24 (1) of the GDPR; and - an infringement of article 8 of the law of 21 March 2007 regulating the placement and the use of surveillance cameras (hereinafter: “Camera Act”), on Article 3 of the Royal Decree of 10 February 2008 establishing the manner in which indicated that camera surveillance takes place (hereinafter: “RD of 10 February 2008”) and 2 1Law of 21/03/2007 regulating the installation and use of surveillance cameras, BS May 31, 2007. 2Royal Decree of 10/02/2008 establishing the manner in which it is indicated that camera surveillance takes place, BS 21 February 2008. Decision on the merits 138/2022 - 3/14 on Article 7, Article 8 and Article 9 of the Royal Decree on the declarations of the installation and use of surveillance cameras and the register of the image processing activities of surveillance cameras (hereinafter: “Camera Decree”) . 3 8. On January 17, 2022, the Disputes Chamber will decide on the basis of Article 95, § 1, 1° and Article 98 WOG that the file is ready for treatment on the merits. 9. On January 17, 2022, the concerned parties will be notified by email of the provisions as stated in Article 95, § 2, as well as of these in Article 98 WOG. Also they are informed, pursuant to Article 99 of the WOG, of the deadlines for their to file defences. The deadline for receipt of the defendant's response was laid down on 28 February 2022, this for the complainant's reply on 21 March 2022 and finally this for the statement of reply of the defendant on April 11 2022. 10. On January 17, 2022, the defendant accepts the electronic communication regarding the matter. 11. On January 17, 2022, the complainants accept electronic communication regarding the case. 12. On February 28, the Disputes Chamber receives a request to extend the claim periods extend. On 28 February, the Disputes Chamber will announce the adjusted conclusion terms. The deadline for receipt of the defendant's response was laid down on March 2, 2022, this for the statement of reply of the complainant on March 23 2022 and finally those for the defendant's rejoinder on April 13, 2022. 13. On 2 March 2022, the Disputes Chamber will receive the statement of defense from the defendant with regard to the findings with regard to the subject-matter of the complaint. 14. The Disputes Chamber has no conclusion from the complainant's reply and conclusion from the rejoinder received from the defendant. II. Justification II.1. Jurisdiction of the Dispute Chamber 15. Article 4, §1, first paragraph WOG states: “The Data Protection Authority is responsible for supervising the compliance with the basic principles of the protection of personal data, in 3Royal Decree of 8 May 2018 on the declarations of the installation and use of surveillance cameras and concerning the register of the image processing activities of surveillance cameras, BS 15 April 2019. Decision on the merits 138/2022 - 4/14 within the framework of this law and of the laws containing provisions on the protection of personal data.” 16. Article 4, §2, second paragraph WOG also states: “The Data Protection Authority is the competent supervisory authority when no other law provides otherwise.” 17. The Court of Justice has previously confirmed that capturing images of persons with surveillance cameras falls under the term 'personal data' within the meaning of the European law standards on data protection. The monitoring using video recording of persons being captured (stored) is an automated processing of personal data within the meaning of Article 2(1) of the GDPR. The processing of personal data in that context should therefore also enjoy direct protection under the GDPR. 18. The surveillance cameras that are the subject of this complaint have been defendant placed on private property (i.e. the property of the defendant). For the application of the GDPR, it can be pointed out that the installation of surveillance cameras on private domain, and the use of those surveillance cameras with which persons are image, do not necessarily mean that this is a “purely personal or household activity” within the meaning of Article 2(2)(c) GDPR. 19. When, for example, the video surveillance system enters the public space or private domain of others, even in part, and thereby out of the private sphere of those who process data through the system, this cannot be considered as an activity performed solely for personal or household purposes 7 executed. This makes it possible to make images of natural persons 8 and identify them. This is the case here. The Disputes Chamber can therefore fully proceed to exercise its powers and assess the facts. 20. The legal assessment of this file will therefore in the first instance take place at the according to the provisions of the GDPR. The question arises to what extent the processing 4JudgmentCJEU of11December2014,FrantišekRynešt.Úřadproochranuosobníchúdajů,C-212/13,ECLI:EU:C:2014:2428 (hereinafter: Ryneš judgment), para. 22. 5Compare the analysis in the Ryneš judgment of the superseded legal norm mutatis mutandis, par. 25. 6 A private domain is a 'closed place not accessible to the public' within the meaning of article 2,3° Camera Act. The article reads as follows: "enclosed place not accessible to the public: any building or any enclosed area" place intended for use by the public where services can be provided to the public”. 7Compare with the Ryneš judgment, para.32. 8 Compare with judgment of the CJEU of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Credito and Federación de Comercio Electronico y Marketing Directo t. Administración des Estado, C-468-9/10, ECLI:EU:C:2011:777 (hereinafter: JudgmentAsociaciónNacional), para. 35 Decision on the substance 138/2022 - 5/14 of personal data took place lawfully, in accordance with, among other things, Articles 5 and 6 of the GDPR. 21. In addition, the Camera Act and two royal decrees also contain additional obligations imposed relevant for a number of aspects for the treatment of present dossier.However, the Dispute Chamber emphasizes that the application of the AVGGals Regulation of the European Union takes precedence over the aforementioned national legislation because of of its direct effect and primacy within the European legal order. 9 II.2. Article 5, paragraph 1, a) and paragraph 2 of the GDPR and Article 24, paragraph 1 of the GDPR and the Belgian legislation on camera surveillance 22. Above, the Disputes Chamber already emphasized that a video surveillance system under the provisions of the GDPR, when the equipment used makes it possible to register and store personal data. In this sense, the processing of personal data are at all times in accordance with the provisions referred to in Article 5 of the GDPR principles of personal data processing. 23. In its Inspection Report, the Inspection Service establishes that the defendant has has installed a security camera at his home without taking into account all the principles regarding processing of data in Article 5(1) of the GDPR and all obligations of the to respect surveillance camera legislation. More specifically, the Inspectorate concludes that the defendant has not complied with the provisions of Article 5 (1) a), b) and c) GDPR. Article 5 (1) a) GDPR - principle of "lawfulness, fairness and transparency" 24. The basic principle of article 5, paragraph 1, a) AVG is that personal data only in a lawful manner may be processed. This means that a legal ground for processing personal data as referred to in Article 6(1) of the GDPR must be present. For what concerns the assessment of the lawfulness of the processing of personal data, the Disputes Chamber refers to section II.3. 25. The processing of personal data must also be done properly. Finally must be clear for which purposes personal data is processed and how this is done (“transparency”). 26. In implementation of these principles, article 8 of the Camera Act prohibits any secret use of surveillance cameras: 9ie inter alia Judgment of the CJEU of 5 February 1963, NV General Transport and Expeditie Onderneming van Gend & Loos t. Dutch Tax Administration, C-26-62, ECLI:EU:C:1963:1; Judgment of the CJEU of 15 July 1964, Flaminio Costa v. E.N.E.L.,C-6-64,ECLI:EU:C:1964:66;onthelegalprotectionofcitizenson the basis oftheunionrightsprinciples of 'direct effect' and 'primality', see C.BARNARD, TheSubstantiveLawoftheEU:TheFourFreedoms,Oxford(5deed.), 2016, 17. Decision on the merits 138/2022 - 6/14 “Considered surreptitious, any use of surveillance cameras without prior notice permission of the filmed person. Entering a place where an icon indicates that camera surveillance is taking place, counts as prior permission”. 27. Article 7, §2, sixth paragraph of the Camera Act prescribes that the controller place a pictogram at the entrance to the closed areas not accessible to the public place that indicates that camera surveillance is taking place. So the icon has a information role and is mandatory with a view to transparent processing of personal data. With regard to the pictogram itself, the Camera Act provides for a uniform model, so that it is always clear to the person involved that he is being filmed.Article 3of the Royal Decree of 10 February 2008 Article 3 of the Royal Decree of 10 February 2008 establishing the manner in which it is indicated that camera surveillance 10 takes place(hereafter: “RD of 10 February 2008”) determines the requirements that thisicon meets must comply. For example, the pictogram must be placed at the entrance of a non-pre publicly accessible enclosed place, such as a family home. Stand on this icon a number of mandatory information such as, among other things, the identity of the controller. In this way, the data subject has access to this information about the processing and the controller. 28. The Inspectorate establishes in its Inspection Report that the parties involved, in this case the neighbours, were not properly and transparently informed about the processing of their personal data via the defendant's surveillance camera. The Assenede police zone After all, Evergem has established that the required pictogram, with the required entries was not made. After the control of the local police forces, the defendant purchased a pictogram to comply with this obligation. The However, the inspection service determines based on photos that were transferred by the defendant that the pictogram placed was incorrect, which was not in accordance is with Article 3 of the Royal Decree of February 10, 2008. Consequently, those involved, including the complainants, was not properly and transparently informed about the disputed processing their personal data. 29. In its submissions, the defendant argues that when the surveillance camera was installed, was not aware of the obligation to affix the required pictogram at the entrance from a place not accessible to the public, in case you own his property was informed by the local police services during the aforementioned check, has the complainant ordered an icon online. However, it was determined that the ordered pictogram did not meet the requirements as stipulated in the Royal Decree of 10 February 2008. 10Royal Decree of 10/02/2008 establishing the manner in which it is indicated that camera surveillance takes place, BS February 21, 2008. Judgment on the merits 138/2022 - 7/14 When the defendant has been informed of this, he has the correct icon placed. The defendant makes two photos of this. 30. From the findings of the local police services and the Inspectorate, the Litigation Chamber that the requirements of transparency and fairness have not been met data processing, as understood in Article 5 (1) a) GDPR since in the first instance no pictogram was provided, and afterwards a wrong pictogram in the second instance was applied. The Disputes Chamber therefore concludes that there has been an infringement was on Article 5 (1) a) GDPR, but that this has been rectified in the meantime. 31. Abundantly, the Disputes Chamber still points to Article 14 of the GDPR, which determines what information must be provided by the controller when the personal data has not been obtained from the data subject. Pursuant to Article 12(7) of the GDPR this information may be provided through standardized icons, like the above icon. The Disputes Chamber does not have this aspect any further examined, as it does not form part of the present dispute. Article 5, 1, b) GDPR - “purpose limitation” principle 32. In accordance with Article 5(1)(b) of the GDPR, personal data must be collected for specific, expressly defined and specified purposes are collected. 33. The Inspection Report establishes that there has been an infringement of the above principle of “purpose limitation” since during the aforementioned check by the Police Zone Assenede-Evergem showed that no camera surveillance objective was registered by the controller. Also Article 7, §2, second paragraph of the Camera Act requires that the controller makes the decision to place of one or more surveillance cameras in an enclosed area not accessible to the public place to the police, at the latest the day before that on which the security camera is put into use. 34. During the inspection by the Inspectorate, the controller has informed that the purpose of the processing is as follows: “Initially I bought this camera in 2019 to protect my backyard and certainly my carport / garage in which there are 2 motorcycles with a value above 40,000 Euros.” 35. The defendant argues that the camera surveillance was placed with the intention of securing his own backyard with a carport where motor vehicles with a high value. The defendant hereby emphasizes that he was not aware of the mandatory registration and that it was also not his intention to infringe the privacy of his violating neighbors. The necessary registration of the camera surveillance was arranged after the aforementioned control by the local police services. Decision on the merits 138/2022 - 8/14 36. The Disputes Chamber establishes that the necessary registration of the purpose of the camera surveillance was not carried out in a timely manner at the competent local police services, as a result of which it is not possible it can be assumed that the data was processed for a specific, explicit defined and specific purpose. Consequently, there is an infringement of Article 5, paragraph 1, b) GDPR. On the basis of the documents submitted by the defendant, the Dispute chamber has established that the camera surveillance has meanwhile been registered with the local authorities police forces with the aim of securing his own backyard with a carport where high value motor vehicles. Article 5(1)(c) GDPR - “minimum data processing” principle 37. The principle of data minimum processing as set out in Article 5(1)(c) GDPR states that the processed data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed. It follows that the personal data may only be processed if the purpose of the processing is not could reasonably be achieved by other means. 38. The Inspectorate refers in its report to the statement of the defendant during the research. In this statement, the defendant states that the camera has a motion function has, but that this functionality was turned off on the advice of the local police forces during the aforementioned on-the-spot check. The Inspectorate believes that in the period before locking the movement function more personal data was processed, or could be processed than was necessary, which means that the principle of "minimum" data processing” was not respected. 39. Defendant submits photographs of a casing that was made around the surveillance camera, so that at least only part of the own garden and garage can be filmed. The defendant also makes photos that show that the security camera can now only film the defendant's own garden. In view of the above, the defendant also decides that there are conclusions, there can no longer be a violation of Article 5(1)(c) GDPR. 40. The Disputes Chamber establishes that from the Inspectorate and from the conclusions of the Defendant turns out that the security camera was able to film more than the garage/carport of the defendant which constitutes an infringement of Article 5(1)(c) GDPR. Based on documents submitted by the defendant, the Disputes Chamber determines that these infringement has since been rectified. Article 5, paragraph 2 j° Article 24, paragraph 1 GDPR - accountability 41. In view of the violations of the above principles, the Inspectorate notes that the the defendant fails to demonstrate the following elements: - how those involved were properly and transparently informed; Decision on the merits 138/2022 - 9/14 - that the processing of personal data via the defendant's surveillance camera is done for specified, explicit and legitimate purposes; - that the defendant's surveillance camera does not process more data than those personal data that are sufficient, relevant and sufficient for the purpose of purposes for which they are processed. 42. Consequently, the Inspectorate concludes that there is also an infringement of the accountability obligation as defined in Article 5, paragraph 2, in conjunction with Article 24, paragraph 1 of the GDPR. 43. In addition, the Inspectorate also finds an infringement of Articles 7, 8 and 9 of the Camera decision as the defendant has not provided a copy of the register of image processing activities, despite the request of the Inspectorate. 44. In its submissions, the defendant has submitted some of the foregoing by the Inspectorate want to clarify established infringements. With regard to the dated register of image processing activities, the defendant states that he had learned that he did not need to keep such a register because the camera was on a confined place installed, the images are kept for a maximum of one month. In the meantime, he is aware that this obligation does apply and in the period between the completion of the Inspection Report and the submission of the conclusions, the defendant has drawn up an abbreviated register of image processing activities, of which he also send photos. 45. The Disputes Chamber recalls that each controller basic principles of data protection, as provided for in Article 5(1) of the GDPR, comply and must be able to demonstrate this. This results from the accountability obligation in article 5, paragraph 2 of the GDPR in conjunction with Article 24, paragraph 1 of the GDPR. 46. Based on Article 7, §2, fifth paragraph of the Camera Act and Articles 7, 8 and 9 of the Royal Decree of 8may2018concerningthedeclarationsoftheplacementstheuseofsurveillancecameras and concerning the register of image processing activities of surveillance cameras 11 (hereinafter: “Camera Decree”), the controller must keep a register of keep surveillance camera image processing activities as long as it is with surveillance cameras perform image processing. The aforementioned register must be up to date are held by the controller, in case the defendant. This register includes, among other things, the name and contact details of the person responsible, the precise purposes of the processing, the categories of the recipients, any transfer to third countries, the retention period, a description of the security measures and also a number of typical information elements specific to camera use, such as the indication of the type of place. The Disputes Chamber points out that keeping 11 BS 23 May 2018 Judgment on the merits 138/2022 - 10/14 such register of image processing activities provides a basis for the data controller to comply with the accountability obligations set out in Article 5 (2) and Article 24 (1) GDPR). 47. The Disputes Chamber establishes that at the time of the Inspection investigation the requirement register of image processing activities was not established and maintained by the defendant, which constitutes an infringement of Article 5(2) and Article 24(1) GDPR. on based on the documents submitted by the defendant, the Disputes Chamber determines that this infringement has meanwhile been rectified. 48. Unnecessarily, the Disputes Chamber also points out that in the light of the provisions in Article 30(5) of the GDPR, which contains an exception to the obligation to also maintain a processing register directly on the basis of the GDPR, not the register assessed on the basis of Article 30(1) of the GDPR. II.3. Article 6(1)(f) of the GDPR 49. Above, the Disputes Chamber already emphasized that a video surveillance system under the provisions of the GDPR, when the equipment used makes it possible to register and store personal data. In this sense, the processing of personal data meet one of the conditions for a lawful processing under Article 6 GDPR. 50. As explained above, the processing of personal data is only lawful if it is based on one of the legal grounds as listed in Article 6, paragraph 1 of the AVG. Since the processing of personal data via a camera takes place in this case for the protection of an interest of the controller will have to be tested to what extent the requirements of article 6, paragraph 1, f) of the GDPR are met (“legitimate interest”). 12 51. According to the case law of the Court of Justice, this test involves three steps: The controllers must demonstrate that: 1) the interests they pursue with the processing can be justified as legitimate recognized (the “target test”); 2) the intended processing is necessary for the realization of those interests (the “necessity test”); and 3) balancing those interests against the interests, fundamental freedoms and fundamental rights of data subjects weighs in favor of the controllers or a third party (the “balancing test”). 12 See also Judgment Asociación Nacional, 24 November 2011, C-468/10 Judgment on the merits 138/2022 - 11/14 Target key According to Recital 47 of the GDPR, “a careful assessment is required to to determine whether there is a legitimate interest, as well as to determine whether a data subject at the time and in the context of the collection of the personal data may reasonably expect that processing can take place for that purpose.” 52. In the present file, the defendant has a surveillance camera as a private person installed.The interests that the defendant is pursuing in this context he has defined as follows: “Initially I bought this camera in 2019 to protect my backyard and certainly my carport / garage in which there are 2 motorcycles with a value above 40,000 Euros.” 53. The European Data Protection Board (hereinafter: the EDPB ) has previously indicated that burglary, vandalism or theft are examples of situations that justify video surveillance. In the given situation, it is established for the Disputes Chamber that the processing of data for the purpose of monitoring the garage/carport is a justifiable purpose. Necessity test 54. The Court of Justice has underlined in the context of CCTV systems that this necessity condition must be examined in conjunction with the principle of "minimum data processing", currently enshrined in Article 5, 14 paragraph 1, point c) GDPR. Personal data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed. As established above, the Inspection Report and the conclusions of the defendant that not only the defendant's garage/carport was filmed, but also parts of the complainants' private property. Such an arrangement of a surveillance camera can hardly meet the principle of minimum data processing. The Disputes Chamber establishes that constant filming of (part of) thegardens(part of)thehouseofthelagersasneighboursofthedefendantcannotsee be regarded as "relevant", let alone "necessary" for the defendant to legitimate interest mentioned above. That there is a cover was wrapped around the camera, does not detract from the initial infringement. 13Guidelines EDPB 3/2019, par.1 14JudgmentAsociación Nacional 24 November 2011, C-468/10, para. 48. Judgment on the merits 138/2022 - 12/14 balancing test 55. Although failing the 'necessity test' is already sufficient to establish argue that the processing of personal data through the surveillance camera took place unlawfully, the Disputes Chamber investigates to the extent necessary or the existence of fundamental rights and freedoms of data protection persons involved (plaintiffs) whether or not they prevail over the legitimate interests of the defendant. 56. That balancing act depends on the particular circumstances of a particular case and the rights of the complainants concerned under articles 7 and 8 of the European Charter Union with regard to the protection of privacy and data protection. 15In this sense, account can be taken of the seriousness of the infringement of the complainants' rights and freedoms as an essential part of the analysis. It should be noted that the continuous mapping of private neighbor's property constitutes a serious infringement of these fundamental rights. This is all the more the case when another, less invasive treatment has proved possible, i.e. providing the cover around the surveillance camera. It can also be noted that it is beyond the objective expectations of those involved that the surveillance camera is on is positioned in such a way that it is constantly a part of the private domain of 17 the complainants. This is the case, among other things, because the surveillance camera was not placed in accordance with the provisions governing the arrangement of surveillance cameras under national law (the Camera Act), as set out in Section II.2ofthisdecision.Consequently,theDisputesroomdeterminesthattheprocessinginquestion was not foreseeable to the complainants. 57. Consequently, in the given circumstances, there is also an infringement of Article6, para. 1, f) GDPR, as the surveillance camera stores images containing personal data has unlawfully processed. Although legitimate interests exist for the defendant within the meaning of point f) of Article 6(1) of the GDPR, i.e. concrete processing operations not necessary to safeguard those interests, and the fundamental rights and fundamental freedoms of the complainants and other involved parties outweigh those interests. II.4. Breaches 58. On the basis of the documents in the file, the Disputes Chamber establishes that there was an infringement of article 5, paragraph 1, a), b) and c) and paragraph 2, article 6, paragraph 1, f) and article 24 paragraph 1 of the GDPR. 15JudgmentAsociación Nacional November 24, 2011, C-468/10; par. 52; EDPB Guidelines 3/2019, par. 32-35. 16JudgmentAsociación Nacional 24 November 2011, C-468/10, para. 56. 1 Regarding these ‘objective expectations’, see EDPB Guidelines 3/2019, para. 36 Decision on the substance 138/2022 - 13/14 Although the defendant has remedied these infringements, it is established that infringements on the right to data protection. When determining the sanction, the Disputes Chamber takes into account the fact that the defendant has already rectified and submit supporting documents. The Disputes Chamber therefore decides that in the concrete factual circumstances of this case, a reprimand for the aforementioned infringements is sufficient. The seriousness of the infringement is not such that an administrative fine should be imposed. III. Publication of the decision 59. In view of the importance of transparency with regard to the decision-making of the Litigation Chamber, this decision is published on the website of the Data Protection Authority. However, it is not necessary for the identifiers of the parties are disclosed directly. FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority decides, after deliberation, to: - To formulate a reprimand on the basis of Article 100, §1, 5 WOG. Pursuant to Article 108, § 1 of the WOG, within a period of thirty days from the notice against this decision, an appeal may be lodged with the Marktenhof (court of profession Brussels), with the Data Protection Authority as defendant. Such an appeal may be lodged by means of an adversarial petition that the must contain the mentions listed in Article 1034ter of the Judicial Code . It 18The application states, on pain of nullity: 1° the day, month and year; 2° the surname, first name, place of residence of the applicant and, where applicable, his capacity and his national register or company number; 3° the surname, first name, place of residence and, where applicable, the capacity of the person to be summoned; 4° the subject matter and the brief summary of the grounds of the claim; 5° the court before whom the claim is brought; 6° the signature of the applicant or of his lawyer. Decision on the merits 138/2022 - 14/14 adversarial petition must be submitted to the registry of the Marktenhof 19 in accordance with article 1034quinquies of the Ger.W. , or via the e-Deposit IT system of Justice (Article 32ter of the Ger.W.). (get). Hielke H IJMANS Chairman of the Disputes Chamber 19The application with its annex, in as many copies as there are interested parties, shall be sent by registered letter sent to the clerk of the court or deposited at the clerk's office.