APD/GBA - 74/2020
|APD/GBA - 74/2020|
|Relevant Law:||Article 6(1)(f) GDPR|
Article 25(1) GDPR
Law of 21 March 2007 regulating the positioning and use of video surveillance cameras
|National Case Number/Name:||74/2020|
|European Case Law Identifier:||n/a|
|Original Source:||Data Protection Authority (in NL)|
The Belgian DPA (APD/GBA) imposed a fine of € 1500 on a private individual for the unlawful filming of public roads and private property of third parties with surveillance cameras, and for illegally sharing images taken from this system in breach of Article 6(1)(f) GDPR.
There were legitimate interests for the defendants to install surveillance cameras to protect their own private property. But the way those surveillance cameras were positioned and the fact that they were constantly monitoring was not deemed necessary to safeguard those legitimate interests. The DPA moreover found the interests of the defendants to process personal data through the surveillance cameras to be overridden by the interests of the complainants and other data subjects.
On the contrary, the taking of a one-off photograph with a smartphone, as a direct response to seeing an alleged offence, was seen as constituting a lawful processing within the meaning of Article 6(1)(f) of the GDPR.
English Summary[edit | edit source]
Facts[edit | edit source]
A couple has installed a video surveillance system on their property. The couple's neighbors lodged a complaint because some of the cameras were placed in such a way that they were filming part of the public road as well as their private property, and had filmed the complainants while driving on the public road or entering private property of their own. The complainants asked that the video surveillance system would be taken down.
The complainants also opposed the further use of the recordings made by the video surveillance system, which were subsequently shared by the defendants with an expert in the context of another (environmental law) dispute between the defendants and the complainants.
The defendants took a photograph of the complainants with a smartphone, to establish an alleged breach of environmental law. The complainants also fought the making of such photograph and the further processing thereof.
Dispute[edit | edit source]
Is the processing of personal data included in photographs and camera images lawful under Article 6(1)(f) of the GDPR?
Holding[edit | edit source]
First of all, the DPA recalls that:
- a video surveillance system falls under the provisions of the GDPR when the equipment used makes it possible to collect and store personal data;
- such processing of personal data must at all times be consistent with the principles of data protection found in Article 5 of the GDPR, and fulfill one of the lawful bases for processing as set out in Article 6 of the GDPR.
Recording and use of images from the surveillance cameras[edit | edit source]
As the complainants had not given their consent to the processing of their personal data, no other condition for the lawfulness of processing was possible in this context, except the "legitimate interests" under Article 6(1)(f) of the GDPR.
The Belgian DPA therefore conducts a "legitimate interests assessment" by following the three-part test:
Purpose test[edit | edit source]
Is there a legitimate interest behind the processing?
The DPA found that the defendants had a legitimate interest in placing the surveillance cameras in order to ensure the protection of their property and fight burglary, vandalism or theft. The damages caused to the goods belonging to the defendants in the period prior to the installation of the surveillance cameras show that the legitimate interest on the part of the defendants was moreover real and currently existing (and therefore not a purely hypothetical).
Necessity test[edit | edit source]
Is the processing necessary?
The DPA found that some surveillance cameras were set up in a way that cannot be regarded as necessary and in accordance with the data minimisation principle. The extensive and constant filming of the public highway cannot indeed be regarded as 'relevant', let alone 'necessary', for the defendants to safeguard their legitimate interests.
Balancing test[edit | edit source]
Is the legitimate interest overridden by the fundamental rights and freedoms of the data subject?
The surveillance cameras also did not withstand the weighting test, considering the seriousness of the infringement of the rights and freedoms of the complainants.
To come to this conclusion, the DPA pointed out that:
- Continuous monitoring of the public highway, i.e. 24 hours a day, 7 days a week, constitutes a serious breach of the fundamental rights of the complainants. This also applies to the continuous monitoring of private domains of the complainants.
- This is all the more true when other less intrusive processing proves possible, by adjusting the position of the surveillance cameras.
- The rights of many other people were violated, such as the complainants’ children, or drivers of vehicles passing by on public roads in front of the defendants’ homes.
- It is beyond the objective expectations of the data subjects concerned by the surveillance cameras.
- The surveillance cameras were not installed in accordance with the provisions on the installation of security cameras under national law (law of 21 March 2007 regulating the positioning and use of video surveillance cameras).
The DPA Litigation Chamber therefore upheld that the images made by the surveillance cameras were not processed in a lawful way under Article 6(1)(f) GDPR. Those unlawful processing operations were, by their very nature, sufficient in themselves to show that insufficient measures have been taken by the defendants to respect the data protection principles of the GDPR, and therefore also constitute an infringement of Article 25(1) of the GDPR.
Transmission of the images to third parties[edit | edit source]
According to the DPA, the transmission of the images made by the surveillance cameras in the context of the environmental law litigation also constituted a breach of article 6.1(f) of the GDPR, as the images were unlawfully made in the first place, thus constituting unlawful processing impacting the further processing.
Taking of photographs in the event of an (alleged) offence[edit | edit source]
On the other hand, the making of a picture and the further processing thereof, was judged lawful under Article 6(1)(f) of the GDPR, as the processing was necessary for the defendants to safeguard a legitimate interests (i.e. to collect evidence of an infringement and bring this to the attention of the competent authorities), and did not appear to be so intrusive for the fundamental rights of the data subjects to outweigh the legitimate interests of the defendants. The taking of the photograph therefore withstood the assessment test.
The DPA Litigation Chamber therefore imposed a fine of € 1500 for the infringements of Article 6 of the GDPR. In addition, it issued a reprimand to the defendants for not respecting article 25.1 of the GDPR while placing their video surveillance system.
Comment[edit | edit source]
This fine is a reminder that the GDPR does not only apply to companies, but also to citizens who process personal data outside the strictly domestic context.
The defendants claimed that they had engaged the services of a security firm specialized in placing of surveillance cameras, but the DPA pointed out that the defendants remain however responsible for the processing operations for which they determine the purpose and means. The way in which the company (incorrectly) installs the surveillance cameras is a contractual matter that does not oppose the application of the GDPR and the associated responsibilities of the data controller.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Litigation chamber Decision on the merits 74/2020 of 24 November 2020 File number: DOS-2019-04412 Subject: Complaint for unlawful filming of the public road and private domain of third parties with surveillance cameras. The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke Hijmans, chairman and Messrs. Dirk Van Der Kelen and Frank De Smet, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General Data Protection Regulation), hereinafter GDPR; In view of the law of 3 December 2017 establishing the Data Protection Authority, hereinafter WOG; Having regard to the rules of internal procedure, as approved by the Chamber of Representatives on December 20, 2018 and published in the Belgian Official Gazette on January 15, 2019; Considering the documents in the file; . . . 2 has taken the following decision regarding: - X1, hereinafter referred to as “the first complainant”, and X2, hereinafter referred to as “the second complainant”, both natural persons domiciled in […] and hereinafter jointly referred to as “the complainers ”, and, - Y1, hereinafter referred to as “the first defendant” and Y2, hereinafter referred to as “the second defendant ”, both residing in […] and hereinafter jointly referred to as“ the defendants ”. 1. Facts and procedure 1. On August 26, 2019, the complainants file a complaint with the Data Protection Authority. 2. The complaint can be summarized as follows. According to the complainants, three surveillance cameras are filming of the defendants, the “entire domain” of the complainants. One camera would also “it full street scene ”. In the context of environmental law proceedings between the the complainants and the defendants, in particular in the context of an application for regularization by the complainants, images from the defendants' surveillance cameras were brought to the notice of the complainants brought in by a third party, expert engineer Z. Those images were, according to the complainants not only provide evidence for unlawful filming of public and private roads property of third parties, but also of the unlawful transmission of the recordings of those images to unauthorized third parties. The environmental law procedure at the Environment Department that followed from the dispute regarding the regularization application, is hereinafter referred to as “the Environmental Procedure”. The expert engineer Z appointed in the context of the Environmental Procedure is hereafter Called “the Traffic Expert”. 3. The complaint also mentions that a complaint was made to the local police about the same facts. 4. In accordance with Article 58 of the WOG, the Primary Service of the Data Protection Authority on September 6, 2019 the complaint admissible. On the basis of Article 62, §1 of the WOG, the complaint is subsequently transferred to the Disputes Chamber. 5. By registered letter dated September 24, 2019, the complainants and defendants will be notified of the informed of the decision of the Disputes Chamber to close the file in accordance with 3 treat article 95, §1, 1 ° WOG on the merits. In the registered letter are also the closing deadlines communicated to the parties in accordance with Articles 98 and 99 WOG. Conclusion of the defendants' reply 6. The defendants point out that the way in which the surveillance cameras are filming, “was instituted by the company that installed the cameras. ” According to the defendants, the aim was purely securing their property, “and not the public domain nor the property of it to target the applicants. " 7. The defendants insert screenshots of the video images captured by the said surveillance cameras at their conclusion. The images predate the adjustments of the state of the surveillance cameras that the police officer had asked to make. 8. The surveillance cameras have different names. 9. First, there is a security camera "front shed", which according to the defendants is only a limited part of the property of the complainants is filmed, but not the home of the complainants self. 10. Second, the security camera "front facade" films the front garden, part of the facade and part of the public road. On the image added by the defendants more than a third of the security camera image is taken up by the public road which is before the defendants' house. The defendants cite that the bottom line more this security camera was changed after the visit of a local police officer, after which the camera image - at least on the basis of the still image added by the defendants - for more than half only depict the wall of the facade, only a limited part of the defendants' front yard and porch, and in no way the public road pictures. By adjusting the position of this security camera after the visit of a local police officer, are the images that are captured in the dark by the reflection of the light from the "night mechanism" of the security camera, de facto useless, said the defendants. 11. Third, there is the security camera "street side". The defendants argue: “de haag die for the camera is placed on the street side prevents this camera from filming on the street. ” Again, the security camera would, after resetting the position of the security camera, de facto become unusable at night, because more than half of 4 what is portrayed concerns the brick facade, which is the light from it night mechanism of the surveillance camera is reflected in the lens. 12. The photo attached to their complaint by the complainants with the mention "camera garages', according to the defendants, is not an image of a security camera, but a photo taken with a smartphone. 13. The defendants also argue that they are “installing and using the camera surveillance system indicated [have] electronically via the e-counter for the declaration of surveillance cameras by the Federal Public Service Internal Affairs is made available. " 14. The defendants also argue that the designation of the controller, according to the Camera Act, 1 clearly happened. The camera images, according to the defendants, would be erased after one month. However, “the images that the mobility impairments were saved and deleted after they were transferred to the traffic expert. ” The Traffic Expert used the images in the context of the analysis of any nuisance related to environmental law (mobility and other) by the complainants, and this in the context of the Environmental procedure. The Traffic Expert compiled the images, along with the report of his analysis, in the course of the Environment procedure available to the parties and the Environment Department. 15. With regard to the images made available by the Traffic Expert in the context of his environmental report on the mobility situation, the defendants argue incidentally, that the council of mayor and aldermen of the municipality where the the complainants and defendants are resident, as well as the Environment Department as competent government appealed, the images were sent via a "SharePoint" web link. The defendants state in this regard: “The sharepoint in the management of the authorized traffic expert […] ” And further: “The images were erased by the [defendants] after they were presented to the expert handed over. ” The defendants also add that the Traffic Expert is now, “in response of the end of the administrative procedure [the Environmental procedure], the Sharepoint offline [has]. ” 1 Law of 21 March 2007 regulating the installation and use of surveillance cameras, Belgian Official Journal 31 May 2007, hereinafter "Law Camera surveillance'. 5 16. As already mentioned, the defendants argue that the image attached to the complaint and according to the complainants, a camera image of the position is "garages", it was a photo was taken with a smartphone. The photo was taken by the defendants in their own words made to record a breach of environmental law: “a […] is considered as a […] that cannot just be dragged across the street and the sewage well, which the photo shows that this is happening. ” 17. Finally, the defendants raise that, in the context of another environmental law dispute, the complainants themselves are unauthorized and possibly illegal (camera) images and / or photos turned the property of the defendants. Reply of the complainants' reply 18. In this Opinion, the complainants state that - by the defendants in the present procedure - another image was sent, this time to the Federal Agency for the Safety of the Food Chain and the “Cell Environmental Enforcement”. There is not specified what is meant by the latter. 19. The complainants point out that there is indeed a camera "garages" and add conclusion photos of the defendants' home showing a camera above one garage door can be seen, which apparently does not replace the other three cameras. 20. In addition, the complainants argue that the surveillance camera "street side" is indeed part of filmed the property of the complainants. Also with regard to the surveillance cameras 'front facade' and "front shed", according to the complainants, there is a breach of the law, just because the images were used in the Traffic Expert's investigation - following the Environmental procedure - which related to the mobility situation on public roads and access to the complainants' property by themselves or any visitors. 21. In addition, the complainants point out that the retention periods have not been respected certain images used in the Environmental Procedure date from 11 November 2018, and only months later would have been passed on to the Traffic Expert. The complainers point out in addition, note that the Traffic Expert is not part of the police forces or judicial authorities. 6 22. Finally, the complainants will discuss the Environmental Procedure, but the factual explanation is of no importance for the further handling of the complaint for the Data protection authority, and will not be included in this decision. Statement of reply of the defendants 23. The defendants' reply confirms, on the one hand, the content of the first conclusion of reply, but on the other hand introduces some new elements. 24. First of all, the defendants argue that there were indeed five surveillance cameras registered via the e-counter of the FPS Home Affairs. According to the defendants the two other surveillance cameras not mentioned in the original complaint, and therefore not addressed in the reply conclusion. This specifically concerns a security camera "Back of shed" and a security camera "garage". 25. The surveillance camera "garage" again films part of the front facade of the house, just such as security camera "facade". The defendants add a picture to their conclusion that according to them predates the adjustment of the positions of the surveillance cameras after a visit by the local police officer, involving a limited part (less than a third) of the image of the security camera filming the public road. 26. The defendants do not get any picture of the surveillance camera "rear of the shed" transferred, because according to them the position of this surveillance camera is not a problem, neither for the property of the complainants, nor for the public road. 27. According to the defendants, only images of the security camera "front facade" and security camera "front shed" transferred. This one After all, according to the defendants, images were relevant to certain mobility situations, relevant to the Environmental Procedure. 28. The defendants emphasize that the company that installed the surveillance cameras security cameras so tried to establish the property of the defendants "Maximum security." 29. The defendants also emphasize that the images from, among other things, the surveillance cameras that were handed over to the Traffic Expert, were indeed important to him report, and that this report was indeed used in the deliberations of the competent authority in the decision of the Environmental Procedure. 7 Hearing 30. On November 12, 2019, the defendants, through their counsel, had requested to be heard. 31. By Ministerial Decree of June 30, 2020 containing urgent measures to prevent the dissemination of the coronavirus COVID - 19 (Belgian Official Journal 06/30/2020), as amended by Ministerial Decree of August 22, 2020 (Belgian Official Journal 08/22/2020) was decided by the federal government to a number of coercive measures that made it difficult to hold a hearing in the normal setup. The Disputes Chamber therefore offered the parties the opportunity to attend the hearing, where the defendant in its claim asked to take place electronically. Both parties agreed and confirmed their presence. 32. A hearing will take place on September 7, 2020, with the complainants and defendants present as well as counsel for the defendants. 33. The details and additions were made in the minutes of the hearing adopted that are not a mere repetition of elements that recur in the previous documents, and in particular the claims of the parties, of the file. 34. For example, the defendants have pointed out that they make the Traffic Expert an actor deem that falls under "judicial authorities" as referred to in the Camera Act. 35. The defendants further argue that the offer to change the positioning of the the disputed security cameras had clearly been requested before the defendants were informed about the existence of a complaint to the GBA. 36. As usual, the Disputes Chamber invited both parties to submit comments to have the report of the hearing added as an attachment to that report, without this implying a reopening of the debates. Both sides have responded to that invitation, and the responses and accompanying documents were attached to the trial verbally added to the file. 8 2. Justification 2.1 The scope of the proceedings on the merits before the Disputes Chamber a. The submission of new defenses and documents by the parties after the close of the debates 37. The Disputes Chamber finds that both parties have extensive additions and documents to it in response to the invitation of the Disputes Chamber for any to make comments on the official report. 38. The Disputes Chamber underlines that the aforementioned invitation was clearly worded, in the sense that the comments should not constitute a reopening of the debates. The invitation merely offers the parties the opportunity to provide factual comments on what is formulated in the official report. 39. Article 98, 3 ° of the WOG ensures the possibility for the parties to “retrieve all documents that they are useful consider to be added to the file. " A thorough course of the procedure in the light of a due process by the Data Protection Authority within the meaning of Article 58 (4) GDPR, requires that at some point, notably after the end of the hearing, the debates are closed without yet another round of exchange of to allow defenses. 40. Admitting new documents, without defendant means on the part of the other party, would violate the opposing party's right to object. 41. For the above reasons, the Disputes Chamber rejects the documents that both parties as "Comments" on the minutes of the hearing have been forwarded to the Disputes Chamber, from the debates. b. Elements in defenses and documents outside the scope of the procedure 42. The Disputes Chamber finds that the defendants describe facts in their response statement on account of the complainants who allegedly infringe the same provisions that it be the subject of this complaint. 9 43. Without declaring the merits of those allegations made by the defendants, will the Disputes Chamber will only assess the facts as they are in the complaint suggested. After all, the Disputes Chamber is only involved in this matter for the handling of that complaint, in accordance with Article 92, 1 ° WOG. 44. In addition, the Disputes Chamber points out that pending proceedings before the Disputes Chamber does not justify that parties to the dispute themselves - in the context of affixing documents or evidence - carrying out unlawful processing of personal data, or on otherwise the protection of the privacy of the other party in particular misunderstand. The Disputes Chamber reiterates, however, that in this regard it is only concerned with the handling of a complaint in accordance with Article 92, 1 ° WOG. 45. Naturally, any citizen, including the defendants, is free to lodge a complaint with the Data protection authority regarding facts regarding (possible) infringements of the regulations on personal data protection. 2.2 Jurisdiction of the Disputes Chamber (Article 100 WOG) 46. Although the actual events leading up to the Environmental Proceedings, en consequently to the procedure before the Data Protection Authority (hereinafter: GBA), in detail are set out by the complainants and defendants, they have no immediate relevance to the analysis by the Dispute Chamber. 47. The Disputes Chamber considers it important to have some fundamental aspects with regard to to explain camera surveillance in underlying decision. 48. Article 4, §1, first paragraph of the WOG states: “The Data Protection Authority is responsible for overseeing the compliance with the basic principles of the protection of personal data, in under this Act and the laws containing provisions on the protection of personal data. " Article 4, §2, second paragraph of the WOG also states: “The Data Protection Authority is the competent supervisory authority when no other law provides otherwise. " 10 49. The legal assessment of this file will therefore be based in the first place of the provisions of the GDPR. The question arises here to what extent the processing of personal data took place lawfully, in accordance with Articles 5 and 6 of the GDPR. 50. In addition, the CCTV Act - as a national law that contains provisions regarding the protection of personal data - relevant for some interpretative aspects for the handling of this complaint and, by extension, the present file. 51. However, the Disputes Chamber emphasizes that the application of the GDPR as a regulation of the European Union takes precedence over the aforementioned national legislation because of its direct effect and its excellence within the European legal order. 2 52. This also applies in particular to circumstances in which an interpretation is given to 3 the data protection law concept of "legitimate interest". This is the case here, given that it concerns processing operations set up as a result of the private interests of citizens (see infra, part 2.4. with regard to the lawfulness of the processing). 53. The Court of Justice has previously confirmed that capturing images of people with surveillance cameras fall under the concept of "personal data" in the sense of the 4 European law standards on data protection. The surveillance using video recordings of persons that are captured (saved) is an automated one processing of personal data within the meaning of Article 2 (1) GDPR. The processing of personal data in that context should therefore also enjoy direct protection under the GDPR. 2 See, inter alia, CJEU judgment of 5 February 1963, NV Algemene Transport- en Expeditie Onderneming van Gend & Loos v. Dutch Administration of Taxes, C-26-62, ECLI: EU: C: 1963: 1; CJEU judgment of 15 July 1964, Flaminio Costa v. E.N.E.L., C-6-64, ECLI: EU: C: 1964: 66; on the legal protection of citizens based on EU law and the principles of "direct effect" and "prima facieity", see C. BARNARD, The Substantive Law of the EU: The Four Freedoms, ed.), rd (5 2016, 17. 3 Compare CJEU judgment of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Credito and Federación the Comercio Electrónico y Marketing Directo t. Administración des Estado, C-468-9 / 10, ECLI: EU: C: 2011: 777 (hereinafter: Judgment Asociación Nacional), par 39: “It follows that, with regard to the processing of personal data, Article 7 (f) of Directive 95/46 precludes any national legislation which, in the absence of the consent of the data subject, in addition the two cumulative conditions referred to in the preceding paragraph imposes additional requirements. ”; ibid., par. 52: “established Article 7 (f) […] must be sufficiently precise to be invoked by an individual and by the national courts [and imposes] an unconditional obligation. ” 4 CJEU judgment of 11 December 2014, František Ryneš v. Úřad pro ochranu osobních údajů, C-212/13, ECLI: EU: C: 2014: 2428 (hereinafter: Ryneš judgment), par. 22. 5 Compare the analysis in Ryneš of the superseded legal norm mutatis mutandis, par. 25. 11 54. The surveillance cameras that are the objects of this complaint are by the defendants placed on private domain (i.e. the property of the defendants). For the purposes of the AVG can be pointed out that placing security cameras on private domain, and the use of those surveillance cameras with which people are recorded on images, not per definition mean that this is a “purely personal or household activity” in the sentence of Article 2 (2) point c) GDPR. 55. When the video surveillance system, for example, the public space or private domain of covers others, even in part, and thereby moves out of the private sphere of those processing data through the system, this cannot be considered an activity performed exclusively for personal or household purposes. because of this After all, it will be possible to make and record images of natural persons identify. This is the case here. 56. Finally, it can be established that there is no risk that the Disputes Chamber will proceed to a parallel assessment - alongside any other authority - of the facts surrounding the use video surveillance, and thus violate the ne bis in idem principle of law, given the other procedures mentioned in the file concern related, yet legally distinct facts that do not relate to the protection of personal data. The Disputes Chamber can therefore proceed in full to the record its powers and assess the facts. 2.3. The controller (s) 57. In accordance with Article 4 (7) GDPR, the controller is: “A natural or legal person, a public authority, a serving or a other body that, alone or together with others, has the purpose of and means for the processing of personal data; when the objective of and the means of such processing become Union or Member State law 6 A private domain is a "closed place not accessible to the public" within the meaning of Article 2, 3 ° Camera Act. The article sounds like this: “Enclosed space not accessible to the public: any building or any place delimited by an enclosure intended for the use by the public where services can be provided to the public ”. 7 Compare with Ryneš judgment, par. 32. 8 Compare with Asociación Nacional, para. 35. 12 may determine who the controller is or according to which criteria it is designated ” 58. It is fundamental that the core concepts of privacy and data protection can be interpreted uniformly, to ensure legal certainty for citizens to provide. The concept of "controller" within the meaning of the Camera Act, and the GDPR respectively, should therefore be interpreted in the same way. 59. There are a number of elements in the file which indicate that both defendants themselves as joint controller within the meaning of Article 26 GDPR. 2.3.1. Placing surveillance cameras and registering and storing camera images from surveillance cameras that may or may not contain personal data 60. In this respect it can be established that the defendants have both taken actions in the context of placing the surveillance cameras and determining the position of them cameras. The defendants both reside in the home where the security cameras were placed, they both gave instructions to the firm that issued the has installed security cameras and they have both jointly defended all the elements in the file, without distinguishing between them persons. 61. It must be said that within the meaning of Article 7 CCTV Act the first defendant in his name has done the registration at the e-counter of the FPS Home Affairs, but on other places in this application, the name of the second defendant is stated. She is in particular to request the contact person to access the images. Also the e-mail address for mentions the contact with the controller in the application at the e-counter the first respondent's first name. 62. The Court of Justice has confirmed that for the identification of the controller (s) there must be a factual assessment of which natural person or legal entity, resp. natural or legal persons, “the purpose” and “the means ”of the processing, whereby for the protection of data subjects a wide definition is given to the term. 9 The Court has also held that a natural person who, for reasons of his own, influences the processing of 9 CJEU judgment of 13 May 2014, Google Spain and Google, C-131/12, ECLI: EU: C: 2014: 317, par. 34; CJEU judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C-210/16, ECLI: EU: C: 2018: 388, par. 28. 13 personal data and thereby participate in determining the purpose of and the means of this processing can be considered to be a controller. 10 63. It is therefore not because under national law a person (the first defendant) has made a formal request as a controller that that person (the is the sole) controller within the meaning of European law. This also has the second defendant thus behave as controller in the European law sense. 64. In the context of installing surveillance cameras and registering and storing them of the images recorded by those cameras, including the second respondent had a decisive influence, 11 thus appears to be joint processing responsibility of the defendants. 2.3.2. Handing over camera images and photos to the Traffic Expert 65. It appears from the defendants' defense that the camera images were recorded by both defendants were referred to the Traffic Expert in the context of the 12 Environmental procedure. With regard to such transfer as processing, the defendants identified as joint controllers in accordance with Article 26 GDPR, given the choice of transferring these images ("the purpose"), as well as the way ("the means"), was made by both defendants. 2.3.3. The use of camera images by the Traffic Expert in an expert report, and making camera images of the disputed security cameras available via a SharePoint link by that Traffic Expert 66. In the context of the Environmental Procedure, a Traffic Expert was approached by both defendants, in order to prepare an expert report, in particular on the mobility situation in the immediate vicinity of the complainants' private domains, and consequently 10 Judgment of the CJEU of 10 July 2018, Weersan todistajat, C-25/17, ECLI: EU: C: 2018: 551, par. 65. 11 Regarding the role of the "decisive influence", cf. CJEU judgment of 29 July 2019, Fashion ID t. Verbraucherzentrale NRW, C- 40/17, ECLI: EU: C: 2019: 629, par. 70. 12 Conclusion of the reply of the defendants dated. November 27, 2019 (Document 10), mid p. 5: “The conclusions [defendants] have to the dangerous traffic situation recognized by both the city […] and the department of surroundings images preserved and handed over to the [Traffic expert] to address these nuisance aspects that violate spatial planning, public order. ” 14 near the home of the defendants, given the parties on both sides of the same road borders with their property. 67. From the circumstances described in the decision of the Environment Department in the Environmental procedure, as well as from the expert report itself, shows a certain independence from the Traffic Expert. 68. In that sense, it has also not been proven that the defendants transmitted any instructions to the Traffic Expert with regard to the further distribution of the images with personal data that the defendants transferred to the Traffic Expert. Even more, according to the defendants, the Traffic Expert was only charged with the map the mobility situation using the images. The defendants would claim the Traffic experts also requested that the images be removed via the Sharepoint link. 69. In any case, the defendants cannot be regarded as (joint) controllers for the further distribution of the camera images via a Sharepoint link by the Traffic Expert, not just because concrete instructions are lacking in this respect, but also because the defendants did not "determine the means" with which the Traffic Expert had drawn up his expert report, the choice to use the used images with personal data (the vehicles and images of various persons are presented), including the full report. This one resources were determined by the Traffic Expert. 70. The complainants' complaint is addressed to the defendants in this file. To the course of a to safeguard a thorough procedure as well as the correct contradiction, the Disputes Chamber decides not to involve the Traffic Expert in this file. 71. The Disputes Chamber underlines that the fact that a third party - not involved in this procedure - the controller is or would be for subsequent processing of a transfer that is initially the responsibility of (one of) the defendants, not means that the initial transfer was therefore lawful. This aspect, applied to the disputed facts, the Disputes Chamber will deal with below. 15 2.4. The lawfulness of the processing (Article 6 GDPR) 2.4.1. Registering, storing and otherwise using images that are contain personal data and originate from the disputed security cameras 72. Based on the images available in the file, as well as the indications given by the complainants and the defendants of the location of the surveillance cameras on maps and aerial photographs, can determined that all surveillance cameras were attached to either the control panel main building of the defendants' property (hereinafter: the dwelling) or the secondary building on the property of the defendants (hereinafter: the barn). 73. In addition, it can be established from the same images and indications that the house and barn do not directly adjoin the public road or private areas of third parties, but enclosed by pieces of land belonging to the defendants themselves. 74. In the present file, the defendants have five as private persons in their private domain surveillance cameras installed. Under section 2.2. and 2.3. of the present decision, the Disputes Chamber already stressed that a video surveillance system under the provisions of the GDPR, when the equipment used makes it possible to collect personal data register and save. In this sense, the processing of personal data must be at all in accordance with the principles set out in Article 5 GDPR regarding personal data processing and meet one of the conditions for a lawful processing under Article 6 GDPR. 75. The complainants have not in any way consented to the processing of their personal data within the meaning of Article 6 (1) point a) GDPR; this is also not claimed by the defendants. No other condition for the lawfulness of the processing in Article 6 (1) GDPR is possible in this context, unless point f) of that provision. 76. In particular, it should be emphasized that Article 6 (1) (e) GDPR in the present case is not application. After all, none of the defendants had any obligation whatsoever to exercise a task in the public interest, let alone give the defendants a task in the within the framework of the exercise of official authority. In other words: the defendants did not have any task in the public interest that made it necessary 13 For an analysis of the possible processing bases in the context of video surveillance systems, see EDBP Guidelines 3/2019 (version 2.0) as adopted on January 29, 2020, Guidelines 3/2019 on the processing of personal data through video equipment available at: https://edpb.europa.eu/our-work-tools/our- documents / guidelines / guidelines-32019-processing-personal-data-through-video_en (hereinafter: Guidelines EDPB 3/2019), 10 et seq. 16 to place surveillance cameras, and the images with personal data that the register surveillance cameras. 77. For the sake of completeness, it can also be pointed out that Article 6 (1) (c) GDPR is mutatis mutandis mutandis does not apply, as there is no legal obligation on the defendants to i.a. to install the surveillance cameras and to process personal data in this way. 78. The Court of Justice has confirmed that, in the absence of any consent or any other legal basis, the legitimate basis "legitimate interest" on the basis of Article 6 (1) point f) GDPR. 4 Specifically, the Court of Justice states with regard to that ground of lawfulness under the previous European Directive on personal data protection: “In this context, there are three cumulative in Article 7 (f) of Directive 95/46 conditions that must be met in order for the processing of personal data is lawful, namely, in the first place, the promotion of a legitimate interest of the controller or of the third parties to whom the data are disclosed, in the second place, the necessity of the processing of personal data for the purpose of processing of the legitimate interest and, thirdly, the fact that the fundamental rights and freedoms of the person involved in data protection prevail (judgment of 4 May 2017, Rigas satiksme, C-13/16, EU: C: 2017: 336, paragraph 28). ”15 79. In other words, data controllers must demonstrate that: 1) the interests that they pursue with the processing can be justified recognized (the “target test”); 2) the intended processing is necessary for the realization of those interests (the “Necessity test”); and 3) the balancing of those interests against the interests, fundamental freedoms and fundamental rights of data subjects weighs in favor of the controllers or of a third party (the “balancing test”). 14 Compare the analysis of the former Directive mutatis mutandis with the GDPR in Asociación Nacional, para. 40 and 42. 15 Ibid., Par. 40. 17 1. The target test 80. The Disputes Chamber can determine that the defendants are in concrete terms justified had an interest in placing the surveillance cameras on their private domain in order to prevent the protection of the property, health and life of the defendants and their family members or other third parties. 81. The European Data Protection Board (hereinafter: the EDPB) has indicated earlier that burglary, vandalism or theft are examples of situations requiring video surveillance 16 justify. The legitimate interest of the defendants must be are real and relate to a current problem. 17 The damage to the property of the defendants in the period before the installation of the surveillance cameras, show in themselves that this is a current and existing - and therefore not a purely hypothetical - interest. 2. The necessity test 82. In the context of camera surveillance systems, the Court of Justice has underlined that these condition must be examined in conjunction with the principle of “minimal data processing ”, which is currently stipulated in Article 5 (1) point c) GDPR. 18 Personal data must be adequate, relevant and limited to what is necessary is for the purposes for which they are processed. 83. The Disputes Chamber now proceeds to the analysis per disputed security camera in order to establish whether or not the processing of the personal data by means of those cameras is considered can be considered necessary. a) Camera facade 84. First, on a still image in the camera's complaint, there is "facade" a piece of land can be seen next to the garden at the front of the defendants that constitutes the "front garden". On a camera image that the complainants transferred to the Dispute Chamber, it can be seen that the security camera was aimed so that about a third of the image is on the public road 16 Guidelines EDPB 3/2019, par. 19. 17 Guidelines EDPB 3/2019, par. 20. 18 Judgment Asociación Nacional, para. 48. 18 (as an unenclosed place). This can also be seen in the still images in the complaint and the statement of reply of the defendants. This at the time before the positioning of the surveillance cameras were changed by the defendants. 85. The Disputes Chamber finds that the extensive and constant filming of the public road is not can be seen as “relevant”, let alone “necessary” for the defendants to safeguard their legitimate interests mentioned above. 86. Such an arrangement of a surveillance camera can hardly correspond to the principle of minimal data processing. The defendants argue that the turning the surveillance camera results in a reflection of the image, “so a large part of the camera surveillance misses its target, especially at night […] From the images that before, it appears that the company [X] 9 has set the cameras to be owned by conclusions was maximally secured. ” 20 87. That the surveillance cameras are set up in a way that is not as necessary and in compliance with the principle of data minimization remains the responsibility of the defendants as controllers. A technically unpleasant consequence is therefore not possible here Form "escape route" to obtain lawful processing. Such a route is also not provided by any legislator. 88. How the company [X] installs the surveillance cameras and, if necessary, incorrectly is a contractual matter that does not preclude the application of the GDPR and the associated consequences and responsibilities of the controllers. 89. That the surveillance cameras were adjusted after the visit of the police officer, does not matter prejudice the initial infringement. Incidentally, the Disputes Chamber does not rule on the accuracy of the statements of the police officer; it only checks the provisions of the law (in this case the GDPR) to the actions of the controller. 90. In any case, with the wrong placement of the camera, the first defendant has "facade" undisputedly the personal data of, in particular, the first complainant processed by them register and store, as well as pass on this personal data to the Traffic expert. 19D.i. the company that installed all surveillance cameras for the defendants. 20 Statement of reply of the defendants, document 10. 19 91. For the sake of completeness, it can also be noted that Article 8/2 of the CCTV Act is the King allows to establish places where surveillance cameras may be aimed at the perimeter directly around a given place. 92. The Royal Decree of 6 December 2018 determining the places where the controller can direct his surveillance cameras at the perimeter directly around the place, the images from the surveillance cameras for three months can save and give real-time access to the images to the police forces (B.S. December 18, 2018, hereinafter Royal Decree Extended Perimeter) determines in Article 2 in which Fallen security cameras can be aimed at the perimeter around the site. 93. The Royal Decree Extended Perimeter does not offer the defendants the opportunity to submit their surveillance cameras on the perimeter (i.e. not the private domain of the defendants) around the instead of aiming the cameras. The places specified in the Royal Decree are often places that pose a risk and where the filming of the extended perimeter de public safety or public interest (and a contrario, not purely private interests). 94. In this sense, it can be such extensive and constant filming of the public road, as shown the images in the file presented by the defendants themselves are not regarded as necessary for the processing of personal data when using the surveillance cameras. b) Shed front camera 95. According to the defendants, the camera "front shed" films a "limited part of the owned by [the complainers], more precisely the driveway and part of the large automatic gate. ” This at the time before the positioning of the surveillance cameras became amended by the defendants. 96. The national legislature (in Article 7 of the Camera Act) has installed these for the surveillance cameras in "closed places not accessible to the public" a provision is provided for that filming a "non-enclosed place" or a "publicly accessible enclosed place" subject to stringent conditions in accordance with the principle of minimal data processing. In this sense it can be assumed in an a fortiori line of reasoning property of private persons or private companies should in any case not be filmed turn into. 20 97. Here too, Article 8/2 Camera Act cannot be applied, for the same reasons as above set forth under the analysis of necessity for camera "facade". 98. The Disputes Chamber does not rule out this in certain - very exceptional - cases property of third parties could be lawfully filmed within the meaning of Article 6, paragraph 1 GDPR. More specifically, situations in which the third party owns the private domain gives her or his permission to install a security camera that films her or his property, when the person who installs the security camera at no can protect its property in some effective way without entering another private domain image. 99. In this case, there is no such consent; the complaint proves the contrary. Moreover none of the documents in the file appears to have any other necessary reason, for filming parts of the complainants' property. 100. Indeed, the 'front shed' camera films only a very limited part of the property of the complainants, it appears from the images submitted by the defendants, which predate the adjustment of the position of the surveillance cameras. That is why it can be questioned be why it would be somewhat necessary to have this limited portion of the property of the complainants was portrayed. 101. In this sense it can be - albeit limited but constant - filming of the private domains of the complainants, as is apparent from the images in the file presented by the defendants themselves, where personal data are processed, are not seen as necessary for the processing of personal data when using the surveillance cameras c) Other surveillance cameras 102. The complainants did not produce any documents with regard to the other surveillance cameras submitted in the complaint. However, in the reply of the defendants images taken from before the repositioning of the surveillance cameras, from which not can be determined that these surveillance cameras are slightly different places than it private domain of the defendants themselves. It's about the surveillance cameras "street side", "garage" and "rear shed". 21 3. The balancing test 103. Although not passing the "necessity test" is already sufficient to establish state that the processing of personal data by means of the surveillance cameras 'facade' and "front shed" took place unlawfully, the Disputes Chamber is investigating unnecessarily or the existence of fundamental rights and freedoms in data protection the persons concerned (the complainants) may or may not prevail over the legitimate interests of the defendants. 104. That balance depends on the particular circumstances of a particular case and the rights of the complainants concerned under Articles 7 and 8 of the Charter of the European Union with regard to the protection of privacy and 21 data protection. 105. In that sense, the seriousness of the infringement of rights and freedoms of the complainants as an essential part of the analysis. 22 In doing so can be noted that the continuous mapping of the public road, this is 24 hours a day hours and 7 days out of 7 days, constitutes a serious violation of these fundamental rights. This applies at least equally for the private domains of the complainants and is all the more the case when a other, less intrusive processing appears to be possible, given the adjustment of the position of the surveillance cameras. 106. In addition, there are also many others involved, such as the children of the complainants, or drivers of vehicles passing on the public road in front of the house defendants, whose rights are also being violated in this regard. 107. It can also be pointed out that it is beyond the objective expectations of those involved it falls that the two aforementioned surveillance cameras are positioned in such a way, constantly filming part of the public road and the private domain of the complainants. 23 This is the case, among other things, because the surveillance cameras are not in accordance with the provisions regarding the installation of surveillance cameras under national law (de Camera Act) were placed. 108. For all these reasons, the security cameras "front facade" and "front shed" also withstand the balancing test is not. 21 Judgment Asociación Nacional, par. 52; Guidelines EDPB 3/2019, par. 32-35. 22 Ibid., Par. 56. 23 With regard to these "objective expectations", see EDPB Guidelines 3/2019, par. 36. 22 4. Conclusion 109. The security cameras "front facade" and "front shed" have images with unlawfully processes personal data, which constitutes an infringement of Article 6, paragraph 1 GDPR, now that there are legitimate interests for the defendants within the meaning of point f) of that standard, but the concrete processing operations are not necessary for the safeguarding those interests, and the fundamental rights and freedoms of the complainants and other stakeholders outweigh those interests. 2.4.2. The transfer of the camera images with personal data to the Traffic expert 110. As in section 2.3. already determined by the Disputes Chamber, are for this transfer the defendants are responsible as joint controller in their view both act as parties to the Environmental Proceedings, and they say together the Have addressed a traffic expert and transferred the images in this context (supra). 111. At the hearing, defense counsel argues that, in the context of the Environmental Procedure, camera images were allowed to be transferred to the Traffic Expert , given that Traffic Expert can be seen as part of the "Judicial authorities" within the meaning of Article 9, paragraph 1, fourth paragraph, 1 ° Camera Act. 112. Article 9 CCTV Act does not apply in this situation. 113. Contrary to what the defendants argue, the Traffic Expert is not involved out of the "judicial authorities," as he was appointed by order of the defendants themselves, and this moreover in the context of an administrative appeal procedure. 114. The question remains - partly in view of the inapplicability of Article 9 of the CCTV Act - whether in the defendants nevertheless have a legitimate interest in the images to pass on to the Traffic Expert with the aim of visualizing the mobility situation in the immediate vicinity of the property of the complainants under the Environmental Procedure. 115. Now the Disputes Chamber in section 2.4.1. has come to the conclusion that the images made with the surveillance cameras "front facade" and "front shed" illegal processing of personal data, it appears in itself that these images are not 23 could be submitted to the Traffic Expert. After all, this transfer is then also unlawful within the meaning of Article 6 (1) GDPR. 116. The assignment that the Traffic Expert received from the defendants showed the transfer moreover just around the images - and the associated processing of personal data - that were made from public roads, albeit the private domains of the complainants. 117. The transmission of the images made with the surveillance cameras to the Traffic Expert by the defendants does not constitute lawful processing within the meaning of Art.6 para. 1 GDPR, and therefore constitutes an infringement of that legal provision. 2.4.3. Taking pictures of the public road in case of an (alleged) crime is committed, or when a mistake is made in any other way that causes nuisance flows 118. In the complaint, an image is added that from the private domain of the defendants portrays the public road and the private domain of the complainants, the former the complainant is visible while apparently carrying a […]. 119. The complainants believe that this is a screenshot of an image taken with one of the defendants' surveillance cameras, but the latter deny this. They argue that this image was taken with a smartphone from the home on the private domain of the defendants by one of them. The technical framing by the defendants appears in this regard to be correct. 120. Then the question remains whether the making of such an image constitutes a lawful processing within the meaning of Article 6 (1) GDPR. 121. The defendants believe that the photo could be taken as they believe it transporting a […] possibly constitutes an (environmental) crime. The defendants are of the opinion it is necessary to collect evidence of an infringement (suspected or otherwise) to report this to the competent services, authorities or judicial authorities or complain. The defendants appear to have done this in the present case by notifying the Federal Agency for the Safety of the Food Chain (FASFC), which is also a investigation started. 24 122. In the context of safeguarding public and private security, the defendants therefore have a legitimate interest within the meaning of Art.6 para. 1 lit.f GDPR to take the picture. After all, they assumed in good faith that the transport of a […] does indeed constitute an (environmental) crime, which is why their notification to the FASFC illustrates. 123. Although the Dispute Chamber refers to public safety in this regard, it should be emphasized that this in no way means that Article 6 (1) (e) GDPR in the present case would find application. After all, none of the defendants had any obligation whatsoever to exercise a task in the public interest, let alone give the defendants a task in the within the framework of the exercise of official authority. In other words: the defendants were under no obligation to provide evidence of the (alleged) environmental crime by taking a picture and processing it accordingly personal data; this would be different in the case of judicial authorities or others competent authorities provide evidence, through images that contain, collect and further process personal data. 124. The damage resulting from such a crime (i.e. environmental pollution) would not only affect the society, but also directly affect the private interests of the defendants, in their view reside next to the complainants, including the first complainant transports it […]. In that sense was taking the photo as processing of personal data (of the first complainant) also necessary for safeguarding those legitimate interests of the complainant because it may serve as evidence of the alleged crime. 125. Finally, it can also be mentioned that taking that photo does not seem so intrusive for the interests or fundamental rights and freedoms of the first complainant, that these outweigh the legitimate interests of the defendants holding the photo, as the defendants had a good faith belief that there was a crime was committed. Moreover, the position of the camera that took the image was such aimed at visualizing only the (alleged) crime on the public road. It taking the photo as processing of personal data therefore also passes the balancing test. 126. For all the foregoing reasons, taking a one-time photo was with a smartphone, as shown in the complaint and where the first complainant is visible, as a direct response to seeing an alleged crime (as opposed to the constant filming by surveillance cameras of part of the public road or private domain), a lawful processing within the meaning of Article 6 (1) point f GDPR, and none of the 25 defendants commit an infringement of this article in relation to this fact. 2.5. Data protection by design (Article 25 GDPR) 127. In the GDPR, the European legislator has provided an article 25, containing the concepts "Data protection by design" and "data protection by default" ("DPbDD"), in Dutch respectively "data protection by design" and "data protection by standard settings'. The Disputes Chamber hereafter uses the abbreviation DPbDD when the deals with both concepts at the same time. 128. Article 25 GDPR reads: “1. Taking into account the state of the art, the implementation costs, and the nature, scope, context and purpose of the processing as well as the qua likelihood and severity varying risks to the rights and freedoms of natural persons associated with the processing, the controller, both in determining the processing means and in the processing itself, appropriate technical and organizational measures, such as pseudonymisation, which are created with the aim of the data protection principles, such as data minimization, on one effective manner and put in place the necessary safeguards in the processing construction to comply with the requirements of this Regulation and for protection of the rights of the data subjects. 2. The controller takes appropriate technical and organizational measures to ensure that, in principle, only personal data are made that are necessary for each specific purpose of the processing. That obligation applies to the amount of personal data collected, the extent to which they are processed, the period for which they are stored and the accessibility thereof. In particular, these measures ensure that personal data in principle not without human intervention for one unlimited number of natural persons are made accessible. 3. A certification mechanism approved in accordance with Article 42 may used as an element to demonstrate compliance with the requirements of paragraphs 1 26 and 2 of this article have been met. ” 24 129. The EDPB has guidelines on DPbDD in accordance with Article 70 (1) (e) GDPR 25 issued. 130. Data protection by default refers, according to the guidelines, to the terminology used in computer science, and refers to a pre-existing one or pre-selected value of an adjustable setting within a software 26 application. 131. To the situation in this file with regard to the placement and positioning of the surveillance cameras, data protection by design should be considered. 132. The purpose of data protection by design, according to the EDPB, is to protect of the rights of data subjects and ensure the protection of their 27 personal data ("built-in") is specific to the processing. It is important here that the "Appropriate measures" that a controller must take are intended that data protection principles are effectively built in so that the risks of violations of the rights and freedoms of data subjects are limited. 28 133. It is important to note that for the purposes of the data protection by design does not require actual processing to take place. However, it is the specific nature of installing surveillance cameras and filming with those surveillance cameras, which requires taking appropriate technical and organizational measures with the aim, inter alia, of data protection principles effectively to apply, as well as to ensure the protection of potential data subjects, would be one processing of personal data. 24 See also recital 78 GDPR in this regard. 25EDBP Guidelines 4/2019 of 13 November 2019, Guidelines on Article 25 Data Protection by Design and by Default, available via: https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_201904_dataprotection_by_design_and_by_default.pdf (hereinafter: EDPB Guidelines 4/2019). 2EDPB Guidelines 4/2019, par. 39. See also ibid., Par. 40: “Hence, 'data protection by default' refers to he choices made by a controller regarding any pre-existing configuration value or processing option that is assigned in a software application, computer program or device that the effect of adjusting, in particular but not limited to, the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. ” 27EDPB Guidelines 4/2019, par. 7. 28EDPB Guidelines 4/2019, par. 14 et seq. 27 134. In this sense, there will also be at least one controller for, among other things, the placing the surveillance cameras, and providing data protection by design cfr. Article 25 (1) GDPR by that controller, regardless of whether the posting of which results in surveillance cameras in the processing of personal data. To be these both defendants are joint controllers within the meaning of Article 26 GDPR, as determined in section 2.3. 135. The legal provision on data protection by design, Article 25 GDPR, states expressly the importance of taking effective measures to give effect to the principle of minimal data processing. The controller must after all, checking whether there is a need to process personal data. 29 136. When filming the public road and private domains, there is almost absolute certainty that personal data, and probably a large number of personal data, will become processed. This is also evident from the fact that the defendants in the Environmental Procedure the have used camera images from, among other things, the camera 'front facade' to vehicles and visualize their behavior. The same risk applies to private domain filming (like that of the complainants), which happens with the camera 'front shed'. 137. In section 2.4. of the present decision, the Disputes Chamber concluded that unlawful processing took place because of the position of certain surveillance cameras. By their nature, these unlawful processing operations are sufficient in themselves indicates that insufficient measures have been taken by the defendants to take the necessary take measures to comply with the data protection principles of the GDPR, and thus constitutes an infringement of Article 25 (1) GDPR. 138. It is of the utmost importance that the continuous filming of such places (cf. par. 136) is done with due care and restraint and in accordance with the legal provisions in this regard, which is not the case in this case. 139. For all of the above reasons, the defendants infringed Article 25 (1) GDPR by the placement of the surveillance cameras "front facade" and "front shed". 29 EDPB Guidelines 4/2019, par. 69. 28 2.6. Sanctioning the infringements 140. The Disputes Chamber finds the following infringements on the part of the defendants: a.Article 6 (1) GDPR, in view of the processing of personal data, and more the determines the personal data of the first complainant in the present case, using the security camera "front facade" 30 and security camera "front shed", at 31 happened unlawfully, where personal data was collected at the filming of public road 32 and filming of private property 33 of third natural persons; b. Article 6 (1) GDPR, given the defendants unlawful image material pass it on to the Traffic Expert, in the context of the Environmental Procedure between the complainants and the defendants, in particular the personal data of the former the complainant were processed unlawfully, after which that material with personal data of the first complainant was provided by the Traffic Expert made available through an online platform; c. Article 25 (1) GDPR, given that the defendants do not have adequate measures affected when installing their surveillance cameras, especially the cameras "Front facade" and "shed front", so that these are the data protection principles, and in particular data minimization, compliance, to protect the rights of involved. 141. The Disputes Chamber notes that the current positioning of the said security cameras has stopped the violations, and therefore decides only one reprimand and impose an administrative fine for the aforementioned infringements (infra). 30 The name of the surveillance cameras is the same as that used by the defendants in their statement of reply dated. 27 November 2019, first indicated at the bottom of page 6. 31 Ibid. 32 Compare: the public road as an "open space" within the meaning of Article 2, 1 ° of the Law of 21 March 2007 regulating of the placement and use of surveillance cameras (Belgian Official Gazette 21 May 2007), hereinafter the Camera Act. 33 Compare: private property as "closed place not accessible to the public" within the meaning of Article 2, 3 ° CCTV Act. 29 34 142. Taking into account article 83 GDPR and the case law of the Marktenhof, the Dispute Resolution Chamber imposing an administrative sanction for the two infringements Article 6 (1) GDPR in concrete terms: Duration The fact that from the initial placement of the surveillance cameras to changing the position of the surveillance cameras continuously unlawfully personal data were processed with the two mentioned surveillance cameras, that implies the infringements have taken place over many months. 35 As for the transmission of the footage from the two surveillance cameras to the Traffic expert, images taken in November 2018 appear to be used by the defendants in the context of the Environmental Procedure. The phase of the However, the environmental procedure in which the Traffic Expert was appointed dates back to not until April 12, 2019, more than five months after the images were taken. The fact that the footage was kept for so long, and then further processed, also points out here on a term of preservation of unlawfully made images, which apparently is excessive, while those images in the first place have already been made unlawfully became. Ernst The violated provisions are at the heart of the General Regulation Data protection, in particular the lawfulness of the processing. The defendants say they used a firm specialized in installation surveillance cameras - however, the defendants themselves remain responsible for the processing operations for which they determine the purpose and means on the basis of Article 5 (2) and article 24 GDPR. The defendants and the complainants are engaged in different disputes before different ones government agencies, with the defendants arguing that the complainants also determined have committed personal data breaches - this justifies, however 34 Brussels Court of Appeal (section Marktenhof), X t. GBA, Judgment 2020/1471 of 19 February 2020. 35 The surveillance cameras were installed, according to the defense statement of the defendants, p. 6, “in the autumn of 2018” - the registration of the surveillance cameras in the e-counter of the FPS Home Affairs dates from October 2018; the repositioning of the surveillance cameras was reported by the defendants to the police officer in November 2019, according to the complainants at the end of September 2019.30 by no means own violations of laws and regulations, let alone impunity implies by the supervisory authority. The defendants have already set up several of their surveillance cameras changed, after an intervention of the community police officer, thus changing the current arrangement of the surveillance cameras (including the two where violations are detected) less risk implies for the interests, freedoms and fundamental rights of third natural persons who could be filmed. The Disputes Chamber also takes into account that the defendants are private citizens are apparently not pursuing commercial interests in the processing of the personal data. Violations of Article 6 GDPR give rise to the highest fines in Article 83 (5) AVG. With regard to the setup of the surveillance cameras and the personal data processing with those cameras, the Disputes Chamber takes into account what the defendants say regarding compliance by them with national legislation (in particular the Camera Act) and the advice from the security firm as a contractual partner. The defendants themselves argue that the cameras were set up in such a way that it was owned by [defendants] was given maximum protection. ” 36 However, it is apparent from all the elements of the file that sufficient account was not taken with the implications of CCTV for personal data protection third parties involved, the complainants. Number of people involved With regard to the number of parties involved, the Disputes Chamber wishes to remind you that misplacing surveillance cameras, and subsequent processing of personal data through the images of such cameras, when on public roads or private domains are mapped, a large number of data subjects are affected by their rights. Children can also be involved in this, something where the GDPR, inter alia in Article 6 (1), point f) GDPR, paid additional attention. 36 Reply statement of the defendants dated. November 27, 2019, p. 3; the Disputes Chamber underlines. 31 It is important the personal data of such a large number (for the defendants perhaps unknown number) to process data subjects with the greatest caution, and ten at least in accordance with data protection regulations. Sufficient deterrent effect An administrative fine of EUR 1,500 is sufficient for the Disputes Chamber deterrent amount to prevent further breaches, given the response to it penalty form of the defendants dated. November 17, 2020. 143. The Disputes Chamber points out that the other criteria of art. 83.2. AVG in this case not nature that they lead to an administrative fine other than that which the Dispute Resolution Chamber has established within the framework of this decision. 144. On October 27, 2020, the Disputes Chamber filed a form for response against intended fine to the defendants, which was notified to the defendants that the Disputes Chamber intended to impose a fine of 2,000 on them EUR. The elements that the defendant subsequently put forward in its response to this form, are included in the deliberations by the Dispute Chamber. In addition, the take particular account of the defendant's financial strength. 145. Given the importance of transparency with regard to the decision-making of the Disputes Chamber, this decision is made in accordance with Article 100, §1, 16 ° WOG published on the website of the Data Protection Authority with the omission of the identification data of the parties, given that identification data is not necessary and relevant in the publication of the decision. 32 FOR THESE REASONS, the Disputes Chamber of the Data Protection Authority will, after deliberation, decide to issue the defendants: on the basis of Article 58, paragraph 2, point b) GDPR and Article 100, §1, 5 ° WOG to be reprimanded for the infringement of Article 25 (1) GDPR; b. on the basis of Article 83 GDPR and Articles 100, 13 ° and 101 WOG an administrative one a fine of EUR 1,500 to be imposed on the defendants for the infringements of article 6 GDPR. The defendants are jointly and severally liable to pay the aforementioned amount. Against this decision on the basis of art. 108, §1 WOG, appeals are lodged within one term of thirty days, from the notification, at the Marktenhof, with the Data protection authority as defendant. (get.) Hielke Hijmans Chairman of the Disputes Chamber