APD/GBA - 74/2020

From GDPRhub
APD/GBA - 74/2020
LogoBE.png
Authority: APD/GBA (Belgium)
Jurisdiction: Belgium
Relevant Law: Article 6(1)(f) GDPR
Article 25(1) GDPR
Law of 21 March 2007 regulating the positioning and use of video surveillance cameras
Type: Complaint
Outcome: Partly Upheld
Decided: 24.11.2020
Published: 24.11.2020
Fine: 1500 EUR
Parties: n/a
National Case Number/Name: 74/2020
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Dutch
Original Source: Data Protection Authority (in NL)
Initial Contributor: n/a

The Belgian DPA (APD/GBA) imposed a fine of € 1500 on a private individual for the unlawful filming of public roads and private property of third parties with surveillance cameras, and for illegally sharing images taken from this system in breach of Article 6(1)(f) GDPR.

There were legitimate interests for the defendants to install surveillance cameras to protect their own private property. But the way those surveillance cameras were positioned and the fact that they were constantly monitoring was not deemed necessary to safeguard those legitimate interests. The DPA moreover found the interests of the defendants to process personal data through the surveillance cameras to be overridden by the interests of the complainants and other data subjects.

On the contrary, the taking of a one-off photograph with a smartphone, as a direct response to seeing an alleged offence, was seen as constituting a lawful processing within the meaning of Article 6(1)(f) of the GDPR.

English Summary[edit | edit source]

Facts[edit | edit source]

A couple has installed a video surveillance system on their property. The couple's neighbors lodged a complaint because some of the cameras were placed in such a way that they were filming part of the public road as well as their private property, and had filmed the complainants while driving on the public road or entering private property of their own. The complainants asked that the video surveillance system would be taken down.

The complainants also opposed the further use of the recordings made by the video surveillance system, which were subsequently shared by the defendants with an expert in the context of another (environmental law) dispute between the defendants and the complainants.

The defendants took a photograph of the complainants with a smartphone, to establish an alleged breach of environmental law. The complainants also fought the making of such photograph and the further processing thereof.

Dispute[edit | edit source]

Is the processing of personal data included in photographs and camera images lawful under Article 6(1)(f) of the GDPR?

Holding[edit | edit source]

First of all, the DPA recalls that:

- a video surveillance system falls under the provisions of the GDPR when the equipment used makes it possible to collect and store personal data;

- such processing of personal data must at all times be consistent with the principles of data protection found in Article 5 of the GDPR, and fulfill one of the lawful bases for processing as set out in Article 6 of the GDPR.

Recording and use of images from the surveillance cameras[edit | edit source]

As the complainants had not given their consent to the processing of their personal data, no other condition for the lawfulness of processing was possible in this context, except the "legitimate interests" under Article 6(1)(f) of the GDPR.

The Belgian DPA therefore conducts a "legitimate interests assessment" by following the three-part test:

Purpose test[edit | edit source]

Is there a legitimate interest behind the processing?

The DPA found that the defendants had a legitimate interest in placing the surveillance cameras in order to ensure the protection of their property and fight burglary, vandalism or theft. The damages caused to the goods belonging to the defendants in the period prior to the installation of the surveillance cameras show that the legitimate interest on the part of the defendants was moreover real and currently existing (and therefore not a purely hypothetical).

Necessity test[edit | edit source]

Is the processing necessary?

The DPA found that some surveillance cameras were set up in a way that cannot be regarded as necessary and in accordance with the data minimisation principle. The extensive and constant filming of the public highway cannot indeed be regarded as 'relevant', let alone 'necessary', for the defendants to safeguard their legitimate interests.

Balancing test[edit | edit source]

Is the legitimate interest overridden by the fundamental rights and freedoms of the data subject?

The surveillance cameras also did not withstand the weighting test, considering the seriousness of the infringement of the rights and freedoms of the complainants.

To come to this conclusion, the DPA pointed out that:

- Continuous monitoring of the public highway, i.e. 24 hours a day, 7 days a week, constitutes a serious breach of the fundamental rights of the complainants. This also applies to the continuous monitoring of private domains of the complainants.

- This is all the more true when other less intrusive processing proves possible, by adjusting the position of the surveillance cameras.

- The rights of many other people were violated, such as the complainants’ children, or drivers of vehicles passing by on public roads in front of the defendants’ homes.

- It is beyond the objective expectations of the data subjects concerned by the surveillance cameras.

- The surveillance cameras were not installed in accordance with the provisions on the installation of security cameras under national law (law of 21 March 2007 regulating the positioning and use of video surveillance cameras).

The DPA Litigation Chamber therefore upheld that the images made by the surveillance cameras were not processed in a lawful way under Article 6(1)(f) GDPR. Those unlawful processing operations were, by their very nature, sufficient in themselves to show that insufficient measures have been taken by the defendants to respect the data protection principles of the GDPR, and therefore also constitute an infringement of Article 25(1) of the GDPR.

Transmission of the images to third parties[edit | edit source]

According to the DPA, the transmission of the images made by the surveillance cameras in the context of the environmental law litigation also constituted a breach of article 6.1(f) of the GDPR, as the images were unlawfully made in the first place, thus constituting unlawful processing impacting the further processing.

Taking of photographs in the event of an (alleged) offence[edit | edit source]

On the other hand, the making of a picture and the further processing thereof, was judged lawful under Article 6(1)(f) of the GDPR, as the processing was necessary for the defendants to safeguard a legitimate interests (i.e. to collect evidence of an infringement and bring this to the attention of the competent authorities), and did not appear to be so intrusive for the fundamental rights of the data subjects to outweigh the legitimate interests of the defendants. The taking of the photograph therefore withstood the assessment test.

The DPA Litigation Chamber therefore imposed a fine of € 1500 for the infringements of Article 6 of the GDPR. In addition, it issued a reprimand to the defendants for not respecting article 25.1 of the GDPR while placing their video surveillance system.

Comment[edit | edit source]

This fine is a reminder that the GDPR does not only apply to companies, but also to citizens who process personal data outside the strictly domestic context.

The defendants claimed that they had engaged the services of a security firm specialized in placing of surveillance cameras, but the DPA pointed out that the defendants remain however responsible for the processing operations for which they determine the purpose and means. The way in which the company (incorrectly) installs the surveillance cameras is a contractual matter that does not oppose the application of the GDPR and the associated responsibilities of the data controller.

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

                                   Litigation chamber



                                   Decision on the merits 74/2020 of 24 November

                                   2020












File number: DOS-2019-04412



Subject: Complaint for unlawful filming of the public road and private domain

of third parties with surveillance cameras.





The Disputes Chamber of the Data Protection Authority, composed of Mr Hielke

Hijmans, chairman and Messrs. Dirk Van Der Kelen and Frank De Smet, members;



Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data and repealing Directive

95/46 / EC (General Data Protection Regulation), hereinafter GDPR;



In view of the law of 3 December 2017 establishing the Data Protection Authority, hereinafter

WOG;



Having regard to the rules of internal procedure, as approved by the Chamber of

Representatives on December 20, 2018 and published in the Belgian Official Gazette on

January 15, 2019;



Considering the documents in the file;






                                                                                                     .

                                                                                                     .

                                                                                                     . 2



has taken the following decision regarding:

    - X1, hereinafter referred to as “the first complainant”, and X2, hereinafter referred to as “the second complainant”,

        both natural persons domiciled in […] and hereinafter jointly referred to as “the

        complainers ”, and,

    - Y1, hereinafter referred to as “the first defendant” and Y2, hereinafter referred to as “the second

        defendant ”, both residing in […] and hereinafter jointly referred to as“ the defendants ”.





    1. Facts and procedure



    1. On August 26, 2019, the complainants file a complaint with the Data Protection Authority.



    2. The complaint can be summarized as follows. According to the complainants, three surveillance cameras are filming

        of the defendants, the “entire domain” of the complainants. One camera would also “it

        full street scene ”. In the context of environmental law proceedings between the

        the complainants and the defendants, in particular in the context of an application for regularization by the

        complainants, images from the defendants' surveillance cameras were brought to the notice of the

        complainants brought in by a third party, expert engineer Z. Those images were, according to

        the complainants not only provide evidence for unlawful filming of public and private roads

        property of third parties, but also of the unlawful transmission of the recordings of those

        images to unauthorized third parties.



        The environmental law procedure at the Environment Department that followed from the dispute

        regarding the regularization application, is hereinafter referred to as “the Environmental Procedure”.



        The expert engineer Z appointed in the context of the Environmental Procedure is hereafter

        Called “the Traffic Expert”.



    3. The complaint also mentions that a complaint was made to the local police about the same

        facts.



    4. In accordance with Article 58 of the WOG, the Primary Service of the

        Data Protection Authority on September 6, 2019 the complaint admissible. On the basis of

        Article 62, §1 of the WOG, the complaint is subsequently transferred to the Disputes Chamber.



    5. By registered letter dated September 24, 2019, the complainants and defendants will be notified of the

        informed of the decision of the Disputes Chamber to close the file in accordance with 3



        treat article 95, §1, 1 ° WOG on the merits. In the registered letter are also

        the closing deadlines communicated to the parties in accordance with Articles 98 and 99 WOG.




Conclusion of the defendants' reply



    6. The defendants point out that the way in which the surveillance cameras are filming, “was instituted

        by the company that installed the cameras. ” According to the defendants, the aim was purely

        securing their property, “and not the public domain nor the property of it

        to target the applicants. "



    7. The defendants insert screenshots of the video images captured by the said

        surveillance cameras at their conclusion. The images predate the adjustments of the

        state of the surveillance cameras that the police officer had asked to make.



    8. The surveillance cameras have different names.



    9. First, there is a security camera "front shed", which according to the defendants is only

        a limited part of the property of the complainants is filmed, but not the home of the complainants

        self.



    10. Second, the security camera "front facade" films the front garden, part of the facade and

        part of the public road. On the image added by the defendants

        more than a third of the security camera image is taken up by the public road

        which is before the defendants' house. The defendants cite that the bottom line

        more this security camera was changed after the visit of a local police officer, after which the

        camera image - at least on the basis of the still image added by the defendants - for

        more than half only depict the wall of the facade, only a limited part

        of the defendants' front yard and porch, and in no way the public road

        pictures. By adjusting the position of this security camera after the visit

        of a local police officer, are the images that are captured in the dark by the reflection

        of the light from the "night mechanism" of the security camera, de facto useless, said

        the defendants.



    11. Third, there is the security camera "street side". The defendants argue: “de haag die for

        the camera is placed on the street side prevents this camera from filming on the street. ”

        Again, the security camera would, after resetting the position of the

        security camera, de facto become unusable at night, because more than half of 4




        what is portrayed concerns the brick facade, which is the light from it

        night mechanism of the surveillance camera is reflected in the lens.



    12. The photo attached to their complaint by the complainants with the mention "camera

        garages', according to the defendants, is not an image of a security camera, but a photo

        taken with a smartphone.



    13. The defendants also argue that they are “installing and using the

        camera surveillance system indicated [have] electronically via the e-counter for

        the declaration of surveillance cameras by the Federal Public Service Internal Affairs

        is made available. "



    14. The defendants also argue that the designation of the controller,

        according to the Camera Act, 1 clearly happened. The camera images, according to the

        defendants, would be erased after one month. However, “the images that the

        mobility impairments were saved and deleted after they were transferred

        to the traffic expert. ” The Traffic Expert used the images in the context of

        the analysis of any nuisance related to environmental law (mobility and other)

        by the complainants, and this in the context of the Environmental procedure. The Traffic Expert

        compiled the images, along with the report of his analysis, in the course of the

        Environment procedure available to the parties and the Environment Department.



    15. With regard to the images made available by the Traffic Expert


        in the context of his environmental report on the mobility situation, the defendants argue

        incidentally, that the council of mayor and aldermen of the municipality where the

        the complainants and defendants are resident, as well as the Environment Department as competent

        government appealed, the images were sent via a "SharePoint" web link.



        The defendants state in this regard: “The sharepoint in the

        management of the authorized traffic expert […] ”

        And further: “The images were erased by the [defendants] after they were presented to the expert

        handed over. ”

        The defendants also add that the Traffic Expert is now, “in response

        of the end of the administrative procedure [the Environmental procedure], the Sharepoint

        offline [has]. ”





1
 Law of 21 March 2007 regulating the installation and use of surveillance cameras, Belgian Official Journal 31 May 2007, hereinafter "Law
Camera surveillance'. 5



    16. As already mentioned, the defendants argue that the image attached to the complaint and

        according to the complainants, a camera image of the position is "garages", it was a photo

        was taken with a smartphone. The photo was taken by the defendants in their own words

        made to record a breach of environmental law: “a […] is considered

        as a […] that cannot just be dragged across the street and the sewage well, which the

        photo shows that this is happening. ”



    17. Finally, the defendants raise that, in the context of another environmental law

        dispute, the complainants themselves are unauthorized and possibly illegal (camera) images and / or photos

        turned the property of the defendants.




Reply of the complainants' reply



    18. In this Opinion, the complainants state that - by the defendants in the present

        procedure - another image was sent, this time to the Federal Agency

        for the Safety of the Food Chain and the “Cell Environmental Enforcement”. There is not

        specified what is meant by the latter.



    19. The complainants point out that there is indeed a camera "garages" and add

        conclusion photos of the defendants' home showing a camera above one

        garage door can be seen, which apparently does not replace the other three

        cameras.



    20. In addition, the complainants argue that the surveillance camera "street side" is indeed part of

        filmed the property of the complainants. Also with regard to the surveillance cameras 'front facade'

        and "front shed", according to the complainants, there is a breach of the law, just because the

        images were used in the Traffic Expert's investigation - following the

        Environmental procedure - which related to the mobility situation on public roads and

        access to the complainants' property by themselves or any visitors.



    21. In addition, the complainants point out that the retention periods have not been respected

        certain images used in the Environmental Procedure date from 11 November 2018, and only

        months later would have been passed on to the Traffic Expert. The complainers point out

        in addition, note that the Traffic Expert is not part of the police forces or

        judicial authorities. 6



    22. Finally, the complainants will discuss the Environmental Procedure, but the factual explanation is

        of no importance for the further handling of the complaint for the

        Data protection authority, and will not be included in this decision.




Statement of reply of the defendants



    23. The defendants' reply confirms, on the one hand, the content of the first

        conclusion of reply, but on the other hand introduces some new elements.



    24. First of all, the defendants argue that there were indeed five surveillance cameras

        registered via the e-counter of the FPS Home Affairs. According to the defendants

        the two other surveillance cameras not mentioned in the original complaint, and therefore not

        addressed in the reply conclusion. This specifically concerns a security camera

        "Back of shed" and a security camera "garage".



    25. The surveillance camera "garage" again films part of the front facade of the house, just

        such as security camera "facade". The defendants add a picture to their conclusion that

        according to them predates the adjustment of the positions of the surveillance cameras after

        a visit by the local police officer, involving a limited part (less than a third) of the image

        of the security camera filming the public road.



    26. The defendants do not get any picture of the surveillance camera "rear of the shed"

        transferred, because according to them the position of this surveillance camera is not a problem,

        neither for the property of the complainants, nor for the public road.



    27. According to the defendants, only images of the

        security camera "front facade" and security camera "front shed" transferred. This one

        After all, according to the defendants, images were relevant to certain mobility situations,

        relevant to the Environmental Procedure.



    28. The defendants emphasize that the company that installed the surveillance cameras

        security cameras so tried to establish the property of the defendants

        "Maximum security."



    29. The defendants also emphasize that the images from, among other things, the surveillance cameras that

        were handed over to the Traffic Expert, were indeed important to him

        report, and that this report was indeed used in the deliberations of the

        competent authority in the decision of the Environmental Procedure. 7






Hearing



    30. On November 12, 2019, the defendants, through their counsel, had requested

        to be heard.



    31. By Ministerial Decree of June 30, 2020 containing urgent measures to prevent the dissemination

        of the coronavirus COVID - 19 (Belgian Official Journal 06/30/2020), as amended by Ministerial

        Decree of August 22, 2020 (Belgian Official Journal 08/22/2020) was decided by the federal government to

        a number of coercive measures that made it difficult to hold a hearing in the

        normal setup.

        The Disputes Chamber therefore offered the parties the opportunity to attend the hearing, where the

        defendant in its claim asked to take place electronically.

        Both parties agreed and confirmed their presence.



    32. A hearing will take place on September 7, 2020, with the complainants and defendants present

        as well as counsel for the defendants.



    33. The details and additions were made in the minutes of the hearing

        adopted that are not a mere repetition of elements that recur in the

        previous documents, and in particular the claims of the parties, of the file.



    34. For example, the defendants have pointed out that they make the Traffic Expert an actor

        deem that falls under "judicial authorities" as referred to in the Camera Act.



    35. The defendants further argue that the offer to change the positioning of the

        the disputed security cameras had clearly been requested before the defendants were informed

        about the existence of a complaint to the GBA.



    36. As usual, the Disputes Chamber invited both parties to submit comments

        to have the report of the hearing added as an attachment to that report,

        without this implying a reopening of the debates. Both sides have responded to

        that invitation, and the responses and accompanying documents were attached to the trial

        verbally added to the file. 8



2. Justification



2.1 The scope of the proceedings on the merits before the Disputes Chamber




        a. The submission of new defenses and documents by the parties
           after the close of the debates




37. The Disputes Chamber finds that both parties have extensive additions and documents to it

    in response to the invitation of the Disputes Chamber for any

    to make comments on the official report.



38. The Disputes Chamber underlines that the aforementioned invitation was clearly worded,

    in the sense that the comments should not constitute a reopening of the debates. The

    invitation merely offers the parties the opportunity to provide factual comments on
    what is formulated in the official report.



39. Article 98, 3 ° of the WOG ensures the possibility for the parties to “retrieve all documents that they are useful

    consider to be added to the file. " A thorough course of the procedure in the light of a

    due process by the Data Protection Authority within the meaning of Article 58 (4)

    GDPR, requires that at some point, notably after the end of the hearing, the

    debates are closed without yet another round of exchange of

    to allow defenses.



40. Admitting new documents, without defendant means on the part of the other party, would

    violate the opposing party's right to object.




41. For the above reasons, the Disputes Chamber rejects the documents that both parties as

    "Comments" on the minutes of the hearing have been forwarded to the

    Disputes Chamber, from the debates.



           b. Elements in defenses and documents outside the scope of the

               procedure



42. The Disputes Chamber finds that the defendants describe facts in their response statement

    on account of the complainants who allegedly infringe the same provisions that it

    be the subject of this complaint. 9



43. Without declaring the merits of those allegations made by the defendants, will

    the Disputes Chamber will only assess the facts as they are in the complaint

    suggested. After all, the Disputes Chamber is only involved in this matter for the handling of

    that complaint, in accordance with Article 92, 1 ° WOG.



44. In addition, the Disputes Chamber points out that pending proceedings before the Disputes Chamber

    does not justify that parties to the dispute themselves - in the context of affixing

    documents or evidence - carrying out unlawful processing of personal data, or on

    otherwise the protection of the privacy of the other party in particular

    misunderstand. The Disputes Chamber reiterates, however, that in this regard it is only concerned with the

    handling of a complaint in accordance with Article 92, 1 ° WOG.



45. Naturally, any citizen, including the defendants, is free to lodge a complaint with the

    Data protection authority regarding facts regarding (possible) infringements of the

    regulations on personal data protection.





2.2 Jurisdiction of the Disputes Chamber (Article 100 WOG)



46. Although the actual events leading up to the Environmental Proceedings, en

    consequently to the procedure before the Data Protection Authority (hereinafter: GBA), in detail

    are set out by the complainants and defendants, they have no immediate

    relevance to the analysis by the Dispute Chamber.



47. The Disputes Chamber considers it important to have some fundamental aspects with regard to

    to explain camera surveillance in underlying decision.



48. Article 4, §1, first paragraph of the WOG states:



            “The Data Protection Authority is responsible for overseeing the

            compliance with the basic principles of the protection of personal data, in

            under this Act and the laws containing provisions on the

            protection of personal data. "




    Article 4, §2, second paragraph of the WOG also states:



            “The Data Protection Authority is the competent supervisory authority

            when no other law provides otherwise. " 10






    49. The legal assessment of this file will therefore be based in the first place


         of the provisions of the GDPR. The question arises here to what extent the processing of

         personal data took place lawfully, in accordance with Articles 5 and 6 of

         the GDPR.



    50. In addition, the CCTV Act - as a national law that contains provisions regarding the

         protection of personal data - relevant for some interpretative aspects for


         the handling of this complaint and, by extension, the present file.



    51. However, the Disputes Chamber emphasizes that the application of the GDPR as a regulation of the

         European Union takes precedence over the aforementioned national legislation because of its direct effect

         and its excellence within the European legal order. 2




    52. This also applies in particular to circumstances in which an interpretation is given to
                                                                                  3
         the data protection law concept of "legitimate interest". This is the case here,

         given that it concerns processing operations set up as a result of the private interests of citizens (see

         infra, part 2.4. with regard to the lawfulness of the processing).



    53. The Court of Justice has previously confirmed that capturing images of people with


         surveillance cameras fall under the concept of "personal data" in the sense of the
                                                                         4
         European law standards on data protection. The surveillance using

         video recordings of persons that are captured (saved) is an automated one

         processing of personal data within the meaning of Article 2 (1) GDPR. The processing of

         personal data in that context should therefore also enjoy direct protection under

         the GDPR.









2 See, inter alia, CJEU judgment of 5 February 1963, NV Algemene Transport- en Expeditie Onderneming van Gend & Loos v.

Dutch Administration of Taxes, C-26-62, ECLI: EU: C: 1963: 1; CJEU judgment of 15 July 1964, Flaminio Costa v.
E.N.E.L., C-6-64, ECLI: EU: C: 1964: 66; on the legal protection of citizens based on EU law and the principles
of "direct effect" and "prima facieity", see C. BARNARD, The Substantive Law of the EU: The Four Freedoms, ed.), rd (5
2016, 17.
3
 Compare CJEU judgment of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Credito and Federación
the Comercio Electrónico y Marketing Directo t. Administración des Estado, C-468-9 / 10, ECLI: EU: C: 2011: 777 (hereinafter: Judgment
Asociación Nacional), par 39: “It follows that, with regard to the processing of personal data, Article 7 (f) of
Directive 95/46 precludes any national legislation which, in the absence of the consent of the data subject, in addition
the two cumulative conditions referred to in the preceding paragraph imposes additional requirements. ”; ibid., par. 52: “established

Article 7 (f) […] must be sufficiently precise to be invoked by an individual and by the
national courts [and imposes] an unconditional obligation. ”
4 CJEU judgment of 11 December 2014, František Ryneš v. Úřad pro ochranu osobních údajů, C-212/13, ECLI: EU: C: 2014: 2428

(hereinafter: Ryneš judgment), par. 22.
5 Compare the analysis in Ryneš of the superseded legal norm mutatis mutandis, par. 25. 11




    54. The surveillance cameras that are the objects of this complaint are by the defendants

         placed on private domain (i.e. the property of the defendants). For the purposes of the

         AVG can be pointed out that placing security cameras on private domain, and the

         use of those surveillance cameras with which people are recorded on images, not per

         definition mean that this is a “purely personal or household activity” in the

         sentence of Article 2 (2) point c) GDPR.




    55. When the video surveillance system, for example, the public space or private domain of

         covers others, even in part, and thereby moves out of the private sphere of those

         processing data through the system, this cannot be considered an activity

         performed exclusively for personal or household purposes. because of this

         After all, it will be possible to make and record images of natural persons

         identify. This is the case here.



    56. Finally, it can be established that there is no risk that the Disputes Chamber will proceed to a

         parallel assessment - alongside any other authority - of the facts surrounding the use


         video surveillance, and thus violate the ne bis in idem principle of law, given the

         other procedures mentioned in the file concern related,

         yet legally distinct facts that do not relate to the

         protection of personal data. The Disputes Chamber can therefore proceed in full to the

         record its powers and assess the facts.






2.3. The controller (s)




    57. In accordance with Article 4 (7) GDPR, the controller is:



                 “A natural or legal person, a public authority, a serving or a

                 other body that, alone or together with others, has the purpose of and means


                 for the processing of personal data; when the objective of and

                 the means of such processing become Union or Member State law






6 A private domain is a "closed place not accessible to the public" within the meaning of Article 2, 3 ° Camera Act. The article
sounds like this:

“Enclosed space not accessible to the public: any building or any place delimited by an enclosure intended for
the use by the public where services can be provided to the public ”.
7
 Compare with Ryneš judgment, par. 32.
8 Compare with Asociación Nacional, para. 35. 12



                may determine who the controller is or

                according to which criteria it is designated ”




    58. It is fundamental that the core concepts of privacy and

        data protection can be interpreted uniformly, to ensure legal certainty for citizens

        to provide. The concept of "controller" within the meaning of the Camera Act,

        and the GDPR respectively, should therefore be interpreted in the same way.



    59. There are a number of elements in the file which indicate that both defendants themselves as


        joint controller within the meaning of Article 26 GDPR.



2.3.1. Placing surveillance cameras and registering and storing camera images from

        surveillance cameras that may or may not contain personal data



    60. In this respect it can be established that the defendants have both taken actions in

        the context of placing the surveillance cameras and determining the position of them

        cameras. The defendants both reside in the home where the security cameras

        were placed, they both gave instructions to the firm that issued the

        has installed security cameras and they have both jointly defended

        all the elements in the file, without distinguishing between them

        persons.



    61. It must be said that within the meaning of Article 7 CCTV Act the first defendant in his

        name has done the registration at the e-counter of the FPS Home Affairs, but on

        other places in this application, the name of the second defendant is stated. She is

        in particular to request the contact person to access the images. Also the e-mail address for

        mentions the contact with the controller in the application at the e-counter

        the first respondent's first name.




    62. The Court of Justice has confirmed that for the identification of the

        controller (s) there must be a factual assessment of which natural

        person or legal entity, resp. natural or legal persons, “the purpose” and “the

        means ”of the processing, whereby for the protection of data subjects a wide

        definition is given to the term. 9 The Court has also held that a

        natural person who, for reasons of his own, influences the processing of



9
 CJEU judgment of 13 May 2014, Google Spain and Google, C-131/12, ECLI: EU: C: 2014: 317, par. 34; CJEU judgment of 5 June
2018, Wirtschaftsakademie Schleswig-Holstein, C-210/16, ECLI: EU: C: 2018: 388, par. 28. 13




         personal data and thereby participate in determining the purpose of and the

         means of this processing can be considered to be a controller.

         10




    63. It is therefore not because under national law a person (the first defendant)

         has made a formal request as a controller that that person (the

         is the sole) controller within the meaning of European law. This also has

         the second defendant thus behave as controller in the


         European law sense.



    64. In the context of installing surveillance cameras and registering and storing them

         of the images recorded by those cameras, including the second respondent

         had a decisive influence, 11 thus appears to be joint processing responsibility

         of the defendants.





2.3.2. Handing over camera images and photos to the Traffic Expert




    65. It appears from the defendants' defense that the camera images were recorded by both

         defendants were referred to the Traffic Expert in the context of the

                                12
         Environmental procedure. With regard to such transfer as processing, the

         defendants identified as joint controllers in accordance with

         Article 26 GDPR, given the choice of transferring these images ("the purpose"), as well as the

         way ("the means"), was made by both defendants.




2.3.3. The use of camera images by the Traffic Expert in an expert report, and


         making camera images of the disputed security cameras available via a

         SharePoint link by that Traffic Expert



    66. In the context of the Environmental Procedure, a Traffic Expert was approached by

         both defendants, in order to prepare an expert report, in particular on the

         mobility situation in the immediate vicinity of the complainants' private domains, and consequently





10 Judgment of the CJEU of 10 July 2018, Weersan todistajat, C-25/17, ECLI: EU: C: 2018: 551, par. 65.

11 Regarding the role of the "decisive influence", cf. CJEU judgment of 29 July 2019, Fashion ID t. Verbraucherzentrale NRW, C-
40/17, ECLI: EU: C: 2019: 629, par. 70.
12
  Conclusion of the reply of the defendants dated. November 27, 2019 (Document 10), mid p. 5: “The conclusions [defendants] have to
the dangerous traffic situation recognized by both the city […] and the department of surroundings images preserved and
handed over to the [Traffic expert] to address these nuisance aspects that violate spatial planning,
public order. ” 14



    near the home of the defendants, given the parties on both sides of

    the same road borders with their property.



67. From the circumstances described in the decision of the Environment Department in the

    Environmental procedure, as well as from the expert report itself, shows a certain

    independence from the Traffic Expert.



68. In that sense, it has also not been proven that the defendants transmitted any instructions to

    the Traffic Expert with regard to the further distribution of the images with

    personal data that the defendants transferred to the Traffic Expert. Even more,

    according to the defendants, the Traffic Expert was only charged with the

    map the mobility situation using the images. The defendants would claim the

    Traffic experts also requested that the images be removed via the Sharepoint link.



69. In any case, the defendants cannot be regarded as (joint)

    controllers for the further distribution of the camera images via a

    Sharepoint link by the Traffic Expert, not just because concrete instructions

    are lacking in this respect, but also because the defendants did not "determine the means"

    with which the Traffic Expert had drawn up his expert report, the choice to use the

    used images with personal data (the vehicles and images of various

    persons are presented), including the full report. This one

    resources were determined by the Traffic Expert.



70. The complainants' complaint is addressed to the defendants in this file. To the course of a

    to safeguard a thorough procedure as well as the correct contradiction, the Disputes Chamber decides

    not to involve the Traffic Expert in this file.



71. The Disputes Chamber underlines that the fact that a third party - not involved in this

    procedure - the controller is or would be for subsequent processing of a

    transfer that is initially the responsibility of (one of) the defendants, not

    means that the initial transfer was therefore lawful. This aspect, applied to the

    disputed facts, the Disputes Chamber will deal with below. 15




2.4. The lawfulness of the processing (Article 6 GDPR)



        2.4.1. Registering, storing and otherwise using images that are

                contain personal data and originate from the disputed security cameras



    72. Based on the images available in the file, as well as the indications given by the complainants

        and the defendants of the location of the surveillance cameras on maps and aerial photographs, can

        determined that all surveillance cameras were attached to either the control panel


        main building of the defendants' property (hereinafter: the dwelling) or the secondary

        building on the property of the defendants (hereinafter: the barn).



    73. In addition, it can be established from the same images and indications that the

        house and barn do not directly adjoin the public road or private areas of

        third parties, but enclosed by pieces of land belonging to the defendants themselves.



    74. In the present file, the defendants have five as private persons in their private domain

        surveillance cameras installed. Under section 2.2. and 2.3. of the present decision,

        the Disputes Chamber already stressed that a video surveillance system under the provisions

        of the GDPR, when the equipment used makes it possible to collect personal data

        register and save. In this sense, the processing of personal data must be at all

        in accordance with the principles set out in Article 5 GDPR regarding

        personal data processing and meet one of the conditions for a

        lawful processing under Article 6 GDPR.



    75. The complainants have not in any way consented to the processing of their

        personal data within the meaning of Article 6 (1) point a) GDPR; this is also not claimed by

        the defendants. No other condition for the lawfulness of the processing

        in Article 6 (1) GDPR is possible in this context, unless point f) of that provision.



    76. In particular, it should be emphasized that Article 6 (1) (e) GDPR in the present case is not

        application. After all, none of the defendants had any obligation whatsoever


        to exercise a task in the public interest, let alone give the defendants a task in the

        within the framework of the exercise of official authority. In other words: the

        defendants did not have any task in the public interest that made it necessary



13 For an analysis of the possible processing bases in the context of video surveillance systems, see EDBP
Guidelines 3/2019 (version 2.0) as adopted on January 29, 2020, Guidelines 3/2019 on the processing of
personal data through video equipment available at: https://edpb.europa.eu/our-work-tools/our-

documents / guidelines / guidelines-32019-processing-personal-data-through-video_en (hereinafter: Guidelines EDPB 3/2019),
10 et seq. 16




        to place surveillance cameras, and the images with personal data that the

        register surveillance cameras.



    77. For the sake of completeness, it can also be pointed out that Article 6 (1) (c) GDPR is mutatis mutandis

        mutandis does not apply, as there is no legal obligation on the defendants

        to i.a. to install the surveillance cameras and to process personal data in this way.



    78. The Court of Justice has confirmed that, in the absence of any

        consent or any other legal basis, the

        legitimate basis "legitimate interest" on the basis of Article 6 (1) point f) GDPR. 4



        Specifically, the Court of Justice states with regard to that ground of lawfulness under the

        previous European Directive on personal data protection:




                 “In this context, there are three cumulative in Article 7 (f) of Directive 95/46

                conditions that must be met in order for the processing of

                personal data is lawful, namely, in the first place, the promotion of

                a legitimate interest of the controller or of the

                third parties to whom the data are disclosed, in the second place, the

                necessity of the processing of personal data for the purpose of processing

                of the legitimate interest and, thirdly, the fact that the fundamental

                rights and freedoms of the person involved in data protection

                prevail (judgment of 4 May 2017, Rigas satiksme, C-13/16, EU: C: 2017: 336, paragraph

                28). ”15



    79. In other words, data controllers must demonstrate that:



        1) the interests that they pursue with the processing can be justified

            recognized (the “target test”);


        2) the intended processing is necessary for the realization of those interests (the

            “Necessity test”); and

        3) the balancing of those interests against the interests, fundamental freedoms and

            fundamental rights of data subjects weighs in favor of the

            controllers or of a third party (the “balancing test”).







14 Compare the analysis of the former Directive mutatis mutandis with the GDPR in Asociación Nacional, para. 40 and 42.
15
  Ibid., Par. 40. 17




        1. The target test



    80. The Disputes Chamber can determine that the defendants are in concrete terms justified

        had an interest in placing the surveillance cameras on their private domain in order to prevent the

        protection of the property, health and life of the defendants and their

        family members or other third parties.




    81. The European Data Protection Board (hereinafter: the EDPB) has indicated earlier

        that burglary, vandalism or theft are examples of situations requiring video surveillance
                        16
        justify. The legitimate interest of the defendants must be

        are real and relate to a current problem. 17 The damage to the

        property of the defendants in the period before the installation of the surveillance cameras,

        show in themselves that this is a current and existing - and therefore not a purely hypothetical -

        interest.






        2. The necessity test




    82. In the context of camera surveillance systems, the Court of Justice has underlined that these

        condition must be examined in conjunction with the principle of “minimal

        data processing ”, which is currently stipulated in Article 5 (1) point c) GDPR. 18

        Personal data must be adequate, relevant and limited to what is necessary

        is for the purposes for which they are processed.



    83. The Disputes Chamber now proceeds to the analysis per disputed security camera in order to establish

        whether or not the processing of the personal data by means of those cameras is considered


        can be considered necessary.



        a) Camera facade



    84. First, on a still image in the camera's complaint, there is "facade" a piece of land

        can be seen next to the garden at the front of the defendants that constitutes the "front garden". On a

        camera image that the complainants transferred to the Dispute Chamber, it can be seen that the


        security camera was aimed so that about a third of the image is on the public road




16 Guidelines EDPB 3/2019, par. 19.
17
  Guidelines EDPB 3/2019, par. 20.
18 Judgment Asociación Nacional, para. 48. 18




        (as an unenclosed place). This can also be seen in the still images in the complaint and the

        statement of reply of the defendants. This at the time before the positioning of the

        surveillance cameras were changed by the defendants.



    85. The Disputes Chamber finds that the extensive and constant filming of the public road is not

        can be seen as “relevant”, let alone “necessary” for the defendants to

        safeguard their legitimate interests mentioned above.



    86. Such an arrangement of a surveillance camera can hardly correspond to the

        principle of minimal data processing. The defendants argue that the

        turning the surveillance camera results in a reflection of the image, “so

        a large part of the camera surveillance misses its target, especially at night […] From the images that

        before, it appears that the company [X] 9 has set the cameras to be owned by

        conclusions was maximally secured. ” 20




    87. That the surveillance cameras are set up in a way that is not as necessary and in

        compliance with the principle of data minimization

        remains the responsibility of the defendants as

        controllers. A technically unpleasant consequence is therefore not possible here

        Form "escape route" to obtain lawful processing. Such a route is also

        not provided by any legislator.



    88. How the company [X] installs the surveillance cameras and, if necessary, incorrectly

        is a contractual matter that does not preclude the application of the

        GDPR and the associated consequences and responsibilities of the

        controllers.



    89. That the surveillance cameras were adjusted after the visit of the police officer, does not matter

        prejudice the initial infringement. Incidentally, the Disputes Chamber does not rule on the


        accuracy of the statements of the police officer; it only checks the provisions of the law

        (in this case the GDPR) to the actions of the controller.



    90. In any case, with the wrong placement of the camera, the first defendant has "facade"

        undisputedly the personal data of, in particular, the first complainant processed by them

        register and store, as well as pass on this personal data to the

        Traffic expert.



19D.i. the company that installed all surveillance cameras for the defendants.
20
  Statement of reply of the defendants, document 10. 19





91. For the sake of completeness, it can also be noted that Article 8/2 of the CCTV Act is the King

    allows to establish places where surveillance cameras may be aimed at the

    perimeter directly around a given place.



92. The Royal Decree of 6 December 2018 determining the places where the

    controller can direct his surveillance cameras at the perimeter

    directly around the place, the images from the surveillance cameras for three months

    can save and give real-time access to the images to the police forces (B.S.

    December 18, 2018, hereinafter Royal Decree Extended Perimeter) determines in Article 2 in which

    Fallen security cameras can be aimed at the perimeter around the site.



93. The Royal Decree Extended Perimeter does not offer the defendants the opportunity to submit their

    surveillance cameras on the perimeter (i.e. not the private domain of the defendants) around the

    instead of aiming the cameras. The places specified in the Royal Decree are

    often places that pose a risk and where the filming of the extended perimeter de

    public safety or public interest (and a contrario, not purely private interests).



94. In this sense, it can be such extensive and constant filming of the public road, as shown

    the images in the file presented by the defendants themselves are not regarded as

    necessary for the processing of personal data when using the

    surveillance cameras.




    b) Shed front camera



95. According to the defendants, the camera "front shed" films a "limited part of the

    owned by [the complainers], more precisely the driveway and part of the large automatic

    gate. ” This at the time before the positioning of the surveillance cameras became

    amended by the defendants.



96. The national legislature (in Article 7 of the Camera Act) has installed these for the surveillance cameras

    in "closed places not accessible to the public" a provision is provided for that

    filming a "non-enclosed place" or a "publicly accessible enclosed place"

    subject to stringent conditions in accordance with the principle of minimal

    data processing. In this sense it can be assumed in an a fortiori line of reasoning

    property of private persons or private companies should in any case not be filmed

    turn into. 20



97. Here too, Article 8/2 Camera Act cannot be applied, for the same reasons as above

    set forth under the analysis of necessity for camera "facade".



98. The Disputes Chamber does not rule out this in certain - very exceptional - cases

    property of third parties could be lawfully filmed within the meaning of Article 6,

    paragraph 1 GDPR. More specifically, situations in which the third party owns the

    private domain gives her or his permission to install a security camera that

    films her or his property, when the person who installs the security camera at no

    can protect its property in some effective way without entering another private domain

    image.



99. In this case, there is no such consent; the complaint proves the contrary. Moreover

    none of the documents in the file appears to have any other necessary reason,

    for filming parts of the complainants' property.



100. Indeed, the 'front shed' camera films only a very limited part of the property

    of the complainants, it appears from the images submitted by the defendants, which predate

    the adjustment of the position of the surveillance cameras. That is why it can be questioned

    be why it would be somewhat necessary to have this limited portion of the property

    of the complainants was portrayed.



101. In this sense it can be - albeit limited but constant - filming of the private domains of the

    complainants, as is apparent from the images in the file presented by the defendants themselves, where

    personal data are processed, are not seen as necessary for the processing

    of personal data when using the surveillance cameras



    c) Other surveillance cameras



102. The complainants did not produce any documents with regard to the other surveillance cameras

    submitted in the complaint. However, in the reply of the defendants

    images taken from before the repositioning of the surveillance cameras, from which not

    can be determined that these surveillance cameras are slightly different places than it

    private domain of the defendants themselves. It's about the

    surveillance cameras "street side", "garage" and "rear shed". 21




        3. The balancing test



    103. Although not passing the "necessity test" is already sufficient to establish

        state that the processing of personal data by means of the surveillance cameras 'facade'

        and "front shed" took place unlawfully, the Disputes Chamber is investigating unnecessarily

        or the existence of fundamental rights and freedoms in data protection

        the persons concerned (the complainants) may or may not prevail over the legitimate interests

        of the defendants.




    104. That balance depends on the particular circumstances of a particular case and the

        rights of the complainants concerned under Articles 7 and 8 of the Charter of the European

        Union with regard to the protection of privacy and
                               21
        data protection.



    105. In that sense, the seriousness of the infringement of rights and

        freedoms of the complainants as an essential part of the analysis. 22 In doing so can be

        noted that the continuous mapping of the public road, this is 24 hours a day

        hours and 7 days out of 7 days, constitutes a serious violation of these fundamental rights. This applies

        at least equally for the private domains of the complainants and is all the more the case when a

        other, less intrusive processing appears to be possible, given the adjustment of the position of

        the surveillance cameras.




    106. In addition, there are also many others involved, such as the children of the complainants, or

        drivers of vehicles passing on the public road in front of the house

        defendants, whose rights are also being violated in this regard.



    107. It can also be pointed out that it is beyond the objective expectations of those involved

        it falls that the two aforementioned surveillance cameras are positioned in such a way,

        constantly filming part of the public road and the private domain of the complainants. 23

        This is the case, among other things, because the surveillance cameras are not in accordance with the

        provisions regarding the installation of surveillance cameras under national law (de

        Camera Act) were placed.




    108. For all these reasons, the security cameras "front facade" and "front shed" also withstand

        the balancing test is not.



21 Judgment Asociación Nacional, par. 52; Guidelines EDPB 3/2019, par. 32-35.

22 Ibid., Par. 56.
23 With regard to these "objective expectations", see EDPB Guidelines 3/2019, par. 36. 22



    4. Conclusion




109. The security cameras "front facade" and "front shed" have images with

    unlawfully processes personal data, which constitutes an infringement of Article 6,

    paragraph 1 GDPR, now that there are legitimate interests for the defendants within the meaning of

    point f) of that standard, but the concrete processing operations are not necessary for the

    safeguarding those interests, and the fundamental rights and freedoms of the complainants

    and other stakeholders outweigh those interests.




    2.4.2. The transfer of the camera images with personal data to the

            Traffic expert



110. As in section 2.3. already determined by the Disputes Chamber, are for this transfer

    the defendants are responsible as joint controller in their view

    both act as parties to the Environmental Proceedings, and they say together the

    Have addressed a traffic expert and transferred the images in this context

    (supra).



111. At the hearing, defense counsel argues that, in the context of

    the Environmental Procedure, camera images were allowed to be transferred to the Traffic Expert

    , given that Traffic Expert can be seen as part of the

    "Judicial authorities" within the meaning of Article 9, paragraph 1, fourth paragraph, 1 ° Camera Act.



112. Article 9 CCTV Act does not apply in this situation.



113. Contrary to what the defendants argue, the Traffic Expert is not involved

    out of the "judicial authorities," as he was appointed by order of the

    defendants themselves, and this moreover in the context of an administrative appeal procedure.



114. The question remains - partly in view of the inapplicability of Article 9 of the CCTV Act - whether in

    the defendants nevertheless have a legitimate interest in the images

    to pass on to the Traffic Expert with the aim of visualizing the

    mobility situation in the immediate vicinity of the property of the complainants under

    the Environmental Procedure.



115. Now the Disputes Chamber in section 2.4.1. has come to the conclusion that the images

    made with the surveillance cameras "front facade" and "front shed" illegal

    processing of personal data, it appears in itself that these images are not 23



    could be submitted to the Traffic Expert. After all, this transfer is then also

    unlawful within the meaning of Article 6 (1) GDPR.



116. The assignment that the Traffic Expert received from the defendants showed the

    transfer moreover just around the images - and the associated processing of

    personal data - that were made from public roads, albeit the

    private domains of the complainants.



117. The transmission of the images made with the surveillance cameras to the Traffic Expert

    by the defendants does not constitute lawful processing within the meaning of Art.6 para. 1 GDPR,

    and therefore constitutes an infringement of that legal provision.




    2.4.3. Taking pictures of the public road in case of an (alleged) crime

            is committed, or when a mistake is made in any other way that causes nuisance

            flows



118. In the complaint, an image is added that from the private domain of the defendants

    portrays the public road and the private domain of the complainants, the former

    the complainant is visible while apparently carrying a […].



119. The complainants believe that this is a screenshot of an image taken with one

    of the defendants' surveillance cameras, but the latter deny this. They argue

    that this image was taken with a smartphone from the home on the private domain of the

    defendants by one of them. The technical framing by the defendants appears in this regard

    to be correct.



120. Then the question remains whether the making of such an image constitutes a lawful processing

    within the meaning of Article 6 (1) GDPR.



121. The defendants believe that the photo could be taken as they believe it

    transporting a […] possibly constitutes an (environmental) crime. The defendants are of the opinion

    it is necessary to collect evidence of an infringement (suspected or otherwise)

    to report this to the competent services, authorities or judicial authorities or

    complain. The defendants appear to have done this in the present case by notifying the

    Federal Agency for the Safety of the Food Chain (FASFC), which is also a

    investigation started. 24



122. In the context of safeguarding public and private security, the

    defendants therefore have a legitimate interest within the meaning of Art.6 para. 1 lit.f GDPR

    to take the picture. After all, they assumed in good faith that the transport of

    a […] does indeed constitute an (environmental) crime, which is why their notification to the FASFC

    illustrates.



123. Although the Dispute Chamber refers to public safety in this regard, it should

    be emphasized that this in no way means that Article 6 (1) (e) GDPR in the present case

    would find application. After all, none of the defendants had any obligation whatsoever

    to exercise a task in the public interest, let alone give the defendants a task in the

    within the framework of the exercise of official authority. In other words: the

    defendants were under no obligation to provide evidence of the (alleged) environmental crime

    by taking a picture and processing it accordingly

    personal data; this would be different in the case of judicial authorities or others

    competent authorities provide evidence, through images that

    contain, collect and further process personal data.



124. The damage resulting from such a crime (i.e. environmental pollution) would not only affect the

    society, but also directly affect the private interests of the defendants, in their view

    reside next to the complainants, including the first complainant transports it […]. In that sense

    was taking the photo as processing of personal data (of the first complainant)

    also necessary for safeguarding those legitimate interests of the

    complainant because it may serve as evidence of the alleged crime.



125. Finally, it can also be mentioned that taking that photo does not seem so intrusive

    for the interests or fundamental rights and freedoms of the first complainant,

    that these outweigh the legitimate interests of the defendants holding the

    photo, as the defendants had a good faith belief that there was a crime

    was committed. Moreover, the position of the camera that took the image was such

    aimed at visualizing only the (alleged) crime on the public road. It

    taking the photo as processing of personal data therefore also passes the

    balancing test.



126. For all the foregoing reasons, taking a one-time photo was with a

    smartphone, as shown in the complaint and where the first complainant is visible,

    as a direct response to seeing an alleged crime (as opposed to the constant

    filming by surveillance cameras of part of the public road or private domain), a

    lawful processing within the meaning of Article 6 (1) point f GDPR, and none of the 25



    defendants commit an infringement of this article in relation to this fact.






2.5. Data protection by design (Article 25 GDPR)



127. In the GDPR, the European legislator has provided an article 25, containing the concepts

    "Data protection by design" and "data protection by default" ("DPbDD"), in Dutch

    respectively "data protection by design" and "data protection by

    standard settings'. The Disputes Chamber hereafter uses the abbreviation DPbDD when the

    deals with both concepts at the same time.



128. Article 25 GDPR reads:



            “1. Taking into account the state of the art, the implementation costs, and the

            nature, scope, context and purpose of the processing as well as the qua

            likelihood and severity varying risks to the rights and freedoms of

            natural persons associated with the processing, the

            controller, both in determining the processing means and

            in the processing itself, appropriate technical and organizational measures, such as

            pseudonymisation, which are created with the aim of the

            data protection principles, such as data minimization, on one

            effective manner and put in place the necessary safeguards in the processing

            construction to comply with the requirements of this Regulation and for protection

            of the rights of the data subjects.



            2. The controller takes appropriate technical and organizational

            measures to ensure that, in principle, only personal data are made

            that are necessary for each specific purpose of the processing. That

            obligation applies to the amount of personal data collected, the extent to which

            they are processed, the period for which they are stored and the

            accessibility thereof. In particular, these measures ensure that

            personal data in principle not without human intervention for one

            unlimited number of natural persons are made accessible.


            3. A certification mechanism approved in accordance with Article 42 may

            used as an element to demonstrate compliance with the requirements of paragraphs 1 26




                  and 2 of this article have been met. ” 24





    129. The EDPB has guidelines on DPbDD in accordance with Article 70 (1) (e) GDPR

                        25
         issued.



    130. Data protection by default refers, according to the guidelines, to the

         terminology used in computer science, and refers to a pre-existing one

         or pre-selected value of an adjustable setting within a software

                    26
         application.



    131. To the situation in this file with regard to the placement and positioning of the

         surveillance cameras, data protection by design should be considered.




    132. The purpose of data protection by design, according to the EDPB, is to protect

         of the rights of data subjects and ensure the protection of their
                                                                             27
         personal data ("built-in") is specific to the processing. It is important here that the

         "Appropriate measures" that a controller must take are intended

         that data protection principles are effectively built in so that

         the risks of violations of the rights and freedoms of data subjects are limited. 28




    133. It is important to note that for the purposes of the

         data protection by design does not require actual processing to take place.

         However, it is the specific nature of installing surveillance cameras and filming with

         those surveillance cameras, which requires taking appropriate technical and organizational


         measures with the aim, inter alia, of data protection principles effectively

         to apply, as well as to ensure the protection of potential data subjects, would be one

         processing of personal data.









24 See also recital 78 GDPR in this regard.

25EDBP Guidelines 4/2019 of 13 November 2019, Guidelines on Article 25 Data Protection by Design and by Default,
available via:
https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_201904_dataprotection_by_design_and_by_default.pdf

(hereinafter: EDPB Guidelines 4/2019).
2EDPB Guidelines 4/2019, par. 39. See also ibid., Par. 40: “Hence, 'data protection by default' refers to he choices made by
a controller regarding any pre-existing configuration value or processing option that is assigned in a software application,

computer program or device that the effect of adjusting, in particular but not limited to, the amount of personal data collected,
the extent of their processing, the period of their storage and their accessibility. ”
27EDPB Guidelines 4/2019, par. 7.

28EDPB Guidelines 4/2019, par. 14 et seq. 27




    134. In this sense, there will also be at least one controller for, among other things, the

        placing the surveillance cameras, and providing data protection by design

        cfr. Article 25 (1) GDPR by that controller, regardless of whether the posting of

        which results in surveillance cameras in the processing of personal data. To be these

        both defendants are joint controllers within the meaning of Article 26 GDPR,

        as determined in section 2.3.





    135. The legal provision on data protection by design, Article 25 GDPR, states

        expressly the importance of taking effective measures to give effect to

        the principle of minimal data processing. The controller must

        after all, checking whether there is a need to process personal data. 29



    136. When filming the public road and private domains, there is almost absolute certainty

        that personal data, and probably a large number of personal data, will become

        processed. This is also evident from the fact that the defendants in the Environmental Procedure the

        have used camera images from, among other things, the camera 'front facade' to vehicles and

        visualize their behavior. The same risk applies to private domain filming

        (like that of the complainants), which happens with the camera 'front shed'.



    137. In section 2.4. of the present decision, the Disputes Chamber concluded that

        unlawful processing took place because of the position of certain

        surveillance cameras. By their nature, these unlawful processing operations are sufficient in themselves


        indicates that insufficient measures have been taken by the defendants to take the necessary

        take measures to comply with the data protection principles of the GDPR, and

        thus constitutes an infringement of Article 25 (1) GDPR.



    138. It is of the utmost importance that the continuous filming of such places (cf. par. 136)

        is done with due care and restraint and in accordance with the

        legal provisions in this regard, which is not the case in this case.



    139. For all of the above reasons, the defendants infringed Article 25 (1) GDPR by the

        placement of the surveillance cameras "front facade" and "front shed".










29
  EDPB Guidelines 4/2019, par. 69. 28




    2.6. Sanctioning the infringements




    140. The Disputes Chamber finds the following infringements on the part of the defendants:




         a.Article 6 (1) GDPR, in view of the processing of personal data, and more the

             determines the personal data of the first complainant in the present case, using the

             security camera "front facade" 30 and security camera "front shed", at 31

             happened unlawfully, where personal data was collected at the

             filming of public road 32 and filming of private property 33 of third


             natural persons;



         b. Article 6 (1) GDPR, given the defendants unlawful image material

             pass it on to the Traffic Expert, in the context of the Environmental Procedure between

             the complainants and the defendants, in particular the personal data of the former

             the complainant were processed unlawfully, after which that material with


             personal data of the first complainant was provided by the Traffic Expert

             made available through an online platform;



         c. Article 25 (1) GDPR, given that the defendants do not have adequate measures

             affected when installing their surveillance cameras, especially the cameras


             "Front facade" and "shed front", so that these are the data protection principles, and

             in particular data minimization, compliance, to protect the rights of

             involved.



    141. The Disputes Chamber notes that the current positioning of the said


         security cameras has stopped the violations, and therefore decides only one

         reprimand and impose an administrative fine for the aforementioned infringements

         (infra).














30 The name of the surveillance cameras is the same as that used by the defendants in their statement of reply dated. 27
November 2019, first indicated at the bottom of page 6.
31
  Ibid.
32 Compare: the public road as an "open space" within the meaning of Article 2, 1 ° of the Law of 21 March 2007 regulating

of the placement and use of surveillance cameras (Belgian Official Gazette 21 May 2007), hereinafter the Camera Act.
33 Compare: private property as "closed place not accessible to the public" within the meaning of Article 2, 3 ° CCTV Act. 29



                                                                  34
    142. Taking into account article 83 GDPR and the case law of the Marktenhof, the

        Dispute Resolution Chamber imposing an administrative sanction for the two infringements

        Article 6 (1) GDPR in concrete terms:




        Duration



        The fact that from the initial placement of the surveillance cameras to changing the

        position of the surveillance cameras continuously unlawfully personal data

        were processed with the two mentioned surveillance cameras, that implies the infringements

        have taken place over many months. 35




        As for the transmission of the footage from the two surveillance cameras to the

        Traffic expert, images taken in November 2018 appear to be used

        by the defendants in the context of the Environmental Procedure. The phase of the

        However, the environmental procedure in which the Traffic Expert was appointed dates back to

        not until April 12, 2019, more than five months after the images were taken. The fact that

        the footage was kept for so long, and then further processed, also points out

        here on a term of preservation of unlawfully made images, which apparently

        is excessive, while those images in the first place have already been made unlawfully

        became.




        Ernst


        The violated provisions are at the heart of the General Regulation

        Data protection, in particular the lawfulness of the processing.



        The defendants say they used a firm specialized in installation

        surveillance cameras - however, the defendants themselves remain responsible for the

        processing operations for which they determine the purpose and means on the basis of Article 5 (2) and

        article 24 GDPR.



        The defendants and the complainants are engaged in different disputes before different ones

        government agencies, with the defendants arguing that the complainants also determined

        have committed personal data breaches - this justifies, however




34
  Brussels Court of Appeal (section Marktenhof), X t. GBA, Judgment 2020/1471 of 19 February 2020.
35 The surveillance cameras were installed, according to the defense statement of the defendants, p. 6, “in the autumn of 2018” -
the registration of the surveillance cameras in the e-counter of the FPS Home Affairs dates from October 2018; the
repositioning of the surveillance cameras was reported by the defendants to the police officer in November 2019, according to the
complainants at the end of September 2019.30




        by no means own violations of laws and regulations, let alone impunity

        implies by the supervisory authority.



        The defendants have already set up several of their surveillance cameras

        changed, after an intervention of the community police officer, thus changing the current arrangement of the

        surveillance cameras (including the two where violations are detected) less risk

        implies for the interests, freedoms and fundamental rights of third natural persons who

        could be filmed.



        The Disputes Chamber also takes into account that the defendants are private citizens

        are apparently not pursuing commercial interests in the processing of the

        personal data.



        Violations of Article 6 GDPR give rise to the highest fines in Article 83 (5)

        AVG.



        With regard to the setup of the surveillance cameras and the personal data processing

        with those cameras, the Disputes Chamber takes into account what the defendants say

        regarding compliance by them with national legislation (in particular the Camera Act) and the

        advice from the security firm as a contractual partner.



        The defendants themselves argue that the cameras were set up in such a way that it was owned by

        [defendants] was given maximum protection. ” 36


        However, it is apparent from all the elements of the file that sufficient account was not taken

        with the implications of CCTV for personal data protection

        third parties involved, the complainants.





        Number of people involved

        With regard to the number of parties involved, the Disputes Chamber wishes to remind you that

        misplacing surveillance cameras, and subsequent processing of

        personal data through the images of such cameras, when on public roads or

        private domains are mapped, a large number of data subjects are affected by their rights.

        Children can also be involved in this, something where the GDPR, inter alia in Article 6 (1),

        point f) GDPR, paid additional attention.






36
  Reply statement of the defendants dated. November 27, 2019, p. 3; the Disputes Chamber underlines. 31



    It is important the personal data of such a large number (for the defendants

    perhaps unknown number) to process data subjects with the greatest caution, and ten

    at least in accordance with data protection regulations.



    Sufficient deterrent effect

    An administrative fine of EUR 1,500 is sufficient for the Disputes Chamber

    deterrent amount to prevent further breaches, given the response to it

    penalty form of the defendants dated. November 17, 2020.



143. The Disputes Chamber points out that the other criteria of art. 83.2. AVG in this case not

    nature that they lead to an administrative fine other than that which the

    Dispute Resolution Chamber has established within the framework of this decision.



144. On October 27, 2020, the Disputes Chamber filed a form for response against

    intended fine to the defendants, which was notified to the defendants

    that the Disputes Chamber intended to impose a fine of 2,000 on them

    EUR. The elements that the defendant subsequently put forward in its response to this form,

    are included in the deliberations by the Dispute Chamber. In addition, the

    take particular account of the defendant's financial strength.



145. Given the importance of transparency with regard to the decision-making of the

    Disputes Chamber, this decision is made in accordance with Article 100, §1, 16 ° WOG

    published on the website of the Data Protection Authority with the omission of the

    identification data of the parties, given that identification data is not necessary and

    relevant in the publication of the decision. 32







FOR THESE REASONS,



the Disputes Chamber of the Data Protection Authority will, after deliberation, decide to issue the

defendants:



     on the basis of Article 58, paragraph 2, point b) GDPR and Article 100, §1, 5 ° WOG

           to be reprimanded for the infringement of Article 25 (1) GDPR;

     b. on the basis of Article 83 GDPR and Articles 100, 13 ° and 101 WOG an administrative one

           a fine of EUR 1,500 to be imposed on the defendants for the infringements of

           article 6 GDPR. The defendants are jointly and severally liable to pay the aforementioned

           amount.




Against this decision on the basis of art. 108, §1 WOG, appeals are lodged within one

term of thirty days, from the notification, at the Marktenhof, with the

Data protection authority as defendant.













(get.) Hielke Hijmans

Chairman of the Disputes Chamber