BVwG - W214 2230473-1
From GDPRhub
| BVwG - W214 2230473-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 6 GDPR Article 57(1)(f) GDPR Article 133 (4) B-VG §1(1) DSG §12 DSG §24 DSG |
| Decided: | 25.09.2020 |
| Published: | |
| Parties: | |
| National Case Number/Name: | W214 2230473-1 |
| European Case Law Identifier: | |
| Appeal from: | DSB (Austria) Zl DSB-D123.386 2020-0.176.784 |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (in German) |
| Initial Contributor: | Agnieszka Rapcewicz |
The Austrian Federal Administrative Court held that since the camera installed in the building did not work (did not record the image), there was no processing of personal data, and further on, there was no infringement. The Court also pointed out that the mere impression of being "observed" does not constitute a violation of Section 1 (1) of the Data Protection Act. When it comes to the right to erasure, it can only be asserted as a subjective right in the context of a complaint procedure if the data subject has submitted such a request for erasure to the (alleged) controller in advance.
English Summary
Facts
The complainant was the beneficiary of a property on which there was an apartment building with numerous tenants. The alleged controller was the tenant of one of the flats and, in the course of installing a security door in the public corridor area of the property in question, had also had a functioning surveillance camera installed. According to the complainant, only the alleged controller had access to the recorded images and the possibility to use them, and this behaviour drastically interfered with the rights to respect for the private and family life of the other tenants, in particular to the confidentiality of the data concerned, as no one other than the alleged controller had access to this data and no one knew what happened to the images. The other tenants and the owner of the house had not given their consent, which was why the recordings were, in the applicant's opinion, inadmissible under section 12(4)(1) of the Data Protection Act. Therefore, she filed a complaint with the DPA, asserting a violation of the right to confidentiality.
After an investigation, the authority dismissed the complaint on the grounds of violation of the right to secrecy and the right to deletion as unfounded and rejected the applications for uninstallation of the camera, for an order to refrain from future interventions and for the initiation of administrative penal proceedings.
The authority found that there had been a burglary at the address mentioned, which was why the co-participant, in agreement with his son, had installed the video camera in question in 2010. The video camera was located on the first floor and was directed at the entrance to the flats XXXX and XXXX. The camera was non-functional and served as a deterrent against burglars. The other party had not used the video camera to take any pictures showing the complainant.
In its assessment of the evidence, the DPA summarised that the statements of the co-participant were credible and that there was also no apparent reason why the co-participant should take pictures of the complainant.
The authority stated that in this case, due to the inoperability of the camera, it was impossible that personal data of the complainant would be processed; the mere impression of being "observed" was not sufficient for a violation of section 1(1) of the Data Protection Act.
The complainant filed an appeal against this decision with the Federal Administrative Court.
Dispute
Has the authority sufficiently clarified the case and examined the complaint? Has there been a violation of the right to privacy?
Holding
The Court dismissed the complaint as unfounded.
Comment
The applicant stated that the co-participant had not proved the inability of the camera to function, despite the order of the authority, but had merely asserted, unsubstantiated, that the camera was inoperable. In the applicant's view this assertion did not correspond to the facts, especially as it had turned out that the red infrared light on the camera was on. The authority in question had completely disregarded this fact. It was also not a mere dummy camera, but a fundamentally functioning camera that was merely in need of repair. Due to the existence of a functioning camera, which had been installed without consent, there was in any case a violation of data protection. Moreover, the applicant pointed out that the co-participant himself had admitted that he would repair the camera after the conclusion of the proceedings, and it was unreasonable to expect the complainant and the other residents of the house to constantly check whether the camera had been repaired or not after the conclusion of the proceedings, as announced by the co-participant. Contrary to the assessment of the authority, the impression of being observed was not merely created, but rather there was a concrete fear that the camera would be repaired at any time and that concrete recordings would be made.
The Court held that no procedural rules had been violated by the DPA, the authority concerned had dealt in detail with the question of the functioning of the camera and had investigated the complaint "to a reasonable extent" pursuant to Article (1)(f) GDPR. The DPA could only determine a violation of the right to secrecy ex post, which is why a complaint in this regard regarding possible future violations could not be successful due to the lack of a complaint at the time of the decision.
The Court found that the camera had been installed after a bulglary at the mentioned address and construction tools were stolen from there. In 2010, the co-participant obtained the consent of the house owner at that time, to install the camera. The camera did not capture that part of the staircase which is used by all persons who want to get to a higher floor.
The co-participant checked the functionality of his camera during the proceedings before the prosecuting authority in 2018 and found that it was no longer working and that no image data was stored on the memory card. The co-participant left the video camera connected to the power supply in place for deterrent effect. After the conclusion of the proceedings before the DPA in 2020, the co-participant removed the storage device and disposed of it.
The Court held that it cannot be established that the co-participant used the said video camera to take footage showing the complainant. It must therefore be assumed that there is no such recording.
At the oral hearing, the complainant stated that the period of time during which unlawful records had been made about her was "approximately 2016 until now". As was revealed in the evidentiary proceedings, the camera installed by the co-participant had been defective in recent years and personal data had not been stored. The complainant was also unable to prove that personal images of her had been taken. As the Administrative Court explained, in the case of non-determinability, it is to be assumed that the fact does not exist (Administrative Court of 16 June 1992, ref. 92/08/0062).
The Court therefore assumed that as no personal data of the complainant was processed, there can also be no violation of the fundamental right to the protection of personal data enshrined in Section 1 (1) of the Data Protection Act. In this respect, there could also be no violation of Article 6 GDPR (which was not even addressed by the complainant) or of Article 12 GDPR (the applicability of which in the area of private video surveillance was denied by the Federal Administrative Court in the first place, see the statements in W211 2210458-1/10E of 25.11.2019 and W256 2214855-1/6E of 20.11.2019).
The mere impression of being "observed" does not constitute a violation of Section 1 (1) of the Data Protection Act.
Moreover, the right to erasure can only be asserted as a subjective right in the context of a complaint procedure pursuant to Article 77(1) GDPR in conjunction with Article 24(1) of the Data Protection Act (DSG) if the data subject has submitted such a request for erasure to the (alleged) controller in advance pursuant to Article 12(3) GDPR. Pursuant to Article 24 (2) of the Data Protection Act, a complaint must be accompanied, if applicable, by the underlying request and any response by the respondent. A request for deletion was not made to the co-participant and this was not even alleged in the complaint proceedings before the authority concerned. Only the request was made to the DPA to order the co-participant (respondent in the proceedings before the prosecuting authority) "to delete the recorded data".
The complaint was therefore to be dismissed on this point.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court, by Judge Eva SOUHRADA-KIRCHMAYER as chairperson and the expert lay judges Huberta MAITZ-STRASSNIG and Claudia KRAL-BAST as associate judges, has ruled on the complaint of XXXX, represented by Dr. XXXX, lawyer, against the decision of the data protection authority of 16 March 2020, Zl. XXXX , against the decision of the data protection authority of 16.03.2020, Zl DSB-D123.386 2020-0.176.784, after an oral hearing on 07.09.2020:
A)
The complaint is dismissed as unfounded pursuant to section 28(2) of the Administrative Court Procedure Act, Federal Law Gazette No. 33/2013 as amended (VwGVG).
B)
The appeal is not admissible pursuant to Art. 133 (4) B-VG.
Text
Reasons for decision:
I. Course of proceedings
In her complaint of 23 August 2018 addressed to the data protection authority (DPA, the authority before the Federal Administrative Court), the complainant asserted a violation of the right to confidentiality. In summary, it was argued that the complainant was the beneficiary of a property (described in more detail) on which there was an apartment building with numerous tenants. The person responsible was the tenant of the flat TOP XXXX and, in the course of installing a security door in the public corridor area of the property in question, had also had a functioning surveillance camera installed. He had neither been entitled nor authorised to carry out this installation. The complainant had become aware of this event on 30 May 2018 and the complaint was therefore timely. Only the person responsible had access to the recorded images and the possibility to use them, and this behaviour drastically interfered with the rights to respect for the private and family life of the other tenants, in particular to the confidentiality of the data concerned, as no one other than the person responsible had access to this data and no one knew what happened to the images. The other tenants and the owner of the house had not given their consent, which was why the recordings were inadmissible under section 12(4)(1) of the Data Protection Act.
The complainant enclosed an extract from the land register of the property in question (annexure ./A), a set of photographs showing the corridor area, wiring and the installed camera (annexure ./B) as well as a house plan of the first floor (annexure ./C) with her complaint.
The complainant requested a declaration of a violation of the right to secrecy and the removal or uninstallation of the camera. 2.
The authority concerned then forwarded the complaint of the complainant to the co-participant (the original respondent before the authority concerned), XXXX, by letter of 10.09. 2018. 2018 and requested him to comment on it within two weeks and, in particular, to state and substantiate with suitable evidence whether the allegations of the complainant were true, for what purpose the system was operated, on what legal basis it was operated, whether recordings were made and, if so, for how long, whether the recordings were kept, whether the cameras were marked and, if so, in what way, as well as which areas were covered by the recording.
The co-owner submitted a statement through his legal representation on 29.10.2018, in which it was stated that the complainant's allegations were not true, that the co-owner was not the tenant of the flat TOP No. XXXX of the property in question, and that no camera was installed in front of this flat. It was therefore requested that the proceedings be discontinued without substitution.
Enclosed with the statement was the tenancy agreement of the flat TOP XXXX dated 01.02.2011, in which XXXX appears as the tenant of this flat.
The authority concerned sent the statement of the co-participant to the complainant on 31.10.2018 and gave the complainant the opportunity to submit a statement within a period of time.
The complainant submitted a statement through her legal representative on 13 November 2018 and argued that the XXXX family had rented the properties TOP XXXX and XXXX, that it was correct that the tenant of TOP XXXX was the son of the co-owner, but that the co-owner, according to his own statements, had been running his office there since 1980 and lived in TOP XXXX, although he was still registered at a different address. Compared to the co-owner, the co-owner's son had so far been a relatively inconspicuous tenant, so that it could be assumed that he was not the driving force behind the data protection violation. The co-tenant was constantly trying to interfere in house matters and to act as the owner of the house and had already committed numerous other violations.
Attached to the statement were the tenancy agreements of the XXXX family (Annex /D), a ZMR extract concerning the co-owner (Annex ./E), a transcript of the main hearing on GZ XXXX of the XXXX District Court of 16.04.2018 (Annex ./F) as well as a letter from the legal representation of the co-owner to XXXX of 29.09.2016 (Annex ./G).
On 03.12.2018, the authority in question forwarded the statement of the complainant to the co-owner and, in this letter and in the letter of reminder of 07.03.2019, requested the co-owner to disclose who had installed the video camera and for what purpose, on which floor it was installed and on which TOP it was directed, whether it was true that the co-owner had an office in the flat TOP XXXX and whether the co-owner actually lived or stayed in the flat TOP XXXX.
The co-owner submitted a statement through his legal representative on 21 March 2019, stating that the video camera was located on the first floor of the house and was exclusively directed at the access to the flats of top numbers XXXX, which were combined, and XXXX. Only persons going directly to one of these flats could be recorded, other flat entrances were no longer accessible from this part of the corridor. However, these rented properties had not been rented by the co-owner, but by his son and daughter. In 2010, there had been a break-in and several objects had been stolen. As a result of this, the co-owner, together with his son, had consulted the owner of the house and obtained permission to install a video camera in this area. For the time being, a dummy video camera had been installed to deter burglars. The video camera currently visible and installed there in the photograph was completely non-functional. It was correct that he lived in the flat TOP XXXX, but it was not correct that he had an office in the flat TOP XXXX, which was run by his son. TOP XXXX was also on the ground floor, where no camera was installed. 8.
By letter of 1 April 2019, the authority again requested the co-owner to submit a statement and asked him to explain whether it was a dummy camera that was not functioning or whether it was a camera that was basically functioning but merely switched off, as well as to name the specific type of camera, to submit any existing invoice, and to submit a photo proving that it was not functioning, e.g. because the cabling was missing, or other evidence.
In his statement of 30 April 2019, the co-owner explained that the camera installed was a Digital LS DVR camera, which was defective and therefore a non-functional dummy camera. The installed camera could not be activated merely by switching it on. A photo evidence of the damage could not be produced, as the camera suffered from a technical defect. 10.
On 20 May 2019, the authority concerned forwarded the comments of the co-participant to the complainant and gave her the opportunity to comment.
In her written statement of 29 May 2019, the complainant commented that it was not correct that the co-owner and/or his son had consulted her or another person in charge regarding the installation of the camera. With regard to the incorrectly alleged malfunctioning of the camera, a photocopy was submitted on which the unauthorised wiring of the surveillance camera by the co-partner was clearly recognisable. Reference was also made to Exhibit ./B, on which it was clearly visible that a red light was shining, which usually indicated an active, recording camera. Despite being requested to do so by the prosecuting authority, the co-participant had not provided any proof of the camera's inoperability and was untrustworthy in every respect. In this regard, reference was also made to Exhibit ./F, according to which the complainant had stated that he had an office in the building in question. 12.
In its letter of 21 June 2019 to the complainant, the authority stated that no red light of a camera was recognisable for the authority on the submitted photos. The complainant was requested to specify on which enclosure and where the red light could be seen. 13.
In its statement of 01.07.2019, the complainant once again submitted the third photograph of the photocontract enclosure ./B and stated that it was a camera whose lens was surrounded by a two-row white arc of light. Only below the lens did this arc of light end and was connected there by only one red luminous light, which was marked with an arrow. This distinctive sign of a red glowing light indicated that the camera was indeed functional, or at least connected to the electric circuit.
At the request of the authority concerned, the complainant again submitted a photo of the said camera on 15 July 2019.
On 07.08.2019, the relevant authority sent the co-participant the comments of the complainant and gave him the opportunity to comment within three weeks. 16.
By letter of 08.10.2019, the authority again requested the co-participant to state which camera model it was and to comment on the red light or the red glow. 17.
In a statement dated 20 December 2019, received by the authority on 9 January 2020, the co-participant submitted a photo showing the model number of the camera. With regard to the red dot on the lamp, it was explained that this was an infrared lamp for night vision. In fact, however, the camera did not work and still does not work today. A repair of the camera had not yet been carried out, as the result of the data protection authority was awaited first. 18.
The authority concerned sent the complainant the statement of the co-participant on 28 January 2020 and gave her the opportunity to comment. 19.
The complainant submitted a statement on 20 February 2020, in which she explained that the co-participant had not yet succeeded in proving that the installed camera was inoperable, that the complainant had not submitted an invoice even when requested to do so, and that he had not named the type of camera. It also had to be pointed out that the most recently submitted enclosure of the co-owner was a photograph of the camera's receiver. Thus, only the model number of the receiver had been submitted. The existence of a receiving device spoke all the more in favour of the permanent storage of video recordings. 20.
In the contested decision, the authority dismissed the complaint on the grounds of violation of the right to secrecy and the right to deletion as unfounded (decision I.) and rejected the applications for uninstallation of the camera, for an order to refrain from future interventions and for the initiation of administrative penal proceedings (decision II.).
In justifying its decision, the authority first stated (after repeating the course of the proceedings) that the subject of the complaint was the question of whether the co-participant had violated the complainant's right to secrecy by operating a functioning video camera in the residential building on a (more specifically named) property. In this context, the complainant's request to order the co-participant to delete the recorded data had to be addressed. The authority concerned assumed that, on the basis of this application, it would also have to rule on a violation of the right to erasure. Finally, the further requests of the complainant regarding the uninstallation of the camera, the order to refrain from future interventions and the initiation of administrative penal proceedings had to be addressed.
The authority found that the complainant lived in flat TOP XXXX of the flat in question and that there had been a burglary at the address mentioned in 2010, which was why the complainant, in agreement with his son, had installed the video camera in question in 2010. The video camera was located on the first floor and was directed at the entrance to the flats XXXX and XXXX. The camera was non-functional and served as a deterrent against burglars. The other party had not used the video camera to take any pictures showing the complainant.
In its assessment of the evidence, the prosecuting authority summarised that the statements of the co-participant were credible and that there was also no apparent reason why the co-participant should take pictures of the complainant.
Legally, the authority stated that in this case, due to the inoperability of the camera, it was impossible that personal data of the complainant would be processed; the mere impression of being "observed" was not sufficient for a violation of section 1(1) of the Data Protection Act. The complaint regarding the violation of the right to erasure (and the related request to order the co-participant to erase the data) had already had to be dismissed due to the lack of a request for erasure; moreover, the camera was also inoperable, which was why there was no "recorded data" that the authority could order to be erased. As far as the complainant requested the uninstallation of the camera and the order to refrain from future encroachments on the right to secrecy, it had to be pointed out that proceedings on the grounds of an alleged violation of the right to secrecy could only be directed at establishing a violation of the law - which was due to an unauthorised use of data. It was therefore not possible to make an order for removal in such proceedings. Finally, it had to be noted that administrative penal proceedings could only be initiated by an affected person, there was no right to initiate such proceedings, which is why the decision had to be made in accordance with the ruling. 20.
20 The complainant filed an appeal against this decision with the Federal Administrative Court through her legal representation in a written submission dated 14 April 2020.
First of all, it was stated that the decision was being contested in its entirety because of the unlawfulness of its content and the violation of procedural rules. The co-participant had not proved the inability of the camera to function, despite the order of the authority, but had merely asserted, unsubstantiated and unsubstantiated, that the camera was inoperable. It had to be assumed that this assertion did not correspond to the facts, especially as it had turned out that the red infrared light on the camera was on. The authority in question had completely disregarded this fact. It was also not a mere dummy camera, but a fundamentally functioning camera that was merely in need of repair. Due to the existence of a functioning camera, which had been installed without consent, there was in any case a violation of data protection.
However, even in the event that the camera was not fully functional due to lack of repair, a data protection violation had to be assumed, since the co-participant himself had admitted that he would repair the camera after the conclusion of the proceedings, and it was unreasonable to expect the complainant and the other residents of the house to constantly check whether the camera had been repaired or not after the conclusion of the proceedings, as announced by the co-participant. Contrary to the assessment of the authority, the impression of being observed was not merely created, but rather there was a concrete fear that the camera would be repaired at any time and that concrete recordings would be made.
In its letter of 16 April 2020, the authority submitted the administrative act and the complaint - without making use of the possibility of a preliminary decision on the complaint - to the Federal Administrative Court and issued a statement on the matter.
Due to the fact that, according to the complainant, the inability of the camera to function had not been proven beyond doubt, it could not be assumed, conversely, that the camera had been functional and, moreover, that footage of the complainant had been taken. The complainant's further argument that the other party could repair the camera and that data protection violations could occur in the future could also remain undecided, since the public authority could only determine a violation of the right to secrecy ex post, which is why a complaint in this regard regarding possible future violations could not be successful due to the lack of a complaint at the time of the decision. In the case at hand, no procedural rules had been violated, the authority concerned had dealt in detail with the question of the functioning of the camera and had investigated the complaint "to a reasonable extent" pursuant to Art. 57(1)(f) of the GDPR.
On 07.09.2020, an oral hearing took place before the Federal Administrative Court, in which several witnesses were heard and the parties to the proceedings were also questioned. During the oral hearing, the complainant (who was represented by a lawyer) also clarified that the complaint asserted the inadmissibility of the image recording as well as a violation of the right to erasure and the right to confidentiality, and that the de-installation would still be requested. The application for the initiation of administrative penal proceedings was also maintained.
According to the parties, an out-of-court settlement was not reached, which was communicated by the complainant in a letter dated 17 September 2020.
II. the Federal Administrative Court considered:
1. findings:
The course of proceedings stated under point I. is taken as a basis for the findings.
During the week, the co-participant inhabits the flat in XXXX TOP XXXX In 2010, there was a burglary at the aforementioned address and construction tools were stolen from there, which is why the co-participant, in agreement with his son XXXX , who inhabits TOP XXXX, and his daughter XXXX , who rents TOP XXXX, procured a video camera in the same year and installed it himself. From the point of view of the video camera, the entrance door to TOPs XXXX , a door to another rented flat (TOP XXXX ), which however cannot be used because a plaster wall has been put up inside, as well as a window and a bassena (the latter half) were covered. The camera did not capture that part of the staircase which is used by all persons who want to get to a higher floor.
In 2010, the co-appellant obtained the consent of the then house owner, Ms XXXX , to install the camera.
The complainant is the beneficiary of the XXXX XXXX property.
The complainant learned of the existence of the camera in 2016 from her son. In 2018, a house inspection took place, after which the complainant was also made aware of the existence of the camera. She then lodged a complaint with the relevant authority.
The complainant did not submit a request for deletion of her personal data to the co-participant prior to her complaint to the authority concerned.
The co-participant checked the functionality of his camera during the proceedings before the prosecuting authority in 2018 and found that it was no longer working and that no image data was stored on the memory card. The co-perpetrator left the video camera connected to the power supply in place for deterrent effect. After the conclusion of the proceedings before the prosecuting authority in 2020, the co-participant removed the storage device and disposed of it.
It cannot be established that the co-perpetrator used the said video camera to take footage showing the complainant. It must therefore be assumed that there is no such recording.
2. assessment of evidence:
The findings result from the administrative and judicial record, in particular from the transcript of the oral proceedings before the Federal Administrative Court.
The finding that the co-participant took the decision to install a video camera in agreement with his son XXXX and his daughter XXXX not only results from the statements of the co-participant in the proceedings before the authority concerned of 25 March 2019, but was also corroborated by the testimony of his son and his own testimony in the oral proceedings. The fact that the co-participant also reached agreement with his daughter XXXX is evident from her statements. At the oral hearing, the co-owner himself also stated that he had installed the camera. That the consent of the then owner of the house was obtained in 2010 is evident from the credible testimony of the co-owner and his children who were heard as witnesses.
That the camera's angle of view only covered the area of the corridor leading to the living area of the co-partner and his family is clear from the statements of the co-partner and the testimonies of his children as well as from the photos submitted by the complainant, whereby it must be borne in mind that these photos were taken at ground level, which is why the statement of the co-partner's daughter is followed that (when viewed from above) only half of the washbasin was covered. The fact that the camera angle only captured the corridor area leading to the door of the co-partner's family was also not disputed by the complainant. That the door to XXXX, which was in the angle of view, could not be used was confirmed by three witnesses, in particular also by the complainant's son.
The fact that the flats of the co-partner's family were broken into in 2010 is evident from the complaint he submitted.
The fact that the complainant is the holder of the usufructuary rights to the aforementioned property is clear from her own statements and from the extract from the land register that she submitted. The fact that the complainant learned of the existence of a camera from her son in 2016 is clear from her own testimony at the oral proceedings before the Federal Administrative Court. The complainant's son also stated that he had noticed the camera "a few years ago". The fact that the complainant was (also) informed of the existence of the camera after an inspection of the house is clear from her complaint to the authority concerned. The fact that the complainant did not apply to the co-participant for deletion is clear from the statements of the co-participant. This statement was also never disputed by the complainant and she also did not submit a corresponding request for deletion in the proceedings before the authority concerned.
The fact that the camera has not been functioning since 2018 at any rate is clear from the co-participant's statement of 25.03.2019 in the proceedings before the prosecuting authority and from his own statements in the oral proceedings before the Federal Administrative Court. The fact that a red light is on does not contradict this because the camera, which is no longer capable of recording, is still connected to the power supply. The fact that the party removed the storage device in 2020 corresponds to the credible statements made by the co-party at the oral hearing and also correlates with the perception of the complainant's son, who stated during his examination as a witness that apparently "something was done in the area of the camera" between Christmas last year and the oral hearing and that the wooden facing of the camera was cut open.
The fact that it was not possible to establish that footage had been taken in which the complainant could be seen follows on the one hand from the statements of the co-participant and on the other hand from the fact that the complainant herself was not able to present any evidence of this. Moreover, according to their own statements, the co-participant and his daughter checked the functioning of the camera a few weeks after it had been installed and in any case did not see any pictures showing the complainant. It is clear from the statements of the co-participant that there was no further viewing of the data thereafter, as there were no incidents and it was only in 2018, during the data protection proceedings, that it was established that the camera was no longer functional. The fact that the camera is not functional cannot be refuted by the testimony of the property manager, who testified that an electrician had carried out a check of the camera and found it to be activated, as it can be assumed that the electrician only carried out a check from the outside and was able to determine that it was connected to the power. However, it cannot be assumed that he removed the storage device and checked it, as otherwise (especially the complainant's son, who regularly inspects the house) changes (as they have now taken place by removing the storage device) must have been noticed. The witness also did not remember what the electrician's "findings" consisted of, only that he apparently assumed that the camera was activated. He did not remember whether there was anything in writing from the electrician. The complainant, who was apparently informed of the "findings" of the inspection in 2018 or during the proceedings before the authority, subsequently only stated in the proceedings before the DPO that the camera had a red light, which indicated that the camera was activated (which does not indicate that the camera had been examined in detail).
For the sake of completeness, it is pointed out that the complainant claimed that she only learned about the existence of the camera in 2016, through her son, so that it can be assumed that she had not entered the corridor area in front of the security door at all or only very rarely. When the complainant stated that - since a new tenant has been living in the TOPs XXXX - she increasingly visits the Bassena in order to clean it, it must be countered that at any rate since 2018, presumably also for some time before that, the camera was and is inoperative and that, according to the statement of the complainant's son, the new tenant only moved in about half a year ago.
Re A)
3.1 Pursuant to Art. 130 para. 1 no. 1 of the Federal Constitution, the administrative courts rule on complaints against the decision of an administrative authority on grounds of unlawfulness.
Pursuant to section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides by single judges, unless federal or provincial laws provide for decisions by senates. Pursuant to section 27 of the Data Protection Act (DSG) as amended (which essentially corresponds to section 39 DSG 2000, which was in force until 24 May 2018), the Federal Administrative Court decides in proceedings on appeals against decisions, on the grounds of violation of the duty to inform pursuant to section 24(7) and the duty of the data protection authority to decide by a senate. The senate consists of a chairman and one expert lay judge each from the circle of employers and employees.
The procedure of the administrative courts, with the exception of the Federal Finance Court, is regulated by the Administrative Court Procedure Act (VwGVG) (§ 1 leg.cit.). Pursuant to section 58 subsection 2 VwGVG, conflicting provisions that have already been promulgated at the time of the entry into force of this Federal Act shall remain in force.
3.1.2 Pursuant to § 17 VwGVG, unless otherwise provided for in this Federal Act, the provisions of the AVG, with the exception of §§ 1 to 5 and Part IV, as well as other more specifically mentioned laws (not relevant in the present case) and otherwise those procedural provisions in federal or provincial laws which the authority applied or should have applied in the proceedings before the administrative court shall apply mutatis mutandis to the proceedings on appeals pursuant to Art. 130 para 1 B-VG.
3.1.3 Pursuant to § 28 para 1 VwGVG, the Administrative Court shall settle the case by way of a decision, unless the complaint is to be dismissed or the proceedings are to be discontinued. Pursuant to section 31 (1) VwGVG, decisions and orders shall be made by decision, unless a finding is to be made.
Pursuant to § 28 para 2 VwGVG, the administrative court shall decide on the merits of appeals pursuant to Art. 130 para 1 subpara 1 B-VG if the relevant facts have been established or if the establishment of the relevant facts by the administrative court itself is in the interest of speed or entails a considerable saving of costs.
3.2 On the procedural requirements:
The appeal was filed in due time pursuant to section 7 (4) VwGVG and the other procedural requirements are also met.
3.3 Part A) Dismissal of the appeal:
3.3.1 Legal situation
The authority concerned based its decision on the following legal bases:
Art. 4(1), (2) and (7), Art. 12(3), Art. 17 and Art. 77 of Regulation (EU= 2016/679) (General Data Protection Regulation, hereinafter: DSGVO, OJ No. L 119 of 04.05.2016 p.1 and §§ 1 para. 1 and para. 3 line 2 as well as 24 para. 1 and 5 of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended. These provisions are also to be applied in the present appeal proceedings before the Federal Administrative Court. Furthermore, Article 24 (2) and (3) of the Data Protection Act is also relevant.
Article 4(1), (2) and (7) of the GDPR read:
"Article 4
Definitions
For the purposes of this Regulation:
(1) 'personal data' means any information relating to an identified or identifiable natural person (hereinafter 'data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
(2) 'processing' means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
(7) 'controller' means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for under Union or Member State law;".
§ Section 12(3) of the GDPR reads:
"(3) The controller shall provide the data subject with information on the measures taken upon request pursuant to Articles 15 to 22 without undue delay and in any event within one month of receipt of the request. That period may be extended by a further two months if necessary taking into account the complexity and the number of requests. The controller shall inform the data subject of any extension of the time limit, together with the reasons for the delay, within one month of receipt of the request. If the data subject makes the request electronically, he or she shall be informed by electronic means where possible, unless he or she indicates otherwise."
Art. 17 GDPR reads:
"Art. 17
Right to erasure ("right to be forgotten")
(1) The data subject shall have the right to obtain from the controller the erasure without delay of personal data concerning him or her, and the controller shall be obliged to erase personal data without delay, where one of the following grounds applies:
a)
The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
b)
The data subject withdraws the consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) and there is no other legal basis for the processing.
c)
the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2).
d)
The personal data have been processed unlawfully.
e)
The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
f)
the personal data have been collected in relation to information society services offered in accordance with Article 8(1).
Where the controller has made the personal data public and is obliged to erase it in accordance with paragraph 1, the controller shall take reasonable steps, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers which process the personal data that a data subject has requested them to erase any links to, or copies or replications of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that the processing is necessary in order to
a)
for the exercise of the right to freedom of expression and information;
b)
compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c)
for reasons of public interest in the field of public health as referred to in points (h) and (i) of Article 9(2) and Article 9(3);
d)
for archiving, scientific or historical research purposes in the public interest or for statistical purposes pursuant to Article 89(1), where the right referred to in paragraph 1 is likely to make impossible or seriously prejudice the achievement of the purposes of such processing; or
e)
for the establishment, exercise or defence of legal claims.
Article 77 GDPR reads:
"Article 77
Right to lodge a complaint with a supervisory authority
1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her residence, place of work or the place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78."
§ Article 1(1) and (3) of the FADP read:
"Article 1
(Constitutional provision)
Fundamental right to data protection
(1) Everyone shall have the right, in particular also with regard to respect for his private and family life, to confidentiality of personal data concerning him, insofar as there is an interest worthy of protection. The existence of such an interest shall be excluded if data is not accessible to a claim to secrecy due to its general availability or due to its lack of traceability to the person concerned.
(3) Insofar as personal data relating to the data subject are intended for automated processing or for processing in manual files, i.e. files maintained without the support of automated systems, everyone shall have the following rights in accordance with statutory provisions
1. the right to be informed about who processes which data concerning him/her, where the data originate from and what they are used for, in particular also to whom they are transmitted;
2. the right to have inaccurate data corrected and the right to have inadmissibly processed data deleted.
§ Section 24 (1), (3), (4) and (5) DSG read:
"SECTION 24 DSG
Complaint to the data protection authority
(1) Every data subject shall have the right to lodge a complaint with the data protection authority if he or she is of the opinion that the processing of personal data relating to him or her violates the GDPR or Section 1 or Article 2 1st main section.
(3) A complaint shall be accompanied, if applicable, by the underlying request and any response by the respondent. The data protection authority shall provide further assistance in the case of a complaint at the request of the data subject.
(4) The right to have a complaint dealt with shall expire if the person lodging the complaint fails to do so within one year of becoming aware of the event giving rise to the complaint, but at the latest within three years of the event alleged to have taken place. Late complaints shall be rejected.
(5) If a complaint proves to be justified, it shall be upheld. If an infringement is attributable to a private sector controller, the latter shall be ordered to comply with the complainant's requests for information, correction, deletion, restriction or data transfer to the extent necessary to remedy the established infringement. Insofar as the complaint proves to be unjustified, it shall be dismissed.
3.3.2 Applied to the specific case, this means the following:
With regard to paragraph 1 of the contested decision
1) On the right to confidentiality and the violation of Article 12 of the Data Protection Act and Article 6 of the GDPR:
At the oral hearing, the complainant stated that the period of time during which unlawful records had been made about her was "approximately 2016 until now". As was revealed in the evidentiary proceedings, the camera installed by the co-participant had been defective in recent years and personal data had not been stored. The complainant was also unable to prove that personal images of her had been taken. As the Administrative Court explained, in the case of non-determinability, it is to be assumed that the fact does not exist (Administrative Court of 16 June 1992, ref. 92/08/0062).
Since in the present case it must therefore be assumed that no personal data of the complainant was processed, there can also be no violation of the fundamental right to the protection of personal data enshrined in Section 1 (1) of the Data Protection Act. In this respect, there could also be no violation of Article 6 of the GDPR (which was not even addressed by the complainant) or of Section 12 (the applicability of which in the area of private video surveillance was denied by the Federal Administrative Court in the first place, see the statements in W211 2210458-1/10E of 25.11.2019 and W256 2214855-1/6E of 20.11.2019).
The authority concerned must also be agreed that it (and also the Federal Administrative Court at first instance) cannot rule on an encroachment on the complainant's private sphere due to the impression of being "observed", but that this could at best be asserted in civil proceedings pursuant to section 16 of the Austrian Civil Code (see OGH of 20.01.2012, Zl 8 Ob 125/11g, etc.). The mere impression of being "observed" does not constitute a violation of Section 1 (1) of the Data Protection Act.
As far as a violation of other persons' right to confidentiality was raised in the proceedings, it must be stated that a violation of the right to confidentiality can only be asserted by the person concerned for himself, but not for other persons who were or are on the premises.
2 Right to deletion
Apart from the fact that it turned out in the oral hearing before the Federal Administrative Court that no personal data of the complainant are stored at all and that the storage device has been disposed of in the meantime, the complainant has also not filed a request for deletion of her personal data with the co-participant.
As the authority concerned rightly points out, the right to erasure requires an application pursuant to Article 1(3)(2) in conjunction with Article 17 of the GDPR. This means that the right to erasure can only be asserted as a subjective right in the context of a complaint procedure pursuant to Article 77(1) of the GDPR in conjunction with Article 24(1) of the GDPR if the data subject has submitted such a request for erasure to the (alleged) controller in advance pursuant to Article 12(3) of the GDPR. Pursuant to Article 24 (2) of the Data Protection Act, a complaint must be accompanied, if applicable, by the underlying request and any response by the respondent. A request for deletion was not made to the co-participant and this was not even alleged in the complaint proceedings before the authority concerned. Only the request was made to the prosecuting authority to order the co-participant (respondent in the proceedings before the prosecuting authority) "to delete the recorded data".
The complaint was therefore to be dismissed on this point.
Regarding point 2 of the contested decision:
a) Regarding the application for the uninstallation of the camera and the order to refrain from future interventions:
Here, too, the argumentation of the authority concerned is to be followed, namely that proceedings on the grounds of an alleged violation of the right to secrecy can only be directed at establishing a violation of the law - which can be traced back to an unauthorised use of data. A claim for removal is not possible in such proceedings and cannot be derived from section 1(1) of the FADP (BVwG of 14.03.2019, Zl. W256 205433-1).
The complaint was therefore to be dismissed on this point as well.
b) On the application for the initiation of administrative penal proceedings:
As the authority concerned already stated in the contested decision, a subjective right to initiate criminal proceedings against a specific controller cannot be derived from Art. 77(1) or Art. 24(1) and (5) DPA and, moreover, the principle of official channels applies under Art. 25(1) VStG (cf. Fister in Lewisch/Fister/Weilguni [eds], VStG-Kommentar 2 [2017] Art. 25 Rz 1).
Administrative criminal proceedings can therefore only be initiated by a (possibly) affected person; there is no right to initiate such proceedings.
Therefore, the complaint was also to be dismissed on this point.
3.4 Part B) Inadmissibility of the appeal:
Pursuant to § 25a para 1 VwGG, the administrative court has to state in the ruling of its decision whether the appeal is admissible pursuant to Art. 133 para 4 B-VG. The decision shall be briefly substantiated.
The present decision does not depend on the solution of a legal question of fundamental importance. There is neither a lack of case law of the Administrative Court nor does the present decision deviate from the case law of the Administrative Court; furthermore, the present case law of the Administrative Court is not to be judged as inconsistent. There are also no other indications of fundamental importance of the legal questions to be resolved. The Federal Administrative Court can rely on the established case law of the Administrative Court or on a legal situation that is clear in any case. It is also not apparent that a legal question arises in the specific case that is of significance beyond the (here specific) individual case. On this basis, a legal question of fundamental importance within the meaning of Art. 133 (4) B-VG cannot be affirmed (cf. e.g. VwGH 25.09.2015, Ra 2015/16/0085, mwN). Therefore, it had to be stated that the appeal was not admissible pursuant to Art. 133 (4) B-VG.
Keywords
official channels right to removal data protection data protection authority data protection proceedings declaratory decision secrecy secrecy interest fundamental right to data protection erasure of personal data infringement of law administrative penalty proceedings video recording video surveillance
European Case Law Identifier (ECLI)
ECLI:AT:BVWG:2020:W214.2230473.1.00
In RIS since
21.12.2020
Last updated on
21.12.2020
Document number
BVWGT_20200925_W214_2230473_1_00
