BVwG - W256 2214855-1/6E
From GDPRhub
| BVwG - W256 2214855-1/6E | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 6(1)(f) GDPR 1 §1 DSG 2 §12 DSG §28 VwGVG |
| Decided: | 20.11.2019 |
| Published: | |
| Parties: | Anonymous |
| National Case Number/Name: | W256 2214855-1/6E |
| European Case Law Identifier: | ECLI:AT:BVWG:2019:W256.2214855.1.00 |
| Appeal from: | DSB (Austria) |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | n/a |
Federal Administrative Court sends case back to Austrian DPA, DSB (Austria), as crucial facts were not investigated by the authority.
English Summary
Facts
Different family members live in different parts of a house. One family member installed six cameras to film different parts of the property, claiming that for example postal letters were stolen. The other family members filed a "report" (Anzeige) with the DPA. The DPA understood the "report" to be a complaint under Article 77 GDPR. The DPA asked the local district authority (Bezirksverwaltungsbehörde) to investigate certain facts on behalf of the DPA and issued an order to stop the processing of personal data.
Dispute
The DPA has not found which exact areas were filmed and if the complaint was actually subject to CCTV surveillance. Has the DPA investigated all relevant facts?
Holding
It is crucial that the data of the complainant was de facto processed. The DPA made no such finding in the entire decision. The decision was therefore invalid and was returned to the DPA to make these investigations.
Comment
Share your comment here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the original. Please refer to the German original for more details.
DECISION
I. Procedure and facts of the case:
By several e-mails of 23 June 2018 addressed to the authority complained of, XXXX (hereinafter referred to as "the party involved") submitted "complaints" to the data protection authority. In this complaint, she essentially stated that she was under permanent surveillance on the property inhabited jointly with her divorced husband, the complainant, by means of cameras installed by their son XXXX, and submitted, inter alia, photographs showing the cameras and their installation.
By letter of 13 July 2018, the authority in charge of the case asked the complainant to comment on these allegations of the co-involved party.
In a letter of 26 July 2018, the complainant submitted that it was correct that he had mounted cameras on the part of his house because, inter alia, "there had always been mail disappearances in recent times". However, with his four cameras, he was filming only his property and his grounds and not the party involved or their home.
In its e-mail received by the authority complained of on 26 July 2018, the co-involved party draws the attention of the authority complained of to the fact that it has had to suffer "reprisals and attacks" by the complainant that have been described in detail for years. The complainant spread various untrue allegations, such as that his mail was stolen. However, the complainant is only looking for a reason for his illegal camera installations. Moreover, the complainant consistently denies the cameras because he has meanwhile replaced some large cameras with hidden cameras. The co-operating party submitted, inter alia, a "WhatsApp correspondence" between itself and its son, XXXX. In this correspondence, XXXX informs the co-operating party (without specific reference to any particular facts) that "there is sound everywhere" and that he has connected two microphones on a server to the hard disk so that everything is always double backed up.
In a letter dated 27 July 2018, the prosecuting authority addressed the following request for administrative assistance (reproduced in extracts) to the District Administration XXXX (hereinafter referred to as the District Administration):
"...
Within the scope of the data protection proceedings, the question of the admissibility of image processing is at issue. In summary, the complainant submitted that the respondent had mounted several cameras on the aforementioned property, the recording area of which covered the area of the complainant's life (see the transmitted images). In order to assess the present case, an on-site inspection is necessary.
The data protection authority may therefore make the polite request,
that the district administration XXXX at the property ....
The data protection authority will then carry out an inspection, obtain a personal impression and, if necessary, transmit pictures of the cameras in question to the data protection authority.
.."
In response to the request for administrative assistance by the authority in question, the district administration explained in a letter dated 17 September 2018 to the authority in question that an on-site inspection had been carried out on 13 September 2018 in the presence of the party involved. It was established that the cameras visible on the transmitted photographs had been removed, but that the wiring was still in place. The complainant had explained to the District Council that he had been informed by his lawyer that the co-operating party was allowed to stay on the entire property, whereupon he had removed all cameras.
In its statement of 7 December 2018, the co-involved party, which had in the meantime been represented by a lawyer, stated that due to the surveillance in question it had in the meantime also filed an action for injunction with the District Court against the complainant. Since then, the cameras listed and precisely described in the "complaint" have, with a few exceptions, been removed by the complainant and replaced by new, more detailed cameras and "mini-lenses". The co-involved party, on the basis of a right in rem to use a flat, lived in one half of a semi-detached house on the complainant's property and was entitled to free residence, movement and use of the entire property. The only exception to this was the premises in the semi-detached house occupied by the complainant. Under one of them, the co-involved party submitted photographs of the cameras now located on the property.
By letter of 10 January 2019, the complainant commented on the new cameras and "mini-lenses" alleged by the co-involved party.
The contested decision upheld the co-defendant's complaint and found that the complainant had infringed the co-defendant's right to confidentiality by "improperly taking photographs of the property jointly occupied by [the] complainant and [the] respondent ... at least [from] June 2018 to September 2018". In this regard, the authority complained of first stated that - as the preliminary proceedings had shown - at the time of the conclusion of the present proceedings before the data protection authority, no cameras operated by the complainant were any longer visible on the property in question. However, at least from June 2018 to September 2018, the complainant had installed and operated at least six functioning cameras on the jointly inhabited property. This was apparent from the submission of the co-involved party of 23 June 2018 and the photographs submitted. For example, it was clear from the photographs that there was a camera installed in the window of the complainant's semi-detached house, which was directed towards the forecourt. Three further cameras, each of which was oriented in a different direction, were placed on a sloping beam. A second sloping beam and a camera in the carport were also equipped with one camera each. In his observations of 28 September 2018, the complainant had himself stated that four cameras had been mounted on the part of his house that he owned. The submitted WhatsApp correspondence between the co-investigating party and XXXX also indicated that several cameras, including a possible sound recording, had been installed on the shared property. Thus, XXXX had indicated to the co-involved party that "there was sound everywhere" and that "two microphones on a server were connected to the hard disk". Moreover, in his opinion of 23 November 2018, the complainant himself stated that "all cameras including cabling" had been removed in the meantime. It had therefore to be assumed that at least 6 cameras had been installed on the property in question. The time period determined was based on the time of the submission and the inspection by the district administration, according to which the clearly visible cameras had apparently been removed and were therefore no longer visible. In legal terms, the prosecuting authority stated that a violation of the right to secrecy, unlike the case law under para. 16 of the Austrian Civil Code, which also covers camera dummies, was based on a personal reference. In the present case, the operation of at least 6 cameras had undisputedly resulted in the recording of images within the meaning of sec. 12 of the DPA. It could be derived from the case-law of the Supreme Court that the exterior of an apartment door encompasses the highly personal sphere of life because it can record the entry and exit of the apartment door of the person concerned. In the present case, the cameras in question were cameras whose recording area had covered the most personal sphere of life of the party involved. In so far as the complainant argued in this connection that these were cameras that had been installed on the part of his house, it must be pointed out to him, with reference to the Ordinance on Exemptions from the Data Protection Impact Assessment (DSFA-AV), Federal Law Gazette II No. 108/2018, that the installation of cameras on a jointly inhabited property requires the consent of all persons entitled to use them. Against this background, the image processing subject of the proceedings is not accessible for a justifiable weighing of interests. Such image processing would only be admissible with the express consent of the party involved, which was not present in the present case.
The present appeal of the complainant is directed against this. The complainant essentially submits that it cannot be inferred from the contested decision where the six incriminated cameras were located and which of these cameras allegedly took inadmissible images. As the complainant had already pointed out in his observations of 26 July 2018, he had used the cameras to film only his own area. Moreover, the complainant had not installed a camera himself, but had done so in XXXX. With the exception of the camera that exclusively filmed the complainant's letterbox, XXXX had acted independently when installing the cameras.
The authority complained of submitted the complaint together with the administrative act to the Federal Administrative Court and submitted a written reply.
II Evaluation of evidence: The course of the proceedings and the facts of the case as described above result from the submitted administrative act.
II The Federal Administrative Court considered
Legal assessment:
Re A) Pursuant to § 28.3, second sentence, VwGVG, the Administrative Court can overturn the contested decision by order and refer the matter back to the authority for a new decision if the authority has failed to carry out necessary investigations of the facts. According to § 28 (2) no. 2, this procedure presupposes that the determination of the relevant facts by the Administrative Court is not in the interest of expediency or is not associated with a significant cost saving.
In its decision of 26 June 2014, Zl. Ro 2014/03/0063, the Administrative Court held that a referral of the case back to the administrative authority for the purpose of conducting necessary investigations pursuant to § 28.3 second sentence VwGVG will be considered in particular if the administrative authority has failed to carry out any necessary investigative activity, if it has merely taken completely unsuitable investigative steps to establish the relevant facts or has only made a rudimentary investigation. The same applies if concrete indications lead to the assumption that the administrative authority failed to carry out (possibly difficult) investigations so that these can then be carried out by the Administrative Court (see also the order of the Administrative Court of 25 January 2017, no. 1 (2)). Ra 2016/12/0109, margin no. 18 et seq.)
In the present case, on the basis of a "report" by the co-party, the authority complained of found in the contested decision that the co-party had violated the complainant's right to secrecy, because the complainant had inadmissibly taken photographs on the (partly) jointly inhabited property until the time of the inspection of the property by the district administration in September 2018, without the consent of the co-party, using cameras that had in the meantime been removed.
However, no further details on whether and, if so, to what extent the part of the property covered by the right of use of the co-involved party or the co-involved party was at all affected by such image recordings in the past are contained in the entire notice and were not even taken into account by the prosecuting authority in the entire investigation proceedings.
It is true that in its letter of 13 July 2018, the authority incriminated requested the complainant as a whole to comment on the accusation of the other party involved that it was permanently monitored by him. However, in his opinion of 26 July 2018, the complainant stated that he would not film the co-involved party using the cameras.
A further dispute with a picture of the co-party involved that was taken in the past by the complainant did not (no longer) take place on the part of the prosecuting authority. Rather, the subsequent request for administrative assistance was limited to the current situation on the ground and the taking of photographs from (still existing) cameras.
In accordance with the investigative proceedings conducted by the prosecuting authority and described above, the contested decision does not contain any findings that could support the legal assessment of the prosecuting authority that the complainant had controlled the movements of the party involved and thus its "most personal area" up to that point in time by removing the cameras at the latest at the time of the on-site inspection. In any event, the mere findings contained therein, according to which the complainant had not currently operated and installed any cameras on the jointly inhabited property, but had operated and installed at least 6 cameras by the time of the on-site inspection in September 2018, cannot in themselves support this legal assessment by the prosecuting authority.
Pursuant to Section 1 (1) 1st sentence of the Data Protection Act, Federal Law Gazette I 1999/165 as amended by Federal Law Gazette I 2019/14 (hereinafter: DSG), everyone has the right to confidentiality of personal data concerning him or her, in particular with regard to respect for his or her private and family life, provided that there is an interest worthy of protection.
Pursuant to Section 24 (1) of the DPA, every data subject has the right to lodge a complaint with the data protection authority if he or she considers that the processing of personal data relating to him or her is in breach of the Previous Search TermDSGNext search term or of Section 1 or Article 2 1st main item.
As can be seen from Section 1 of the DPA (in accordance with Art. 1 (EU) 2016/679), OJ L 2016/119, 1 (hereinafter: Previous Search TermDSGVONnext Search Term)), and as has also been clarified by the Data Protection Authority itself in its legal submissions, a breach of the right to data protection presupposes the processing of ("personal") data relating to a specific person. Accordingly, Article 24 of the Data Protection Act also grants only the person affected by a data processing operation a right of appeal to the data protection authority.
Without knowledge of the complainant's specific data processing of the party involved, it is therefore not possible to assess whether the right to data protection of the party involved has been violated at all.
The mere assertion of the co-party in its "report" that it is being monitored by the complainant by means of cameras is in any case not in itself suitable to show data processing concerning it and thus an infringement of its right to secrecy. This is also not changed by the photographs of the cameras submitted, since they cannot show that the complainant operates the cameras per se and, if so, the only decisive scope of the cameras. Similarly, a "WhatsApp correspondence" between her and her son, submitted by the co-involved party, cannot provide any suitable information about the actual coverage of cameras operated by the complainant and thus about image processing by the co-involved party, especially since no statements were made about this in this correspondence anyway.
In this connection, it is not disregarded that the complainant - according to his own submissions in the proceedings and even in his complaint to the Federal Administrative Court - has expressly confirmed that image surveillance of "his reason" was carried out on his behalf and specifically from his letterbox.
However, the monitoring of the complainant's own mailbox cannot - in particular with regard to a lack of a right of use of the co-involved party with regard to the complainant's semi-detached house located on the property - (without further ado) justify data processing concerning the co-involved party.
Apart from that, even in the case of a (resulting) monitoring of the jointly used part of the property, an unlawful data processing concerning the co-involved party would not automatically be assumed.
According to the provision regulating the lawfulness of data processing in Art. 6 (1) of the Data Protection Act, the next search term in the relevant (for private) lit f) here is lawful if processing is necessary to safeguard the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh the interests or fundamental rights and freedoms of the data subject, especially if the data subject is a child.
Accordingly, Article 6(1)(f) of the Data Protection Act provides for two cumulative conditions for the processing of personal data to be lawful, namely, first, that the processing of personal data is necessary for the purposes of realising the legitimate interest and, second, that the interests or fundamental rights and freedoms of the data subject(s) do not prevail.
In the context of a balancing of interests - according to recital
47 - to take into account, without doubt, whether a data subject is entitled to
the time of collection of the personal data and can reasonably foresee, in view of the circumstances in which it is collected, that processing for that purpose may be carried out.
Even if the complainant were to carry out any image processing of the jointly used property or of the co-participating party, it would not automatically be assumed that an image recording affecting the co-participating party would be inadmissible, but rather the authority in question would be required, after determining the actual scope of the image processing and its purpose, to weigh up the interests and subsequently also the proportionality.
The provision of § 12.4 no. 1 DPA, which is used by the authority in question, does not change this, because the opening clauses contained in Article 6.3 and 6.4 Previous Search TermDSGFollowing Search Term exclusively apply to processing pursuant to Article 6.4 DPA. 1 lit. c ("to fulfil a legal obligation") and lit. e ("for the performance of a task carried out in the public interest or in the exercise of official authority") and therefore do not apply to data processing for private purposes regulated by Article 12 DPA (video surveillance) (see also
Bresich/Dopplinger/Dörnhofer/Kunnert/Riedl, DSG (2018), page 145).
The deviating provision in § 12.4 no. 1 of the DPA on the previous search termDSG of the next search term, according to which the taking of a picture without the express consent of the person concerned in his or her highly personal sphere is generally impermissible and thus without weighing up the interests, would therefore not be applicable for this reason alone (also by the recognising court) (see below).a. VwGH 10.10.2018, Ra 2017/03/0108, according to which every national court seised within the scope of its jurisdiction is obliged, as an organ of the Member State, to apply directly applicable Union law without restriction and to protect the rights which it confers on individuals, in application of the principle of cooperation laid down in Article 4 (3) TEU. The validity of Union law cannot be affected by a Member State through provisions of national law, even if they have constitutional status. Where it is not possible to ensure the full effectiveness of Union law by interpreting national law in conformity with Union law, a national court must ensure the full effectiveness of those Union law rules by giving them primacy of application, by disapplying any provision of national law which may conflict with them on the basis of its own decision-making power).
Even the lack of inclusion of a data processing operation in the list of processing operations provided for in Article 35(5) of the Data Protection Act, for which the controller is not required to carry out a data protection impact assessment, as pointed out by the defendant authority, does not automatically demonstrate the inadmissibility of such a processing operation, because it does not make any statement at all about the admissibility of a data processing operation. Rather, in the case of data processing that is likely to pose a high risk to the rights and freedoms of natural persons, compliance with data protection regulations is to be assessed and ensured precisely on the basis of such a data protection impact assessment that may be necessary under certain circumstances in accordance with Art. 35 (1) Previous search termGDPR Next search term (see on the necessity of a data protection impact assessment Art. 35 (1) Data Protection Act - Next search term). 3 Previous search termGDPR; see also Recital 211: "This impact assessment should in particular address the measures, guarantees and procedures designed to mitigate this risk, ensure the protection of personal data and demonstrate compliance with the provisions of this Regulation").
The fact that in the present case the prosecuting authority affirmed a violation of the co-involved party's right to secrecy due to image processing by the complainant in the past, without, however, having dealt with image processing affecting the co-involved party in any concrete way at all, means that the facts of the case remain in need of comprehensive supplementation in one essential point, which is why, in view of this particularly serious gap in the investigation, a referral back pursuant to § 28.1 of the Basic Law is necessary. 3 second sentence of the VwGVG is necessary and also justified (see in this regard the order of the Administrative Court of 20 October 2015, no. 1 of the Federal Law Gazette (Verwaltungsgerichtshof)). Ra 2015/09/0088).
It cannot be within the meaning of the Act for the Federal Administrative Court to carry out a supplementary investigation and thus to investigate and assess the relevant facts for the first time. It is not apparent that a direct further taking of evidence by the Federal Administrative Court would be "in the interest of speed or would be associated with a considerable saving of costs" - also in view of the increased expense associated with the Federal Administrative Court appeal proceedings as multiparty proceedings.
The requirements of § 28.2 VwGVG are therefore not met in the present case. Consequently, the proceedings had to be referred back to the authority complained of for a new decision.
In the continuation of the proceedings, the prosecuting authority will therefore have to deal with the complainant's image processing of the other party involved in the past and discuss it.
Pursuant to § 24.2 no. 1 VwGVG, oral proceedings could be omitted in the present case because it was already clear from the file that the contested decision was to be "revoked". This factual situation also applies to decisions to set aside and refer back (see § 67d para. 22 of the AVG [2007] on the similar earlier legal situation of Hengstschläger/Leeb.)
Re B) Admissibility of the appeal:
Pursuant to § 25a para. 1 VwGG, the Administrative Court must state in the ruling of its decision or order whether the appeal is admissible under Article 133 para. 4 B-VG. The statement must be briefly substantiated.
The appeal is inadmissible because no question of law within the meaning of Article 133.4 of the Federal Constitution was to be judged which is of fundamental importance: The fact that a referral of the case back to the administrative authority to conduct necessary investigations pursuant to § 28.3, second sentence, VwGVG can be considered in particular if the administrative authority only conducts a rudimentary or insufficient investigation is in accordance with the case-law of the Administrative Court cited above.
It was therefore to be decided by the Senate.
Keywords
Lack of reasoning, image processing, data protection authority,
Data protection complaint, data processing, obligation to investigate,
Confidentiality interest, balancing of interests, cassation, lack of
Establishment of facts, personal data, Union law,
Past, proportionality, video surveillance
European Case Law Identifier (ECLI)
ECLI:AT:BVWG:2019:W256.2214855.1.00
Last updated on
20.01.2020
Document number
BVWGT_20191120_W256_2214855_1_00
