CNPD (Luxembourg) - Délibération n° 2FR/2024
| CNPD - Délibération n° 2FR/2024 | |
|---|---|
 | |
| Authority: | CNPD (Luxembourg) |
| Jurisdiction: | Luxembourg |
| Relevant Law: | Article 5(1)(b) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 21.05.2024 |
| Published: | 13.06.2024 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | Délibération n° 2FR/2024 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | CNPD (in FR) |
| Initial Contributor: | nzm |
The DPA held that the use of video surveillance to justify the dismissal of an employee violates the purpose limitation principle if it was initially installed to ensure the safety of employees.
English Summary
Facts
In 2013, a controller installed a video surveillance system located outside all the municipal buildings. The Luxemburgish DPA (‘CNPD’) authorised this installation. In March 2020, a data subject lodged a complaint with the CNPD regarding her dismissal by the controller who had consulted the video surveillance footage in order to assess the serious misconduct of the data subject as accurately as possible.
In March 2021, during its investigation, the CNPD confirmed that the video surveillance system had been installed to guarantee the safety of the employees and users of the infrastructure.
The controller argued that independently of data protection legislation, Luxemburgish employment law requires that the letter of dismissal states precisely the misconduct of which the employee is accused. Therefore, it was necessary to use the footage to avoid the dismissal being declared unfair by the competent court.
Holding
Article 5(1)(b) GDPR states that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. The CNPD added that in a video surveillance context, the EDPB specified that before using a video device, the purposes of processing have to be specified in detail under Article 5(1)(b) GDPR and that the monitoring purposes should be documented in writing (Guidelines 3/2019 on processing of personal data through video devices, §15).
The CNPD also noted that the EDPB indicated that if any further processing is to take place, the controller must first make sure that this processing had purposes compatible with the original ones and design such processing accordingly. Whether a new purpose is compatible or not is assessed according to Article 6(4) GDPR (Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, §71).
In the present case, the CNPD pointed out that the purpose of the video surveillance system was to guarantee a certain level of safety for both the employees and users of the infrastructure. The CNPD held that the personal data collected was processed for a different purpose, namely to justify the data subject’s dismissal with immediate effect.
The CNPD added that the controller could have been authorised to further process these images but only if it was based on the consent of the data subject or if the further processing was compatible with the initial purposes (which was not the case here), in accordance with Articles 5(1)(b) and 6(4) GDPR.
Therefore, the CNPD issued a reprimand to the controller for breaching Article 5(1)(b) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
