CNPD (Luxembourg) - Délibération n° 2FR/2024

From GDPRhub
CNPD - Délibération n° 2FR/2024
LogoLU.png
Authority: CNPD (Luxembourg)
Jurisdiction: Luxembourg
Relevant Law: Article 5(1)(b) GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: 21.05.2024
Published: 13.06.2024
Fine: n/a
Parties: n/a
National Case Number/Name: Délibération n° 2FR/2024
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): French
Original Source: CNPD (in FR)
Initial Contributor: nzm

The DPA held that the use of video surveillance to justify the dismissal of an employee violates the purpose limitation principle if it was initially installed to ensure the safety of employees.

English Summary

Facts

In 2013, a controller installed a video surveillance system located outside all the municipal buildings. The Luxemburgish DPA (‘CNPD’) authorised this installation. In March 2020, a data subject lodged a complaint with the CNPD regarding her dismissal by the controller who had consulted the video surveillance footage in order to assess the serious misconduct of the data subject as accurately as possible.

In March 2021, during its investigation, the CNPD confirmed that the video surveillance system had been installed to guarantee the safety of the employees and users of the infrastructure.

The controller argued that independently of data protection legislation, Luxemburgish employment law requires that the letter of dismissal states precisely the misconduct of which the employee is accused. Therefore, it was necessary to use the footage to avoid the dismissal being declared unfair by the competent court.

Holding

Article 5(1)(b) GDPR states that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. The CNPD added that in a video surveillance context, the EDPB specified that before using a video device, the purposes of processing have to be specified in detail under Article 5(1)(b) GDPR and that the monitoring purposes should be documented in writing (Guidelines 3/2019 on processing of personal data through video devices, §15).

The CNPD also noted that the EDPB indicated that if any further processing is to take place, the controller must first make sure that this processing had purposes compatible with the original ones and design such processing accordingly. Whether a new purpose is compatible or not is assessed according to Article 6(4) GDPR (Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, §71).

In the present case, the CNPD pointed out that the purpose of the video surveillance system was to guarantee a certain level of safety for both the employees and users of the infrastructure. The CNPD held that the personal data collected was processed for a different purpose, namely to justify the data subject’s dismissal with immediate effect.

The CNPD added that the controller could have been authorised to further process these images but only if it was based on the consent of the data subject or if the further processing was compatible with the initial purposes (which was not the case here), in accordance with Articles 5(1)(b) and 6(4) GDPR.

Therefore, the CNPD issued a reprimand to the controller for breaching Article 5(1)(b) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.