CNPD (Luxembourg) - Délibération n° 44FR/2021: Difference between revisions

From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Luxembourg |DPA-BG-Color= |DPAlogo=LogoLU.png |DPA_Abbrevation=CNPD (Luxembourg) |DPA_With_Country=CNPD (Luxembourg) |Case_Number_Name=Délib...")
 
 
Line 57: Line 57:
The controller in this case is a car dealership that installed video surveillance cameras in its garage.  
The controller in this case is a car dealership that installed video surveillance cameras in its garage.  


In the context of a broader investigation into video surveillance practices in the country (see very similar case here), the Luxembourg DPA inspected whether the car dealership had installed such cameras in its garage. Prior to this inspection, the company declared it did not use such cameras. However, the DPA visited the garage and found evidence of the contrary.
In the context of a broader investigation into video surveillance practices in the country ([[CNPD (Luxembourg) - Délibération n° 47FR/2021|see very similar case here]]), the Luxembourg DPA inspected whether the car dealership had installed such cameras in its garage. Prior to this inspection, the company declared it did not use such cameras. However, the DPA visited the garage and found evidence of the contrary.


It therefore opened an investigation to determine whether these were lawfully installed.
It therefore opened an investigation to determine whether these were lawfully installed.
=== Holding ===
=== Holding ===
First, the Luxembourg DPA assessed whether the company complied with its information obligations under [[Article 13 GDPR|Article 13 GDPR]]. It started by affirming that only what is strictly necessary to achieve the pursued aims can be filmed, and that the processing operations cannot be disproportionate when assessed against their purpose. Companies seeking to lawfully install such systems are therefore required to set out the exact purposes of the processing prior to their installation.
First, the Luxembourg DPA assessed whether the company complied with its information obligations under [[Article 13 GDPR|Article 13 GDPR]]. It started by affirming that only what is strictly necessary to achieve the pursued aims can be filmed, and that the processing operations cannot be disproportionate when assessed against their purpose. Companies seeking to lawfully install such systems are therefore required to set out the exact purposes of the processing prior to their installation.

Latest revision as of 15:34, 24 January 2022

CNPD (Luxembourg) - Délibération n° 44FR/2021
LogoLU.png
Authority: CNPD (Luxembourg)
Jurisdiction: Luxembourg
Relevant Law: Article 5(1)(c) GDPR
Article 13 GDPR
Type: Investigation
Outcome: Violation Found
Started:
Decided: 09.11.2021
Published: 31.12.2021
Fine: 1500 EUR
Parties: n/a
National Case Number/Name: Délibération n° 44FR/2021
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): French
Original Source: CNPD (in FR)
Initial Contributor: FA

The Luxembourg DPA fined a car dealership €1500 for failing to comply with the principle of data minimisation by not limiting the field of vision of its video surveillance systems as well as inadequately informing both its employees and third parties of their existence.

English Summary

Facts

The controller in this case is a car dealership that installed video surveillance cameras in its garage.

In the context of a broader investigation into video surveillance practices in the country (see very similar case here), the Luxembourg DPA inspected whether the car dealership had installed such cameras in its garage. Prior to this inspection, the company declared it did not use such cameras. However, the DPA visited the garage and found evidence of the contrary.

It therefore opened an investigation to determine whether these were lawfully installed.

Holding

First, the Luxembourg DPA assessed whether the company complied with its information obligations under Article 13 GDPR. It started by affirming that only what is strictly necessary to achieve the pursued aims can be filmed, and that the processing operations cannot be disproportionate when assessed against their purpose. Companies seeking to lawfully install such systems are therefore required to set out the exact purposes of the processing prior to their installation.

During the investigation, the DPA found no information as to the existence of the video surveillance system had been provided by the car dealership. Additionally, the the employees were never notified of the existence of the video surveillance systems. The owner of the dealership argued they were not aware of the obligation to provide such information, and had only installed these to ensure customers would not have to wait if one of the receptionists were ever missing. The DPA nonetheless held the car dealership breached Article 13 GDPR by failing to provide information on the existence of the video surveillance systems.

Second, the DPA assessed whether the car dealership complied the principle of data minimisation per Article 5(1)(c) GDPR. The dealership stated the images captured by the camera were not recorded, but simply transmitted onto a screen for the owner to check whether customers were dealt with in time when the reception was not occupied. The DPA's inspector found that the field of vision of the cameras essentially allowed the constant surveillance of employees working at the reception, which they held to be disproportionate as said employees could feel constantly observed. As such, the Luxembourg DPA held the car dealership contravened Article 5(1)(c) GDPR because the cameras could be replaced with less invasive means to achieve the purpose pursued, such as a counter which welcomes customers.

Thus, the Luxembourg DPA held that the company (1) failed to comply with the principle of data minimisation by not limiting the field of vision of its video surveillance systems, and (2) failed to adequately inform its employees and third parties of their existence. It fined the dealership €1500 for these violations of the GDPR.

Comment

This decision is the only pdf available for the n°44-46 Luxembourg DPA decisions. It is unclear whether this is intentional or due to a technical error.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.


    





    
        
            
                
                    
                
                Go to home
            
        
        
            
                Decisions
            
        

        

    

    
        
    
    Deliberation No. 44FR/2021 of November 9, 2021 – fine
    

        
            
        
                
                        31/12/2021
                
                
        
        
        
    Video surveillance – Non-compliance with the principle of data minimization (disproportionate field of vision) – Insufficient information of the persons concerned.
    




            
        
        
    To know more
    
    
    
    
        
            
                Deliberation No. 44FR/2021 of November 9, 2021 – fine
            
            

            (PDF - 619 KB)
            
        
    
    




        
    Last update 01/18/2022
    

    

        
    
    Deliberation No. 44FR/2021 of November 9, 2021 – fine
    

        
            
        
                
                        31/12/2021
                
                
        
        
        
    Video surveillance – Non-compliance with the principle of data minimization (disproportionate field of vision) – Insufficient information of the persons concerned.
    




            
        
        
    To know more
    
    
    
    
        
            
                Deliberation No. 44FR/2021 of November 9, 2021 – fine
            
            

            (PDF - 619 KB)
            
        
    
    




        
    Last update 01/18/2022
    

    
            
        
                
                        31/12/2021
                
                
        
        
        
    Video surveillance – Non-compliance with the principle of data minimization (disproportionate field of vision) – Insufficient information of the persons concerned.