CNPD (Luxembourg) - Délibération n° 47FR/2021: Difference between revisions

From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Luxembourg |DPA-BG-Color= |DPAlogo=LogoLU.png |DPA_Abbrevation=CNPD (Luxembourg) |DPA_With_Country=CNPD (Luxembourg) |Case_Number_Name=Délib...")
 
No edit summary
Line 64: Line 64:


The DPA nonetheless held that three cameras did not comply with the requirements under [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]]:
The DPA nonetheless held that three cameras did not comply with the requirements under [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]]:
1. The camera aimed at the reception, which was unlawful because workers have a right to not be constantly monitored
 
2. The camera aimed at the "smoker's corner", which was unlawful because it monitored a space reserved to employees' leisure time
# The camera aimed at the reception, which was unlawful because workers have a right to not be constantly monitored
3. The camera aimed at the public road outside the office and neighbouring land, which was unlawful because it was disproportionate when assessed against the purposes of the processing.
# The camera aimed at the "smoker's corner", which was unlawful because it monitored a space reserved to employees' leisure time
# The camera aimed at the public road outside the office and neighbouring land, which was unlawful because it was disproportionate when assessed against the purposes of the processing.


Second, the DPA assessed whether the company complied with its information obligations under [[Article 13 GDPR|Article 13 GDPR]]. It found that although the employees were notified of the existence of the video surveillance systems, visitors of the company's facilities had no access to this information.
Second, the DPA assessed whether the company complied with its information obligations under [[Article 13 GDPR|Article 13 GDPR]]. It found that although the employees were notified of the existence of the video surveillance systems, visitors of the company's facilities had no access to this information.

Revision as of 11:27, 18 January 2022

CNPD (Luxembourg) - Délibération n° 47FR/2021
LogoLU.png
Authority: CNPD (Luxembourg)
Jurisdiction: Luxembourg
Relevant Law: Article 5(1)(c) GDPR
Article 13 GDPR
Type: Investigation
Outcome: Violation Found
Started:
Decided: 01.12.2021
Published: 17.01.2022
Fine: 6800 EUR
Parties: n/a
National Case Number/Name: Délibération n° 47FR/2021
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): French
Original Source: CNPD (in FR)
Initial Contributor: Frederick Antonovics

The Luxembourg DPA fined a company €6800 for failing to comply with the principle of data minimisation by not limiting the field of vision of its video surveillance systems as well as inadequately informing both its employees and third parties of their existence.

English Summary

Facts

The processor is a transport company that installed video surveillance systems at its office. In February 2019, the Luxembourg DPA (CNPD) launched an investigation into the company's use of these video surveillance systems to assess its compliance with the GDPR.

Holding

First, the Luxembourg DPA assessed whether the company complied with the principle of data minimisation per Article 5(1)(c) GDPR. It started by affirming that only what is strictly necessary to achieve the pursued aims can be filmed, and that the processing operations cannot be disproportionate when assessed against their purpose. Companies seeking to lawfully install such systems are therefore required to set out the exact purposes of the processing prior to their installation.

During the investigation, the company argued the systems were installed to protect its goods and access to facilities, as well as to safeguard users and prevent accidents.

The DPA nonetheless held that three cameras did not comply with the requirements under Article 5(1)(c) GDPR:

  1. The camera aimed at the reception, which was unlawful because workers have a right to not be constantly monitored
  2. The camera aimed at the "smoker's corner", which was unlawful because it monitored a space reserved to employees' leisure time
  3. The camera aimed at the public road outside the office and neighbouring land, which was unlawful because it was disproportionate when assessed against the purposes of the processing.

Second, the DPA assessed whether the company complied with its information obligations under Article 13 GDPR. It found that although the employees were notified of the existence of the video surveillance systems, visitors of the company's facilities had no access to this information.

Thus, the Luxembourg DPA held that the company (1) failed to comply with the principle of data minimisation by not limiting the field of vision of its video surveillance systems, and (2) failed to adequately inform its employees and third parties of their existence.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.