DSB (Austria) - DSB-D213.1759
From GDPRhub
| DSB - DSB-D213.1759 | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 5(1)(c) GDPR WEG §28 |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 14.12.2022 |
| Decided: | 04.08.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | DSB-D213.1759 |
| European Case Law Identifier: | ECLI:AT:DSB:2023:2023.0.159.938. |
| Appeal: | n/a |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (in DE) |
| Initial Contributor: | annkathrin.a.dix |
The DPA held that the complete surveillance of a residential complex to prevent theft and keep strangers out of the building is a serious interference with the fundamental right to privacy of the data subjects.
English Summary
Facts
The controller, a housing association, installed 38 (active) video cameras and three dummy cameras at a residential complex after an increased number of break-ins in the basement. The cameras monitored the general areas, including entrance areas and bicycle/trash rooms. The apartment entrance doors and residents’ personal spaces were excluded from the cameras’ scope and/or rendered unrecognisable. The data subjects, the residents, were informed about this in a newsletter and on the notice board at the complex.
On 03 November 2022, the Austrian DPA (‘Datenschutzbehörde’) was anonymously informed about the video surveillance system. The DPA then conducted a data protection review in accordance with Article 57(1)(h) GDPR.
The controller argued that the video surveillance system was in the interest of protecting property against theft, damage, and other disruptions (in accordance with Austrian national law, Section 28 WEG) and preserving evidence thereof. The recordings were stored for a maximum of 72 hours.
The controller further argued that although the data subjects had not given their consent, it was not necessary because the legitimate interest of the controller overrode the interests of the data subjects. The proper fulfilment of a contract was also present because the data subjects reported break-ins at the complex. The controller had an obligation to take preventative measures in order to avoid damage.
Holding
The DPA explained that under Article 6(1)(f) GDPR, and as reiterated by the CJEU, video surveillance operated to protect property is considered a legitimate interest. However, any data processing must comply with the principles for processing set out in Article 5(1) GDPR, particularly the principle of confidentiality under Article 5(1)(f) GDPR.
As the controller argued, the controller was also fulfilling their contractual obligations in accordance with Article 6(1)(b) GDPR. However, the DPA held that the data processing must, nevertheless, comply with the conditions prescribed in Article 5(1) GDPR. In particular, the DPA assessed whether these operations complied with the principle of data minimisation under Article 5(1)(c) GDPR. This principle sets out three requirements: adequacy, relevance and limitations to what is necessary. The DPA therefore examined whether the implemented video camera system is sufficient to achieve the purpose is the least intrusive means of achieving the purpose.
Regarding the recording of areas that cover the entrance, lift, staircase and corridor areas, the purpose of these video cameras is to keep strangers out of the building and have the additional purpose of preventing theft. However, the DPA noted that the first purpose was already achieved by the simultaneous installation of electronic access system. Regarding the additional purpose of preventing theft, the DPA found that this could be attained by restricting the recording area. Therefore, the DPA held that the cameras recording areas such entrance, elevator, stairs and corridors did not comply with the data minimisation principle. Moreover, the DPA held that when balancing the interests, the confidentiality interests of the data subjects prevailed due to the lack of necessity for the data processing in this case. The DPA found that the complete surveillance of the lift, staircase, corridor and entrance areas represents a disproportionately serious interference with the fundamental right to privacy of the data subjects and their visitors.
Regarding the monitoring garbage rooms, bicycle, and stroller storage rooms, the DPA found that the controller had a legitimate and justified interest in protecting the property of those responsible.
Regarding the cameras covering the garage entrance area, the DPA held that the controller pursued the legitimate interests of those responsible and third parties (i.e. other residents) who park in the garage.
The DPA concluded that the controller violated Article 5(1)(c) GDPR. The DPA found the processing of areas that cover the entrance, lift, staircase and corridor areas unlawful and therefore fully prohibited the monitoring. The DPA ordered the controller to limit the recording area of certain cameras within two weeks.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Text
GZ: 2023-0.159.938 of August 4, 2023 (case number: DSB-D213.1759)
[Editor's note: Names and companies, legal forms and product names, addresses (including URLs, IP and email addresses), file numbers (and the like), etc., as well as their initials and abbreviations may be abbreviated and/or changed for pseudonymization reasons. Obvious spelling, grammatical and punctuation errors have been corrected.]
DECISION
RULING
The data protection authority decides as part of the official investigation procedure against N*** gemeinnützige Wohnbaugesellschaft m.b.H., FN 2*88*3*t, as follows:
1. The responsible party violates the GDPR by operating 30 video cameras at the location O***allee *8, 1*** Vienna, specifically the cameras with the numbers 1, 2, 3, 4, 5, 6, 7, 8, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 26, 28, 29, 30, 31, 32, 33, 34 and 38, the recording areas of which cover general parts of the property, and in doing so processes personal data contrary to the principle of Art. 5 Paragraph 1 Letter c GDPR (data minimization), by operating 30 video cameras at the location O***allee *8, 1*** Vienna, specifically cameras with the numbers 1, 2, 3, 4, 5, 6, 7, 8, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 26, 28, 29, 30, 31, 32, 33, 34 and 38, the recording areas of which cover general parts of the property, and in doing so processes personal data contrary to the principle of Article 5 Paragraph 1 Letter c GDPR (data minimization).
2. The controller is instructed to restrict the recording area of the video cameras with numbers 6 and 17 within a period of two weeks, failing which the order will be executed, so that only the collection points of the logistics or postal company are recorded, but not the entire entrance area.
3. The controller is prohibited from processing data by the cameras with numbers 1, 2, 3, 4, 5, 7, 8, 11, 12, 13, 14, 15, 16, 18, 19, 20, 21, 22, 23, 26, 28, 29, 30, 31, 32, 33, 34 and 38 with immediate effect, failing which the order will be executed.
Legal basis: Art. 4, Art. 5 Para. 1 lit. c, Art. 6, Art. 12 Para. 3, Art. 51 Para. 1, Art. 57 Para. 1 lit. f, Art. 58 Para. 2 lit. d and f and Art. 77 Para. 1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ L 119, 4 May 2016, p. 1.: Article 4, Article 5 Paragraph 1 Letter c, Article 6, Article 12 Paragraph 3, Article 51 Paragraph 1, Article 57 Paragraph 1 Letter f, Article 58 Paragraph 2 Letters d and f and Article 77 Paragraph 1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ L 119 of 4 May 2016, p. 1.
REASONING
A. Arguments of the parties and course of proceedings
1. By letter dated 3 November 2022, the data protection authority was informed by an anonymous tip, to which several photographs from video cameras were attached as an attachment, about the video surveillance system operated by the controller in the residential complex with the postal address < O***allee *8, 1*** Vienna >.
2. With a decision dated 14 December 2022, the data protection authority initiated a data protection review pursuant to Art. 57 Para. 1 lit. h GDPR ("official review procedure") against the controller regarding the video surveillance system. initiated a data protection review pursuant to Article 57, paragraph one, letter h, GDPR ("official review procedure") against the controller regarding the video surveillance system with a settlement on December 14, 2022.
3. After extending the deadline until January 17, 2023, the controller summarized in its statement of January 17, 2023 that there had been an increasing number of break-ins in the basement compartments in the residential complex in question. First, as a preventive measure, the cylinders and locking areas of the basement access doors were replaced or reinforced. The controller also installed dummy videos and information signs on the ground floor. However, there were renewed break-ins in the basement in the summer months of 2020. The controller then revised the security concept for the residential complex, which now includes an electronic access system in conjunction with a video surveillance system. The residents were informed of this in a circular dated February 22, 2021, which was posted in the display case on February 25, 2021. The property management also raised no objections. The installation order was given to a professional on June 1, 2021. It should be noted that only general areas would be monitored and apartment entrance doors and the residents' most personal living areas would not be affected.
The video surveillance system in question includes 38 active ***vision *4*5 video cameras and three dummy cameras. The system serves to protect the property of those responsible and the tenants/owners/residents. The person responsible has an interest in taking preventive measures against theft, damage to property or other external disturbances or in recording such disturbances for the purpose of securing evidence.
The camera system records on an ad hoc basis using motion detection. The recordings are stored for a maximum of 72 hours. During this time, it is possible, following prior instructions, to deactivate automatic deletion for a specific period of time in the event of a specific event (burglary). After the evaluation has been completed, the data is then deleted. The system consists of three PCs, two of which are used for recording and one for playing back/displaying the images. All recorders and distributors are located in rooms to which neither tenants nor outsiders have access. The PCs are also password-protected and only accessible to a limited group of people. The data is also only processed locally, without being connected to the Internet. Appropriate labeling is attached to all access doors (main/side entrances, garage, stairwells). These are uniform, standardized signs (with QR code for data protection information).
In principle, only the entrance areas and bicycle/stroller/garbage rooms are recorded by the cameras. Sensitive areas (mailboxes, apartment entrances, basement compartments with residential references, public areas) would not be recorded or would be made unrecognizable by irreversibly blacking out the camera image. Audio recordings do not take place. These are deactivated on the camera side. All administrative functions on the video cameras are protected by passwords. Access to the live images and recordings is only possible by entering the password on site.
The appendix to the submission included
- screenshots of the recording area of the video cameras and their positions,
- photos of the information signs from the video surveillance,
- the data sheet for the video cameras and
- the operating instructions for the video cameras.
4. In the supplementary statement of February 7, 2023, the controller essentially argued that the consent of the persons concerned was not available. This was also not necessary in the present case because the legitimate interest of the controller was predominant. There was also proper fulfillment of a contract because the tenants had reported break-ins. According to the property management contract, there was an obligation that preventive measures had to be taken for the benefit of the homeowners' association in order to avoid damage.
The property with the address O***allee *8/L***straße *7, 1*** Vienna, is currently 88.9% owned by those responsible, who in turn are 99.97% owned by P***. Due to the repeated break-ins, the installation of the video surveillance cameras is to be viewed as a measure of ordinary management, for which no majority decision is necessary. Even if it were a measure of extraordinary management, the consent of half the owners would be evident due to the current ownership structure. In addition, no one objected to the installation of the video surveillance system. According to Section 28 WEG, the video surveillance was necessary to maintain the property and protect it from damage. The property with the address O***allee *8/L***straße *7, 1*** Vienna, is currently 88.9% owned by the responsible party, which in turn is 99.97% owned by P***. Due to the repeated break-ins, the installation of the video surveillance cameras is to be viewed as a measure of ordinary administration, for which no majority decision is necessary. Even if it were a measure of extraordinary administration, the consent of half of the owners would be evident due to the current ownership situation. In addition, no one objected to the installation of the video surveillance system. According to paragraph 28, WEG, the video surveillance was necessary to maintain the property and to protect it from damage.
The break-ins into the basement compartments were recorded in the system of the responsible party and the tenant or owner reported them to the police themselves. Pipe safes were also broken into and the basement break-ins reported by the tenants were noted accordingly. There were also incidents in which people from outside the building were in the garage and stairwell. There were also break-ins in the bicycle room, the garage and the apartments.
Attached to the submission were
- a letter dated February 22, 2021, to the tenants and owners of the residential complex,
- a report confirmation dated July 2, 2020 (crime scene: basement) and
- a letter to the tenants of the residential complex, dated November 21, 2018, with the information that people from outside the building were repeatedly in the garage and stairwell.
5. In the submission of February 27, 2023, the person responsible stated that the basement compartments can be accessed through a lock and that the video camera with the number 29 records access. The bicycle room was last broken into in December 2022 on two consecutive days. During the first break-in, a bicycle was stolen and during the second break-in, the same perpetrator had already selected the bicycle but fled without any stolen goods after discovering the video camera. With regard to various disturbances in the garage, it should be noted that a tenant drove into the garage with a smoking car and thereby triggered the fire alarm. This could be traced thanks to the video camera. In the past, bulky waste had often been left in the garbage room and tiles had been knocked off the wall. A stroller had already been stolen from the stroller room. The pipe safes are located in the area of the garage entrance and the video camera with the number 37 records the garage entrance. This means that the pipe safes are not monitored by the video cameras per se, but they are in the camera's field of view. The recording area of the video camera with the number 17 (Rek 1 Std. 2 - ground floor main entrance) covers the main entrance (L***straße *7) and eight boxes at the collection station of a logistics or postal company. In the past, packages from the collection stations have been stolen by outsiders. Every resident of the building or every outsider is recorded when entering and leaving the residential building O***allee *8. In the basement, the elevator is recorded by camera with the number 28. On the ground floor, camera no. 30 is only aimed at the main entrance. Access to the elevator or stairwell is not recorded by the cameras. There are no cameras in the stairwell or at the elevator on floors 1-6.
A picture of the garage entrance and the pipe safes were attached to the submission.
B. Subject of the complaint
Based on the report and the submission, the subject of the proceedings is the question of whether the image processing carried out by the responsible party in the form of the operation of 38 video cameras in the residential building with the postal address O***allee *8, 1*** Vienna, is carried out lawfully.
C. Findings of fact
1. The responsible party is N*** gemeinnützige Wohnbaugesellschaft m.b.H., registered with the Vienna Commercial Court under FN 2*88*3*t. This is the 88.9% majority owner of the property with the postal address O***allee *8 or L***straße *7 in 1*** Vienna.
Evaluation of evidence: The findings arise from the statement of the person responsible dated February 7, 2023, as well as from the official land register query of February 28, 2023 and the official search in the commercial register carried out on June 2, 2023.
2. In order to improve the security concept in the property at O***allee *8 or L***straße *7 in 1*** Vienna, the person responsible had an electronic access system installed in conjunction with a video surveillance system. A professional was commissioned to install the aforementioned video surveillance system on June 11, 2021. The video surveillance system is intended to protect the property of the person responsible and the residents from theft and damage to property. In the past, there have been break-ins in the basement and bicycle rooms as well as in the garage, and pipe safes have also been broken into. There were also an increasing number of people from outside the building in the garage and stairwell. The residents were informed about the installation of the video surveillance system and the electronic access system by means of a circular dated February 22, 2021, which was posted in the display case on February 25, 2021. The video camera system is currently in operation.
All of the video cameras installed are ***vision *4*5 models. 38 video cameras are in operation. Recording begins as soon as movement is detected in the recording area. The recordings are stored for a maximum of 72 hours, after which they are automatically deleted. No sound recordings are made.
Three PCs are in use; two of them are for recording and one for playing back/displaying the recordings. The PCs are password-protected and only a limited number of people have access to the premises.
The cameras installed in the children's playroom are dummy cameras.
Assessment of evidence: These findings are based on the comprehensible statements of those responsible.
3. The video camera system is marked by standardized information signs on all access doors. The information signs contain a QR code for further data protection information.
The information signs at the main entrance and at the garage entrance are as follows (blue highlights of the video camera markings were made officially):
[Editor's note: The four photographs of the information signs and their surroundings reproduced here as graphic files cannot be pseudonymized with reasonable effort and have therefore been removed.]
Assessment of evidence: The findings are based on the statement of those responsible and the photographs submitted, on which the respective information signs can be seen.
4. The positions and the respective recording areas of the individual video cameras are as follows (formatting not 1:1):
4.1. The recording areas of the video cameras with the numbers 6, 7, 17, 30, 31 and 32 cover the entrance areas (main, side and courtyard entrance):
The camera with the number 17 "Stg. 2 - EG main entrance" covers the main entrance area of staircase 2 and also the eight boxes of the collection station of a logistics or postal company.
The position and recording area of the camera with the number 17 is as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The camera with the number 6 "Stg. 1 - EG entrance" covers the entrance area of staircase 1 and also 3 boxes of the collection station of a logistics or postal company. When using the main entrance of staircase 1, the residents of the building must enter and leave the residential building through the recording area of the camera with the number 6 "Stg. 1 - Ground floor entrance".
The position and recording area of the camera with the number 6 is as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The camera with the number 7 "Rek 1, Stg. 1 - Ground floor staircase" records one side entrance and also the staircase area on the ground floor.
The position and recording area of the camera with the number 7 is as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video camera with the number 30 "Main entrance" records the entrance area.
The position and recording area of the camera with the number 30 is as follows:
[Editor's note: The photographs of the position and recording area of the camera shown here as graphic files have been removed.]
The video camera with the number 31 "side entrance" records the side entrance.
The position and recording area of the camera with the number 31 is as follows:
[Editor's note: The photographs of the position and recording area of the camera shown here as graphic files have been removed.]
The video camera with the number 32 "Rek 2, courtyard access" records the entrance to the courtyard.
The position and recording area of the camera with the number 32 is as follows:
[Editor's note: The photographs of the position and recording area of the camera shown here as graphic files have been removed.]
The video camera with the number 31 "Stg. 2, ground floor courtyard access" of number 22 records the access to the courtyard.
The position and recording area of the camera with the number 22 is as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
When using an entrance when entering and leaving the house or when entering the courtyard access, which is recorded by the video cameras with the numbers 22 and 32, the residents must pass through the recording area of one of the above video cameras.
4.2. The recording areas of the video cameras with the numbers 1, 2, 12, 13, 14, 15, 16, 18, 19, 20, 28, and 29 record the elevator and corridor areas:
The video cameras with the numbers 1 and 2 record the elevator to staircase 1 on the first and second basement floors. The positions and recording areas of camera number 1 and camera number 2 are as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video cameras with the numbers 12 and 13 record the elevator to staircase 2 on the first and second basement floors. The positions and recording areas of camera number 12 and camera number 13 are as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video cameras with the numbers 3, 4 and 5 record the corridor area on the first, third and fifth floors to staircase 1.The positions and recording areas of the video cameras with the numbers 3, 4 and 5 are as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video cameras with the numbers 14, 15 and 16 record the corridor area on the first, third and fifth floors of staircase 2 respectively. The positions and recording areas of the video cameras with the numbers 14, 15 and 16 are as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video cameras with the numbers 18 and 19 record the elevator area of staircase 2 on the ground floor and the corridor in front of the elevator on staircase 2. The positions and recording areas of the video cameras with the numbers 18 and 19 are as follows:
[Note Editor: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video cameras with the numbers 20 and 21 record the corridor in front of the elevator and the staircase area on the ground floor of staircase 2. The positions and recording areas of the video cameras with the numbers 20 and 21 are as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video camera with the label "1st basement elevator" and number 28 records the elevator in the basement. The position and recording area of the camera with the number 28 are as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video camera with the label "1st basement lock near technical room" and number 29 records the lock in front of the technical room. The position and recording area of camera number 29 is as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
4.3. The recording areas of the video cameras numbered 23, 24, 25, 36 capture the bicycle room as well as the aisle area in front of it and the stroller room:
The video cameras labeled 23 "Stg. 2 - EG in front of bicycle room" and 24 "Stg.2 - EG bicycle room" capture the bicycle parking area and also the passageway in front of it. The video camera 25 "Stg. 2 - EG stroller room" captures the storage room for the strollers. The positions and recording areas of the video cameras with the numbers 23, 24 and 25 are as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video camera with the number 36 records the bicycle room. The position and recording area of the camera with the number 36 are as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
4.4. The recording areas of the video cameras with the numbers 37, 38, 26 and 27 record the gate at the garage and the garage entrance from staircase 2:
The camera with the number 37 "Staircase 2 - gate at garage" records the gate of the garage and, using camera number 38 "Staircase 2 - gate at garage" mounted in the garage entrance, the bicycle room. 2. Garage entrance" the inside garage entrance is recorded in the recording area. The positions and recording areas of the two cameras with the numbers 37 and 38 are as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The video camera with the number 26 records the gate or the inside entrance area to the garage. The position and recording range of camera number 26 is as follows:
[Editor's note: The photographs of the position and recording range of the camera reproduced here as graphic files have been removed.]
The video camera with number 27 "Rek 1 - garage entrance" records the inside garage entrance of staircase 2. The position and recording range of camera number 27 is as follows:
[Editor's note: The photographs of the position and recording range of the camera reproduced here as graphic files have been removed.]
4.5. The recording ranges of video cameras numbers 8, 9, 10, 34 and 35:
The recording range of video camera number 8 "Rek 1, staircase 1 - ground floor in front of the garbage room" records the corridor area in front of the garbage room. The position and recording range of camera number 8 is as follows:
[Editor's note: The photographs of the camera's position and recording range reproduced here as graphic files have been removed.]
The recording range of video camera number 9 "Rek 1, Stg. 1 EG garbage room 1" records the first garbage room on the ground floor and video camera number 10 "Rek 1 - EG garbage room 2" records the second garbage room on the ground floor. The positions and recording ranges of cameras numbered 9 and 10 are as follows:
[Editor's note: The photographs of the camera's position and recording range reproduced here as graphic files have been removed.]
The recording range of video camera number 34 "Rek 2, corridor in front of garbage room" records the corridor area in front of the garbage room. The position and recording area of camera number 34 is as follows:
[Editor's note: The photographs of the camera's position and recording area reproduced here as graphic files have been removed.]
The recording area of video camera number 35 "Rek 2, garbage room" records the garbage room. The position and recording area of camera number 35 is as follows:
[Editor's note: The photographs of the camera's position and recording area reproduced here as graphic files have been removed.]
4.6. The recording areas of video cameras number 11 and 33, which record the areas in front of the two children's playrooms.
The recording area of video camera number 11 "Stg. 1 - EG in front of children's playroom" records the corridor on the ground floor in front of the children's playroom. The position and recording area of camera number 11 is as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
The recording area of video camera number 33 "corridor in front of children's playroom" captures the corridor in front of the children's playroom. The position and recording area of camera number 33 is as follows:
[Editor's note: The photographs of the position and recording area of the camera reproduced here as graphic files have been removed.]
Assessment of evidence: The findings made regarding the position and recording areas of the respective cameras are based on the statement of the person responsible dated January 17, 2023 and the screenshots and photographs submitted by her therein, which show the positions and recording areas of the individual cameras.
5. The residents of the building have not given their consent for the video surveillance system and there is no resolution from the owners' association.
Assessment of evidence: These findings are based on the arguments put forward by the responsible party.
D. From a legal perspective, this means:
D.1. General
D.1.1. According to Art. 4(7) GDPR, a responsible party is the natural or legal person, public authority, agency or other body which, alone or jointly with others, decides on the purposes and means of processing personal data. D.1.1. According to Article 4(7) GDPR, a responsible party is the natural or legal person, public authority, agency or other body which, alone or jointly with others, decides on the purposes and means of processing personal data.
In these proceedings, the responsible party has not disputed its status as responsible party with regard to the video surveillance system. There is no doubt that it is the person responsible under data protection law for the data processing that is currently ongoing.
D.1.2. According to the person responsible in its statement of February 7, 2023, the video surveillance in question is a measure of ordinary administration within the meaning of Section 28 WEG and, due to the existing ownership structure, is “D.1.2. If the responsible party states in its statement of February 7, 2023 that the video surveillance in question is a measure of ordinary administration within the meaning of Paragraph 28, WEG and that, due to the existing ownership structure, "the consent of half is evident due to the majority relationships and the special circumstances", the following must be countered for the sake of completeness:
Video surveillance in general parts of a property is to be regarded as a measure of extraordinary administration within the meaning of Section 29 Paragraph 1 WEG, especially since it goes beyond the matters mentioned in Section 28 WEG (cf. LGZ Graz December 15, 2006, 3 R 139/06t and within the meaning of Paragraph 29, Paragraph one, WEG, especially since it goes beyond the matters mentioned in Paragraph 28, WEG, cf. LGZ Graz December 15, 2006, 3 R 139/06t and Raffling, Kompein and Brunnhuber in immo aktuell 2019, 131). Therefore, according to the above, this is a measure of extraordinary administration. It should therefore be noted that even if a majority decision actually exists, any of those outvoted could demand that the majority decision be overturned by the courts (cf. Section 29, WEG). in immo aktuell 2019, 131). Therefore, according to the above, this is a measure of extraordinary administration. It should therefore be noted that even if a majority decision actually exists, any of those outvoted could demand that the majority decision be overturned by the courts (cf. Section 29, WEG).
D.2. On video surveillance
The processing of personal data using image processing systems (video surveillance) for the preventive protection of persons or objects in publicly accessible places that are subject to the controller's house rules, if violations of the law (e.g. theft or damage to property) have already occurred or if there is a particular risk potential in these places (this is typically the case with banks, jewelers, tobacconists, petrol stations, data centres, parking garages), can generally be based on the provision of Art. 6 paragraph 1 letter f of the GDPR (see The processing of personal data using image processing systems (video surveillance) for the preventive protection of persons or objects in publicly accessible places that are subject to the controller's house rules, if violations of the law (e.g. theft or damage to property) have already occurred or if there is a particular risk potential in these places (this is typically the case with banks, jewelers, tobacconists, petrol stations, data centres, parking garages), can generally be based on the provision of Article 6, paragraph 1, letter f of the GDPR be supported (see Löffler in Knyrim, Datenschutzrecht 4, para. 15.13).
The ECJ has already stated that the operation of such a video surveillance system to protect property can in principle represent a legitimate interest (see the ECJ judgment of 11 December 2019, C-708/18, para. 42).The ECJ has already stated that the operation of such a video surveillance system to protect property can in principle represent a legitimate interest (see the ECJ judgment of 11 December 2019, C-708/18, para. 42).
At the same time, however, the ECJ has stated that, in order to be lawful, any data processing must comply with the principles for processing set out in Article 5(1) of the GDPR (see, with regard to the comparable legal situation under Directive 95/46/EC, the judgment of the ECJ of 13 May 2014, C-131/12, paragraph 71 with further references).At the same time, however, the ECJ has stated that, in order to be lawful, any data processing must comply with the principles for processing set out in Article 5(1) of the GDPR (see, with regard to the comparable legal situation under Directive 95/46/EC, the judgment of the ECJ of 13 May 2014, C-131/12, paragraph 71 with further references).
According to Section 1(1) of the Data Protection Act, everyone has the right to have personal data concerning them kept confidential, provided there is a legitimate interest in doing so. The existence of such an interest is excluded if data cannot be traced back to the person concerned and is not subject to a claim for confidentiality. According to paragraph one, subsection one of the DSG, everyone has the right to keep personal data concerning them confidential, provided that there is a legitimate interest in doing so. The existence of such an interest is excluded if data cannot be traced back to the person concerned and is not subject to a claim for confidentiality.
Restrictions on the right to confidentiality are permissible pursuant to section 1, paragraph 2 of the DSG if personal data are used in the vital interest of the person concerned, the person concerned has given their consent, there is a qualified legal basis for the use, or the use is justified by the overriding legitimate interests of a third party. Restrictions on the right to confidentiality are permissible pursuant to paragraph one, paragraph 2 of the DSG if personal data are used in the vital interest of the person concerned, the person concerned has given their consent, there is a qualified legal basis for the use, or the use is justified by the overriding legitimate interests of a third party.
The GDPR and in particular the principles enshrined therein must be used to interpret the right to confidentiality (cf. the decision of February 15, 2021, GZ 2021-0.101.211 mwN).The GDPR and in particular the principles enshrined therein must be used to interpret the right to confidentiality (cf. the decision of February 15, 2021, GZ 2021-0.101.211 mwN).
As is clear from the facts of the case, the 38 video cameras in question record the residents of the building and their visitors. On the one hand, real-time monitoring takes place, and on the other hand, the video material is stored for 72 hours. This is undoubtedly processing within the meaning of Art. 4 Z 2 GDPR, which falls within the material scope of the GDPR in accordance with Art. 2 Para. 1 leg. cit. This is because the capture and transmission of real-time recordings to a monitor already constitutes processing within the meaning of Article 4(2) GDPR, as does the storage. As is clear from the facts of the case, the 38 video cameras in question record the residents of the building and their visitors. On the one hand, real-time monitoring takes place, and on the other hand, the video material is stored for 72 hours. This is undoubtedly processing within the meaning of Article 4(2) GDPR, which falls within the material scope of the GDPR pursuant to Article 2, paragraph one, leg. cit. This is because the capture and transmission of real-time recordings to a monitor already constitutes processing within the meaning of Article 4(2) GDPR, as does the storage.
As an interim conclusion, it can therefore be stated that the video camera system processes personal data which is subject to a claim of confidentiality in accordance with Section 1 Paragraph 1 DSG. As an interim result, it can therefore be stated that the video camera system processes personal data that is subject to a confidentiality claim in accordance with paragraph one, subsection one, DSG.
On the other hand, no personal data is processed by the three dummy cameras. Consequently, there can be no violation of the DSG or the GDPR here.
D.2.1. Video surveillance in the individual areas:
The data processing by the controller through the video camera system, which is the subject of the proceedings, is not in the vital interest of the residents of the house, nor has their consent been obtained. However, the legal grounds - as put forward by the controller in its statements of January 17, 2023, February 7, 2023 and February 27, 2023 - of Art. 6, paragraph 1, letter b (fulfillment of a contract) and letter f (legitimate interest of third parties, the respondent and the other co-owners), each GDPR, come into consideration. The data processing by the controller through the video camera system, which is the subject of the proceedings, is not in the vital interest of the residents of the house, nor has their consent been obtained. However, the legal grounds for permission - as put forward by the controller in its statements of January 17, 2023, February 7, 2023 and February 27, 2023 - of Article 6, paragraph one, letter b, (performance of a contract) and letter f, (legitimate interest of third parties, the respondent and the other co-owners), each GDPR, come into consideration.
With regard to the justification in Article 6, paragraph 1, letter b, GDPR (performance of a contract), it should be noted that a contract in the form of a tenancy agreement (rental agreement) exists between the controller and the residents of the house. In substance, the controller is contractually obliged to make an existing property or any parking space for a car available to the respective resident in return for payment of a tenancy fee. However, this does not mean that permanent video surveillance of all residents every time they enter and leave the residential property is required, nor is it necessary. With regard to the justification in Article 6, Paragraph 1, Letter b, GDPR (performance of a contract), it should be noted that a contract in the form of a tenancy agreement (rental agreement) exists between the controller and the residents. In substance, the controller is contractually obliged to make a property or a possible parking space for a car available to the respective resident in return for payment of a rental fee. However, this does not mean that permanent video surveillance of all residents every time they enter and leave the residential property is required, nor is it necessary.
Article 6, Paragraph 1, Letter f, GDPR (legitimate interest of third parties, the respondent and the other co-owners) is generally a possible basis for permission. However, it must be examined whether the processing of personal data in question complies with the principles of data processing pursuant to Art. 5 GDPR, in particular Art. 5 Paragraph 1 Letter c GDPR “data minimization”. Considered on their own, these constitute legally binding regulations that must be taken into account when examining the legality of the data processing in question. As the BVwG stated in its decision on GZ W258 2216873-1 of October 30, 2019, the processing of personal data is permissible if it was carried out in compliance with the processing principles set out in Art. 5 GDPR and on the basis of one of the grounds for permission set out in Art. 6 GDPR. Article 6, Paragraph 1, Letter f, GDPR (legitimate interest of third parties, the respondent and the other co-owners) is generally a possible basis for permission. However, it must be examined whether the principles of data processing pursuant to Article 5 of the GDPR, in particular Article 5, paragraph one, letter c of the GDPR “data minimization”, have been observed when processing the personal data in question. These, in and of themselves, constitute legally binding regulations that must be taken into account when examining the legality of the data processing in question. As the BVwG stated in its decision on GZ W258 2216873-1 of October 30, 2019, the processing of personal data is permissible if it was carried out in compliance with the processing principles set out in Article 5 of the GDPR and on the basis of one of the permissions set out in Article 6 of the GDPR.
Data minimization is the principle of reducing the processing of personal data to what is unavoidable. Only the principle of data minimization brings about an essential aspect of purpose limitation: It ensures that the processing is actually limited to the specified purpose (Hötzendorfer / Tschohl / Kastelitz in DatKomm Art. 5 GDPR, Rz 28). The principle of data minimization standardized in Art. 5 Para. 1 lit. c GDPR for the processing of personal data states that the data must be appropriately limited to the extent necessary for the purposes of the processing. According to this principle, personal data may only be processed if the purpose of the processing cannot be reasonably achieved in accordance with the purposes of the processing (DatKomm Article 5, GDPR, Rz 28). The principle of data minimization standardized in Article 5, Paragraph 1, Letter c, GDPR for the processing of personal data states that the data must be appropriately limited to the extent necessary for the purposes of the processing. According to this principle, personal data may only be processed if the purpose of the processing cannot reasonably be achieved by other means (see above) (see Heberlein in Ehmann/Selmayr, GDPR2, K22 to Art. 5). The principle of data minimization sets out three requirements to be measured against the purpose of the processing, namely adequacy, relevance and limitation to the necessary extent.
In its statements of January 17, 2023 and February 7, 2023, the controller essentially stated that the security concept for the residential complex at O***allee *8, 1*** Vienna had been retrofitted in order to prevent theft, damage to property and the presence of outside persons. In this regard, the data protection authority admits that there have been proven illegal activities in the residential complex in the recent past (see the enclosed documents in the controller’s statement of February 7, 2023), but in accordance with the principle of data minimization set out above in accordance with Art. 5 (1) (c) GDPR, it must be examined whether the video camera system implemented is suitable for achieving the purpose. In its statements of January 17, 2023 and February 7, 2023, the controller essentially stated that the security concept for the residential complex at O***allee *8, 1*** Vienna had been retrofitted in order to prevent theft, damage to property and the presence of outside persons in the building. In this regard, the data protection authority admits that there has been evidence of illegal activities in the residential complex in the recent past (see the enclosed documents in the statement of February 7, 2023 by the responsible party), but in accordance with the principle of data minimization outlined above in accordance with Article 5, paragraph one, letter c, GDPR, it must be examined whether the video camera system implemented is the mildest means of achieving the purpose. In this context, the fact that the responsible party's current security concept includes two points must be taken into account, specifically the installation of video surveillance cameras and the installation of an electronic access system. These two measures were implemented in the same period.
The Data Protection Authority has divided the recording areas of the individual video cameras of the surveillance system:
a) The video cameras with the numbers 1, 2, 3, 4, 5, 6, 7, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 26, 28, 29, 30, 31, 32 and 38, whose recording areas cover the entrance, elevator, staircase and corridor areas
Due to the installed video cameras with the number 6 ("Floor 1 - ground floor entrance"), number 7 ("Floor 1 - ground floor staircase"), number 17 ("Floor 2 - ground floor main entrance"), number 22 ("Floor 2 - ground floor courtyard access"), number 26 ("Floor 2 - gate to the garage"), number 30 ("main entrance"), Number 31 (“side entrance”), number 32 (“courtyard access”) and number 38 (“gate next to garage entrance”), residents, their visitors and third parties (e.g. parcel and postal carriers) must pass through the respective recording area of the above-mentioned video cameras each time they enter and leave the residential building. In addition, the recording areas of the video cameras with the numbers 1, 2, 3, 4, 5, 12, 13, 14, 15, 16, 18, 19, 20, 21, 28, 29 and 33 cover the elevator, stairwell and corridor areas near the garage. Consequently, residents and any of their visitors are recorded each time they enter and leave the apartment building and also partly in the building when using the elevator, stairs and corridors. The person responsible explains this in the statement of February 27, 2023 under point 5 ("It is correct that every resident of the building is recorded when entering and leaving the residential building O***allee *8.")
The purpose of these video cameras is to keep out outsiders, with the video cameras labeled 6 ("Floor 1 - ground floor entrance") and 17 ("Floor 2 - ground floor main entrance") having the additional purpose of preventing thefts at the parcel stations.
With regard to the purpose of preventing outsiders from entering the residential building, it should be noted that this purpose is already achieved by the simultaneous installation of the electronic access system. This prevents people from entering the residential complex who do not have access authorization. From the point of view of the data protection authority, this electronic access system represents the milder means of achieving the intended purpose - preventing access by outsiders. The level of intrusion caused by the large number of video cameras installed, which - as already stated - record residents and their visitors entering and leaving the property, is therefore particularly intensive.
Based on the considerations set out above, the Data Protection Authority has therefore come to the conclusion that the data processing by video cameras numbered 1, 2, 3, 4, 5, 7, 12, 13, 14, 15, 16, 18, 19, 20, 21, 22, 26, 28, 29, 30, 31, 32 and 38 does not comply with the principle of data minimization.
Cameras numbered 6 and 17 also have the additional purpose of preventing theft of residents' packages or mail. Taking into account the principles of the GDPR, the controller can also achieve this purpose if the recording areas of the video cameras with numbers 6 and 17 are restricted to the collection stations of the logistics or postal company and the area beyond that (entrance area) is not recorded. In the light of Article 5, paragraph 1, letter c, GDPR, this represents a much milder means of achieving the purpose. and the area beyond that (entrance area) is not recorded. In the light of Article 5, paragraph 1, letter c, GDPR, this represents a much milder means of achieving the purpose.
The data protection authority expressly notes that a balancing of interests in accordance with Article 6, paragraph 1, letter f, GDPR would lead to the same result, because the consistent case law of the ECJ (see judgment of June 17, 2021, C-597/19, paragraph 106) shows that a total of three conditions must be met cumulatively. In addition to the legitimate interest, the data protection authority expressly notes that a balancing of interests in accordance with Article 6, paragraph one, letter f, GDPR would lead to the same result, because the consistent case law of the ECJ (see judgment of June 17, 2021, C-597/19, paragraph 106) shows that a total of three conditions must be met cumulatively. In addition to the legitimate interest, the necessity of the processing (appropriate, significant and limited to the minimum necessary) and the interests of the controller must also prevail.
Regarding the second requirement of Article 6(1)(f) GDPR, namely that the processing of personal data is necessary to pursue the legitimate interest pursued, the Court of Justice has pointed out that exceptions and limitations to the protection of personal data must be limited to what is strictly necessary (see, for example, ECJ, 4 May 2017, C-13/16 or ECJ, 9 November 2010, C-92/09 and C-93/09). Guidelines 3/2019 of the European Data Protection Board of 29 January 2020 (“Guidelines on the processing of personal data by video devices”) stipulate in point 24 ff. that video surveillance must be adequate, relevant and limited to what is necessary for the purposes of the processing (“data minimisation”, cf. Article 5(1)(c) GDPR). It would have to be examined here whether this is necessary ("data minimization", see Article 5 paragraph 1 letter c, GDPR). It would have to be examined here whether the same protective purpose can also be achieved by a milder means or whether the desired goal can be achieved with less intrusive data processing. If suitable means of achieving the goal exist that are less intrusive than video surveillance, these are in any case preferable to video surveillance (see decision of the VwGH of 12 September 2016, Ro 2015/04/0011). see decision of the VwGH of 12 September 2016, Ro 2015/04/0011).
In this respect, when balancing the interests, the interests of the data subjects in confidentiality prevail due to the lack of necessity for data processing by cameras numbered 1, 2, 3, 4, 5, 7, 12, 13, 14, 15, 16, 18, 19, 20, 21, 22, 26, 28, 29, 30, 31, 32 and 38, and in the case of video cameras numbered 6 and 17, the intended purpose can also be achieved by restricting the recording area, as already stated.
b) The video cameras with the numbers 8, 9, 10, 11, 23, 24, 25, 34, 33, 35 and 36, whose recording areas cover the garbage rooms, the corridor in front of the children's playrooms, and bicycle and stroller storage rooms
Garbage rooms (video cameras with the numbers 8, 9, 10, 34 and 35)
The recording areas of the video cameras with the numbers 9, 10 and 35 cover the closed rooms in which the garbage containers are located. In the statement of February 27, 2023, the person responsible stated that in the past there had been repeated cases of damage to property in these rooms - on the one hand due to the destruction of the tiles on the walls and on the other hand due to the improper storage of bulky waste. The purpose of monitoring the garbage rooms is to prevent damage to property.
It should be noted that for this purpose it is sufficient to record the premises themselves using video cameras numbered 9, 10 and 35, but it is not necessary to record the corridors in front of these premises using video cameras numbered 8 and 34. According to the principle of data minimisation pursuant to Art. 5 Paragraph 1 Letter c of GDPR, personal data may - as already explained above - only be processed if the purpose of the processing cannot be reasonably achieved by other means. According to the principle of data minimisation pursuant to Article 5 Paragraph 1 Letter c of GDPR, personal data may - as already explained above - only be processed if the purpose of the processing cannot be reasonably achieved by other means.
It must therefore be concluded that the person responsible did not follow the principle of using the least restrictive means to achieve the purpose, because the purpose of the proceedings, namely preventing or documenting damage to property, can already be achieved by the video cameras numbered 9, 10 and 35, which are located in these premises. In the present case, there is no need to record the areas in front of the waste disposal premises using video cameras numbered 8 and 34, thereby also recording uninvolved third parties who do not use the waste disposal premises, and this violates the principle of data minimisation (cf. Art. 5 (1) (c) GDPR). As a result, it can be stated that the controller has not objectively followed the principle of using the mildest means to achieve its purpose, because the purpose of the proceedings, namely preventing or documenting damage to property, can already be achieved by video cameras numbered 9, 10 and 35, which are located in these premises. In this case, there is no need to record the areas in front of the garbage rooms using video cameras numbered 8 and 34, thereby also recording uninvolved third parties who do not use the garbage rooms, and this violates the principle of data minimization (see Article 5, paragraph 1, letter c, GDPR).
Bicycle storage rooms, stroller storage rooms and the corridor in front of the children's playrooms (video cameras numbered 11, 23, 24, 25, 33 and 36)
The recording areas of the video cameras numbered 24, 25 and 36 record the rooms in which the residents' bicycles and strollers are parked. The data protection authority does not ignore the fact that thefts or attempted thefts have occurred in the recent past (December 2022), but it is not necessary to record the area in front of the bicycle room using the video camera with the number 23. As the controller itself stated in its statement of February 27, 2023, the thief is recorded by the video cameras in the respective room when entering the premises or, if necessary, these serve as a deterrent.
The video camera with the number 23, which only films the area in front of the bicycle room on staircase 2, is not needed for this purpose and violates the principles of data processing according to Art. 5 GDPR, especially since the video cameras within these premises are sufficient for the purpose to be achieved (prevention of theft and damage to property). required and violates the principles of data processing pursuant to Article 5 of the GDPR, especially since the video cameras within these premises are sufficient for the purpose to be achieved (prevention of theft and damage to property).
With regard to the two video cameras with the numbers 11 and 33, which film the corridors in front of the children's play areas (in particular the video camera with the number 11), reference should first be made to the above statements under point a, according to which the installation of the electronic access system represents a milder means of keeping out outsiders. With regard to the two purposes of counteracting theft and damage to property in the children's play areas, it should also be noted that, despite the options available, the person responsible has not provided any objective evidence, but has merely stated that only dummies have been installed in those premises. This also represents a milder means of preventively warding off such dangers. There is therefore a violation of Article 5(1)(c) GDPR with regard to the two video cameras numbered 11 and 33. With regard to the two video cameras numbered 11 and 33, which film the corridors in front of the children's play areas (in particular the video camera number 11), reference should first be made to the above statements under point a, according to which the installation of the electronic access system represents a milder means of keeping out outsiders. With regard to the two purposes of preventing theft and damage to property in the children's play areas, it should also be noted that, despite the options available, the person responsible has not provided any objective evidence, but has merely stated that only dummies have been installed in those premises. This also represents a milder means of preventively warding off such dangers. There is therefore a violation of Article 5, paragraph 1, letter c, GDPR with regard to the two video cameras with the numbers 11 and 33.
With regard to the recording areas of the video cameras with the numbers 9, 10, 24, 25, 35 and 36, which cover the areas in the garbage, bicycle and stroller storage rooms, it must be stated that these comply with the principles of data processing.
With regard to these cameras, the next step is to check whether the legitimate interests of the controller pursuant to Art. 6 Paragraph 1 Letter f GDPR with regard to the video cameras with the numbers 9, 10, 24, 25, 35 and 36 outweigh. With regard to these cameras, the next step is to check whether the legitimate interests of the controller pursuant to Article 6, paragraph one, letter f, GDPR with regard to the video cameras with numbers 9, 10, 24, 25, 35, 36 outweigh those of the controller.
According to the already cited case law of the ECJ (see judgment of June 17, 2021, C-597/19, paragraph 106), three conditions are necessary for an appeal to Art. 6, paragraph 1, letter f, GDPR. Likewise, Guidelines 3/2019 of the European Data Protection Board of January 29, 2020 According to the already cited case law of the ECJ (see judgment of June 17, 2021, C-597/19, paragraph 106), three conditions are necessary for an appeal to Article 6, paragraph one, letter f, GDPR. Likewise, Guidelines 3/2019 of the European Data Protection Board of January 29, 2020 (“Guidelines on the processing of personal data by video devices”) - based on European case law - provide the following criteria for the existence of a legitimate legal interest within the meaning of Article 6, paragraph 1, letter f, GDPR (see pages 10 ff. of the guidelines): - based on European case law - provide the following criteria for the existence of a legitimate legal interest within the meaning of Article 6, paragraph 1, letter f, GDPR (see pages 10 ff. of the guidelines): i. Legitimate interests of a legal, economic or immaterial nature; ii. Necessity of processing (appropriate, significant and limited to what is necessary) iii. Balancing of interests (outweighing of the interests of the controller) i. ad legitimate interest: The guidelines provide in paragraphs 19 -20. provides that the purpose of protecting property from burglary, theft or vandalism can constitute a legitimate interest in video surveillance if there is an actual risk situation. The legitimate interest must be actual and current (i.e. it must not be fictitious or speculative) and there must be a real risk situation (e.g. serious incidents in the past may indicate this). The subject matter of the proceedings has been thefts in the bicycle and stroller storage rooms (see statement by those responsible dated February 27, 2023). There has also been damage to property in the garbage rooms. (e.g. serious incidents in the past may indicate this). The subject matter of the proceedings has been thefts in the bicycle and stroller storage rooms (see statement by those responsible dated February 27, 2023). There has also been damage to property in the garbage rooms.
ii. ad Necessity of processing: The guidelines stipulate in points 24 ff. that video surveillance is appropriate, relevant and limited to what is necessary for the purposes of processing (“data minimisation”, see Article 5 Paragraph 1 Letter c of GDPR). Here it must be examined whether video surveillance is suitable for achieving the intended goal, is appropriate and necessary for the purpose, and whether the purpose cannot be achieved by less stringent means that interfere less with the fundamental rights and freedoms of the data subject. The guidelines stipulate in points 24 ff. that video surveillance is appropriate, relevant and limited to what is necessary for the purposes of processing (“data minimisation”, see Article 5 Paragraph 1 Letter c of GDPR). Here it must be examined whether video surveillance is suitable for achieving the intended goal, is appropriate and necessary for the purpose, and whether the purpose cannot be achieved by less stringent means that interfere less with the fundamental rights and freedoms of the data subject.
It should be noted that the bicycle parking spaces are located in the building and yet (most recently in December 2022) there have been repeated thefts or attempted thefts of bicycles. It is therefore clear that the protection of the property of the residents of the building cannot be guaranteed by milder means.
iii. ad balancing of interests: The guidelines stipulate in point 30 ff that even if video surveillance is necessary to protect the legitimate interests of a controller, it may only be operated if the interests or fundamental rights and freedoms of the data subject do not outweigh the legitimate interests of the controller or a third party (e.g. protection of property or physical integrity). The decisive factor is the intensity of the interference, which can result, among other things, from the type, extent and number of the area monitored. In accordance with Recital 47, the reasonable expectations of the person concerned must be taken into account.
As already stated, bicycle thefts have occurred from the bicycle storage room in the past. On the one hand, surveillance in this case is also in the legitimate interest of those residents who have parked bicycles or strollers, so that the surveillance also serves to protect their property, and on the other hand, the intensity of the intervention is not comparable to surveillance in the most personal areas (such as in the entrance, corridor and elevator areas).
In summary, therefore, with the cameras numbered 9, 10, 24, 25, 35 and 36 in the garbage rooms, bicycle and stroller storage rooms, there is a legitimate and - as a result of the balancing of interests - justified interest in protecting the property of those responsible.
c) Video cameras numbered 27 and 37 in the garage entrance area
The video cameras numbered 27 (staircase 2 garage entrance) and number 37 (reception 2 garage entrance) record the entrances to the garages. This means that those residents who are authorized to use the garage are recorded every time they enter and leave. However, it should be noted that the intensity or depth of the intervention is less serious than in the entrance areas and that there has also been a recent case - as stated by the person responsible in the statement of February 27, 2023 - in which a tenant himself triggered the fire alarm in the parking garage. A violation of the principles of data processing is not apparent and also outweighs the legitimate interest of the person responsible and third parties (the other residents of the building) who park in the garage.
D.3. Summary remarks
In the overall legal assessment of the case in question, the data protection authority took into account that there have been thefts and damage to property in the past and that - as stringently stated by the person responsible in her statements - people who were not from the building have repeatedly been in the building. By installing an electronic access system at the same time as the video surveillance, the controller has - as explained above - chosen a milder means of achieving its purpose. With regard to the thefts and damage to property in the bicycle and garbage areas and in the garage area, the Data Protection Authority also recognises the expediency and necessity of the video cameras, as milder means such as dummies do not appear to be suitable and permanently deploying security guards does not make economic sense. However, complete surveillance of the lift, staircase, corridor and entrance areas represents a disproportionately serious infringement on the fundamental right to confidentiality of residents and their visitors. Furthermore - as explained above - although the Data Protection Authority does not ignore the controller's legitimate interest, the Data Protection Commission has already ruled in its decision of 6 February 2008 on ZI. K600.049-424/0001-DVR/2008/00 stated that, “even if an objectively ascertainable, overriding legitimate interest of the owner in the protection of property (…) exists in principle – this has its limits where the privacy of the apartment owners is disproportionately impaired: Video surveillance of the entrances to individual apartments, for example, cannot be successfully justified by the existence of a right of disposal of the house owner over a residential building – it represents a disproportionate intrusion into the privacy of people entering and leaving. (…) The problem of the proportionality of (video) surveillance also exists – albeit to a lesser extent – in the surveillance of building entrances and staircase areas, especially since entering these cannot be avoided if communication with residents (which is to be attributed to private life) is sought.” This legal opinion is consistent with the case law of the OGH. With regard to the concept of "highly personal areas of life", the Court has stated that taking pictures in private areas, ongoing unwanted surveillance and stalking constitute a violation of the personal right to respect for a person's private sphere and confidentiality as protected by Article 8 of the ECHR; the protection of a tenant's privacy from such measures does not end at the inner door of the apartment; and stalking constitute a violation of the personal right to respect for a person's private sphere and confidentiality as protected by Article 8 of the ECHR; the protection of a tenant's privacy from such measures does not end at the inner door of the apartment; there is a perfectly legitimate interest in ensuring that the tenant, his roommates or guests do not constantly monitor and record their entry or exit to or from an apartment. the issue here is not whether such surveillance is also recorded, because it already constitutes a serious invasion of privacy (secrecy) if a person concerned feels exposed to constant pressure of surveillance due to the manner in which it is installed and the outward appearance (cf. OGH 17.12.2013, 5 Ob 69/13b). The above legal statements can also be found in the consistent case law of the Federal Administrative Court (most recently in the decision on GZ W245 2246467-1/11E of 21 April 2023).; the issue here is not whether such surveillance is also recorded, because it already constitutes a serious invasion of privacy (secrecy) if a person concerned feels exposed to constant pressure of surveillance due to the manner in which it is installed and the outward appearance (cf. OGH 17.12.2013, 5 Ob 69/13b). The above legal statements can also be found in the consistent rulings of the Federal Administrative Court (most recently in the decision on GZ W245 2246467-1/11E of April 21, 2023).
In summary, it is therefore again stated that the interest of the residents in not having their personal data (or that of their visitors) processed through image recordings every time they leave and enter their apartments outweighs the - possibly objectively legitimate - interest of those responsible in protecting their property. It therefore follows that the processing of personal data by those cameras whose recording areas all persons (residents, visitors, parcel/postal workers, etc.) have to pass through when leaving and entering the residential property is not covered by a legitimate interest of those responsible.
D.4. On point 2 (restriction of the recording area)
According to Article 58, Paragraph 2, Letter d, of the GDPR, the data protection authority has remedial powers that allow it to instruct a controller to change or carry out processing operations in a specific way and within a specific period of time.
Based on the above-cited provision, the controller was instructed to restrict the recording areas of the video cameras with numbers 6 and 17 so that only the collection points of the logistics or postal company are recorded, but not the entrance area.
The way in which the controller implements point 2 is up to it; both "physically moving" the cameras and setting up a "black screen" or attaching a privacy screen are possible. A period of two weeks seems appropriate for this.
The decision regarding point 2 was therefore made in accordance with the judgment.
D.5. On point 3 (prohibition of further image processing)
As can be seen from the above statements under D.2 and D.3 of the legal assessment, the recordings by video cameras with the numbers 1, 2, 3, 4, 5, 7, 8, 11, 12, 13, 14, 15, 16, 18, 19, 20, 21, 22, 23, 26, 28, 29, 30, 31, 32, 33, 34 and 38 of the video camera system in question are inadmissible, which is why data processing for these had to be prohibited in accordance with Art. 58 Paragraph 2 Letter f of GDPR. As can be seen from the above statements under D.2 and D.3. According to the legal assessment, the recordings by video cameras with numbers 1, 2, 3, 4, 5, 7, 8, 11, 12, 13, 14, 15, 16, 18, 19, 20, 21, 22, 23, 26, 28, 29, 30, 31, 32, 33, 34 and 38 of the video camera system in question are inadmissible, which is why data processing for these cameras had to be prohibited in accordance with Article 58, Paragraph 2, Letter f, GDPR.
It was therefore necessary to make a decision with regard to point 3 of the judgment.
