Datainspektionen - DI-2020-4534
From GDPRhub
| Datainspektionen - DI-2020-4534 | |
|---|---|
 | |
| Authority: | Datainspektionen (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 6(1)(f) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 14.12.2020 |
| Published: | 14.12.2020 |
| Fine: | 300000 SEK |
| Parties: | Uppsalahem AB |
| National Case Number/Name: | DI-2020-4534 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Swedish |
| Original Source: | Datainspektionen (in SV) |
| Initial Contributor: | Charlotte Godhe |
The Swedish DPA (Datainspektionen) held that it was not proportionate with regard to Article 6(1)(f) GDPR to conduct camera surveillance of all tenants in an apartment in order to investigate harassment and disturbances towards one tenant.
English Summary
Facts
The housing company set up a surveillance camera to film the door of a tenant who had been objected to harassment and disturbances for a long time. In the camera's recording area, another tenant’s door could be seen, as well as tenants walking in and out of the apartment house. The camera recording was without sound recording or real-time monitoring, and the recordings could only be accessed by five people within the company.
Dispute
Does the interest of camera surveillance to combat disturbances and harassment in an apartment building outweigh the right to the integrity of the tenants under Article 6(1)(f)?
Holding
The DPA held that Uppsalahem AB had processed personal data in breach of Article 6 (1) (f) GDPR by conducting camera surveillance of common areas in an apartment building.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Decision Diary No. 1 (12)
2020-12-14 DI-2020-4534
Ert diarienr
Uppsalahem AB
Box 136
751 04 Uppsala
Uppsalahem AB - Supervision according to
the Data Protection Regulation
Content
Uppsalahem AB - Supervision according to the Data Protection Ordinance .................................. 1
The Data Inspectorate's decision ................................................ ..................................... 2
Report on the supervisory matter ............................................... ............................. 2
Motivation for decision ............................................... .............................................. 4
What is covered by the Data Inspectorate's examination of the case? .............................. 4
The Data Inspectorate's assessment ................................................ ........................ 5
Article 6 (1) (f) - balancing of interests ............................................ ...................... 5
Is the company's security interest justified? ............................................. .... 5
Is the surveillance necessary to safeguard the interest in surveillance? ........... 6
Do the interests of the data subjects outweigh the interests of the security guards? ............. 7
Choice of intervention ............................................... .............................................. 8
Penalty fee ................................................. .............................................. 9
Determination of penalty fee ............................................... ................. 9
Appendix ................................................. .................................................. ............... 11
Copy for information to: ............................................. ..................................... 11
How to appeal............................................... ........................................... 12
Postal address: Box 8114, 104 20 Stockholm E-mail: datainspektionen@datainspektionen.se
Website: www.datainspektionen.se Phone: 08-657 61 00Datainspektionen DI-2020-4534 2 (12)
The Data Inspectorate's decision
The Data Inspectorate states that Uppsalahem AB has processed
personal data in breach of Article 6 (1) (f) the Data Protection Regulation by:
conduct camera surveillance of common areas in an apartment building
and parts of dwellings in the same house between 25 February 2020 and 14
May 2020 when the interest in monitoring does not outweigh those registered
interests as well as fundamental freedoms and rights on the ground.
The Data Inspectorate decides on the basis of Articles 58 (2) and 83
the Data Protection Ordinance for violation of Article 6 (1) f) that Uppsalahem AB
shall pay an administrative sanction fee of SEK 300,000.
Report on the supervisory matter
On 9 March 2020, the Data Inspectorate received a complaint about
camera surveillance in an apartment building. The complaint alleges that
Uppsalahem AB conducts camera surveillance in an apartment building with one
camera mounted in such a way that it films straight towards the complainant's
apartment door. The Data Inspectorate has initiated supervision against Uppsalahem AB for the purpose
to investigate the scope of the surveillance and whether it
personal data processing that monitoring entails (hereinafter
"Surveillance") has legal support under Article 6 of the Data Protection Regulation.
Uppsalahem AB (hereinafter "the company") has mainly stated the following.
The company is responsible for personal data for monitoring. The camera has been
mounted in the residential building in the manner claimed in the complaint and filmed
the floor where the appellant lives. In the shooting area of the camera, two are visible
apartment doors clearly in the picture, one of which belongs to the complainant and the other
belongs to a resident of the house who has been subjected to disturbances and harassment.
The complainant's door is filmed from the side and the other door is filmed from the front.
If the complainant opens his apartment door, a narrow angle of the hall is filmed in
the apartment. If the other tenant opens his apartment door is filmed
the hall in the apartment.
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016
on the protection of individuals with regard to the processing of personal data and on that
free flow of such data and repealing Directive 95/46 / EC (General
Data Protection Ordinance) .Data Inspectorate DI-2020-4534 3 (12)
The camera was installed in the apartment building on 25 February 2020 and
The surveillance has been going on around the clock since then until 14 May
2020. Surveillance takes place only with image recording, without real-time surveillance
or listening or recording sound. Access to the material is restricted
to five executives within the company - one lawyer, one trustee, two
housing supporter and a housing consultant - and the material is stored only
locally in the camera. Housing coordinator, housing consultant and manager
need access to the material in their work of handling
disturbance cases. A lawyer needs access to the material in cases where a legal
assessment needs to be made and whether materials need to be used as
evidence in disputes. To be able to take part in the material, you must load
download the media in place from the camera to an external device. Meanwhile then
the surveillance was ongoing, no access to the material has actually taken place, and
material has also not been shared with any external actor.
The purpose of the surveillance is to deal with the disturbances
which has been going on in the stairwell for a long time, but which escalated in the beginning
of 2019. It has been about potentially criminal behavior in the form of
vandalism and harassment as well as other types of disruptive behavior that do not
are necessarily criminal. The appellant has been singled out by other residents as
the one who is responsible for the problems. The camera has been aimed at one
apartment door belonging to a resident who has been particularly exposed to harassment
in order to identify the perpetrator when he is at the door.
The company supports its monitoring on the legal basis of balancing interests
pursuant to Article 6 (1) (f) of the Data Protection Regulation. In its balance of interests has
the company weighed its own interest in conducting surveillance against the individuals
interest in the protection of privacy. The company has stated that
the following circumstances have mainly been taken into account in a strengthening direction for
their guarding interest.
The landlord's obligation according to the Land Code, ch. 12 to take action
to cause disturbances in the rental property to cease and tenants
the right to compensation if the landlord does not take such measures,
the existing problems and the incidents that have occurred
the place,
the importance of identifying the perpetrator or perpetrators,
the potentially deterrent effect that surveillance could have
future incidents and the Swedish Data Inspectorate DI-2020-4534 4 (12)
the security-creating function the surveillance could have for them
residents who have been subjected to harassment and vandalism.
The company has stated that it has weighed its interest in surveillance against them
individuals' interest in not being monitored on site. The company has at the same time
stated that it has been assessed that the invasion of privacy that the surveillance entails
has been limited by the following measures taken in connection with
the surveillance.
The fact that staff at Uppsalahem do not have direct access to
recorded material as well
that access to material should only take place when there are strong reasons.
With this in mind, the company considers that the interest in surveillance outweighs
than the interest of privacy and that the surveillance is thus permitted according to article
6.1 f the Data Protection Regulation.
Justification of decision
What is covered by the Data Inspectorate's examination of the case?
The Data Protection Regulation contains a large number of rules that must be followed
processing of personal data, including those through
camera surveillance. Within the framework of this supervisory matter deals
The Data Inspectorate does not have all the rules and issues that can
updated in such a personal data processing as the current one
the surveillance entails. The examination is limited to the question of whether the company has
supported the treatment in any of the legal bases set out in
Article 6 of the Data Protection Regulation. The Data Inspectorate thus does not take
position on whether the company has followed or not followed any others
the provisions of the Data Protection Regulation in the context of this case, such as
for example, the provisions on the rights of data subjects under the Articles
12-22 Data Protection Ordinance. Supervision does not cover either
the provisions of the Camera Surveillance Act (2018: 1200), for example if
duty of permission, duty of disclosure or duty of confidentiality. Data Inspectorate DI-2020-4534 5 (12)
The Data Inspectorate's assessment
Article 6 (1) (f) - balancing of interests
The company has stated that the current monitoring is supported by Article 6 (1) f)
the Data Protection Regulation. There are three conditions that must be met
2
fulfilled for that to be the case. The first condition is that they
interests that the guardian intends to protect must be justified
interests. The second condition is that the surveillance is necessary to
protect the current interest or interests. The third condition is
that the data subject's fundamental freedoms and rights do not outweigh
the legitimate interest that the surveillance intends to protect. These props should
therefore be tried separately in the context of this case.
Is the company's security interest justified?
The first part of the assessment concerns the nature of the interests
the surveillance should protect. Not all conceivable interests could
achieved or protected by camera surveillance may be considered justified.
A legitimate interest is an interest that, in general, is enjoyed
protection of the legal system or is otherwise considered legitimate, ethical or
defensible. An interest protected by EU law or relevant national
right must, for example, be regarded as justified. The Data Inspectorate must therefore
take a position on whether the company's security interest can be considered
justified in this case.
The purpose of the surveillance in this case has been to come to fruition
with the disturbances that have occurred in the property during a longer
time. The disturbances have largely consisted of potentially criminal ones
attacks on residents' freedom, peace, health or property. The interest of that
prevent, prevent or detect crime is normally considered to be one
3
legitimate interest. The European Court of Justice has further ruled in case C-708/18 that a
tenant-owner association has a legitimate interest according to the elderly
data protection legislation to protect tenants' property, health
and life. There is no reason to assume that the entry into force of
The Data Protection Regulation has led to a change in the legal situation in that area.
It may further be assumed that a landlord has the same interest in relation to
their tenants that a tenant-owner association has in relation to theirs
Judgment of the European Court of Justice in Case C-13/16 Riga's Satikism paragraph 28.
Judgment of the European Court of Justice in Case C-708/18 TK paragraph 42. Data Inspectorate DI-2020-4534 6 (12)
members. The Data Inspectorate therefore assesses that the company's interest in
conducting on-site surveillance has been a legitimate interest.
Is surveillance necessary to safeguard the interest in surveillance?
Furthermore, surveillance must be necessary to protect the mentioned interests.
In this assessment, the Data Inspectorate must check that it is justified
the interest that has emerged in the case cannot reasonably be protected on an equal footing
effectively by other means which to a lesser extent interfere with the
fundamental freedoms and rights were registered, in particular the right to protection
for privacy and the right to the protection of personal data under Articles 7 and
8 of the EU Charter of Fundamental Rights. The condition that the processing of personal data must
be necessary shall be further tested together with the principle of
data minimization, as set out in Article 5 (1) (c) of the Data Protection Regulation. 4
It appears from the investigation in the case that the company has taken alternative and
less privacy-sensitive measures for camera surveillance before the camera
assembled. However, these measures have not had the intended effect. Then the camera
installed, the disturbances in the stairwell ceased in principle completely and
the direction. This suggests that the surveillance was necessary to protect the company
and the legitimate interests of tenants.
It must also be taken into account in the examination of whether the monitoring was necessary or
not if the camera has been used in a way that limits its intrusion
the privacy that surveillance entails without compromising that matter
would jeopardize the effectiveness of surveillance. In the present case,
the invasion of privacy is limited by the measures that the company has taken
applies to access to the recorded material. The company has also chosen to operate
surveillance only with a camera and at the place where it was judged that
the surveillance had the potential to give the greatest effect, which is compatible with
the principle of data minimization. At the same time, it could have been minimized
further data collection by masking parts of the camera
catchment area, especially the apartment doors that are clearly visible in the picture. MAN
had also for the same reason been able to consider mounting the camera so that
you filmed from a different angle or in some other way adjust the camera
catchment area. This would have made it possible to avoid filming in
3
Charter of Fundamental Rights of the European Union (2010 / C 83/02).
4 C-708/18 TC points 47-48.
5 C-708/18 TK, item 50.Datainspektionen DI-2020-4534 7 (12)
the dwellings on the ground floor, which has most likely happened below
the time the camera was in operation.
Taking into account the alternative measures that the company has taken before
the camera was mounted without effect, the Data Inspectorate assesses, however
overall that the monitoring was necessary to take advantage of the company's and
the legitimate interests of the residents.
Do the interests of the data subjects outweigh the interests of the security guards?
Initially, it can be stated that camera surveillance by definition
entails a restriction of the right to protection of personal data, which
guaranteed by Article 8 of the Statute of Rights. Because the coverage in this
the case has been conducted in close proximity to individuals' private homes, it has
also entailed a restriction of the right to respect for private and
family life and own housing guaranteed by Article 7 of the
the Charter of Rights. Because the surveillance has taken place on the property's first
floor level, all residents in the house have been subject to surveillance on the way to
and from his home throughout the period the camera was on. This applies
especially for the complainant and the accommodation in the apartment next to the complainant, because
their apartment doors are so clearly included in the camera's recording area.
It should also be taken into account that case law regarding the monitoring of common
spaces in apartment buildings have been restrictive. It has been described, for example
that security of entrances to apartment buildings - where the interest in privacy can
assumed to be slightly lower than in the present case - can be accepted only in pure
6
exceptional cases. The European Data Protection Board (EDPB) has further stated that
the data subject should not reasonably expect to be subject to surveillance
7
on private land or in living environments. These circumstances mean that
the interest in privacy at the site as a starting point weighs very heavily.
However, the interest in privacy is weakened somewhat by the fact that security
partly aimed at protecting the persons who have been the subject of surveillance
and by the fact that staff at the company did not have direct access to
the recorded material. In this context, the Data Inspectorate would like to remind
that it arrives at it during all personal data processing
personal data controller to implement routines that involve access
6 See the Data Inspectorate's decision of 21 June 2011 in case no. 1745-2010.
7 EDPB Guidelines 3/2019 on processing of personal data through video devices, p. 13Datainspektionen DI-2020-4534 8 (12)
to personal data only takes place when there are reasons for it. That the company in
the present case has had such a routine in place therefore does not affect
the interest in integrity in either a strengthening or weakening direction. By a
overall assessment, the Data Inspectorate considers that the integrity interest in
the place weighs very heavily.
With regard to the interest in surveillance, the Data Inspectorate finds no reason to
make any other assessment of the circumstances to be weighed than what
the company has done. In light of these, the Data Inspectorate assesses that
the interest in surveillance at the site weighs relatively heavily.
The company has thus had a significant security interest, but with consideration
to the very weighty interest in privacy, the Data Inspectorate assesses
that the interest in privacy outweighs. The Data Inspectorate therefore finds that
Uppsalahem AB has violated Article 6 of the Data Protection Ordinance by:
one has conducted camera surveillance to protect an interest that does not weigh
more important than the interests of the data subjects and fundamental freedoms and
rights on the spot.
Choice of intervention
Article 58 of the Data Protection Regulation lists all the powers that:
The Data Inspectorate has. According to Article 58 (2), the Data Inspectorate has a number
corrective powers, including warnings, reprimands or
limitations of treatment.
According to Article 58 (2) (i) of the Data Protection Regulation,
the supervisory authority shall impose administrative penalty fees in accordance with
with Article 83. Pursuant to Article 83 (2), administrative penalty fees,
depending on the circumstances of the individual case, is applied in addition to or in
instead of the measures referred to in Article 58 (2) (a) to (h) and (j)
Article 83 (2) (n) the factors to be taken into account in administrative decisions
penalty fees in general shall be imposed and in determining
the size of the fee.
Instead of penalty fees, in certain cases according to recital 148 to
data protection regulation a reprimand is issued instead of penalty fees
if it is a matter of a minor infringement. In the assessment, the Data Inspectorate DI-2020-4534 9 (12)
circumstances such as the nature, severity and
duration.
Penalty fee
The Data Inspectorate has above assessed that the company through its camera surveillance
of a floor in an apartment building, including apartment doors and parts of
housing, has violated Article 6 (1) (f) of the Data Protection Regulation.
In view of the processing of personal data by this supervision
includes has involved illegal camera surveillance concerning private individuals in its
home environment, it is not a question of a minor violation. The Data Inspectorate wants
in this context emphasize that the surveillance of residents' apartment doors and
parts of their homes have formed a particularly sensitive part of privacy
surveillance and that there is no reason to compensate for this
the penalty fee with a reprimand.
As the surveillance has ceased, it is not relevant to ban it in the future
the surveillance. For the same reason, it is also not relevant to impose
the company to limit the processing in a way that would make it legal.
There is thus no other corrective measure than penalty fees
current for the treatment that has taken place. The company must therefore be imposed on one
administrative penalty fee.
Determination of penalty fee
According to Article 83 (1) of the Data Protection Regulation, each supervisory authority shall:
ensure that the imposition of administrative penalty fees in each individual
cases are effective, proportionate and dissuasive. The administrative
the penalty fee may not, in accordance with Article 83 (3), exceed its amount
most serious violation if it is a question of one or the same
data processing or interconnected data processing.
Article 83 (2) of the Data Protection Regulation sets out all the factors that must:
taken into account when determining the size of the penalty fee. In the assessment
the size of the penalty fee shall take into account, inter alia, Article 83 (2)
a (nature, severity and duration of the infringement), b (intent or
negligence), g (categories of personal data), h (how the infringement came about
The Data Inspectorate's knowledge) and k (other aggravating or mitigating
factor such as direct or indirect financial gain)
Data Protection Ordinance.Data Inspectorate DI-2020-4534 1 0 (12)
Pursuant to Article 83 (5) (a) of the Data Protection Regulation, in the event of infringements of the
basic principles of treatment, including the conditions for consent,
according to articles 5, 6, 7 and 9, administrative penalty fees are imposed on up
to EUR 20 000 000 (twenty million) or, in the case of companies, up to 4
% of total global annual turnover for the previous financial year,
depending on which value is highest. According to the company's annual report for
In 2019, the company had sales of approximately 1,450,000,000 (one billion four hundred and fifty
million) during that financial year. 4% of that amount is 58,000,000
(fifty-eight million) kronor. Because this amount is less than 20,000,000
EUR, the penalty fee shall be set at an amount between 0 and
EUR 20 000 000.
The penalty fees must in each individual case be effective, proportionate
and deterrent. In the Data Inspectorate's assessment of the infringement
character, the following factors have been taken into account in an aggravating direction.
The violation has come to the Data Inspectorate's knowledge through
a complaint from an individual affected by the infringement.
Camera surveillance has taken place by tenants in their home environment, who
is dependent on the company.
The following factors have been considered in a mitigating direction.
The interest that the surveillance has been intended to protect has
assessed as a legitimate interest and the surveillance has been
necessary to safeguard this interest.
The violation has been committed through negligence rather than intentionally.
The infringement has been going on for a short time.
Overall, the Data Inspectorate finds that an efficient, proportionate and
deterrent penalty fee for the infringement found is 300,000
(three hundred thousand) kronor.
Uppsalahem AB must therefore pay an administrative penalty fee of 300
000 kronor.Datainspektionen DI-2020-4534 1 1 (12)
This decision was made by Director General Lena Lindgren Schelin after
presentation by Gustav Linder. At the final processing has also
unit manager Charlotte Waller Dahlberg participated.
Lena Lindgren Schelin, 2020-12-14 (This is an electronic signature)
Appendix
Appendix - How to pay a penalty fee
Copy for knowledge of:
Uppsala kommunDatainspektionen DI-2020-4534 1 2 (12)
How to appeal
If you want to appeal the decision, you must write to the Data Inspectorate. Enter i
the letter which decision you are appealing and the change you are requesting.
The appeal must have been received by the Data Inspectorate no later than three weeks from
the day you received the decision. If the appeal has been received in due time
the Data Inspectorate forwards it to the Administrative Court in Stockholm
examination.
You can e-mail the appeal to the Data Inspectorate if it does not contain
any privacy-sensitive personal data or data that may be covered by
secrecy. The authority's contact information can be found on the first page of the decision.
