Datainspektionen - DI-2020-4534: Difference between revisions

From GDPRhub
m (Corrected which DPA-logo that is displayed)
No edit summary
Line 48: Line 48:
}}
}}


The Swedish DPA (Datainspektionen) holds that it is not proportionate under Article 6(1)(f) GDPR to conduct camera surveillance of all tenants of the apartment in order to investigate harassment and disturbances towards one tenant.   
The Swedish DPA (Datainspektionen) held that it was not proportionate with regard to Article 6(1)(f) GDPR to conduct camera surveillance of all tenants in an apartment in order to investigate harassment and disturbances towards one tenant.   


==English Summary==
==English Summary==

Revision as of 22:07, 22 December 2020

Datainspektionen - DI-2020-4534
LogoSE.png
Authority: Datainspektionen (Sweden)
Jurisdiction: Sweden
Relevant Law: Article 6(1)(f) GDPR
Type: Investigation
Outcome: Violation Found
Started:
Decided: 14.12.2020
Published: 14.12.2020
Fine: 300000 SEK
Parties: Uppsalahem AB
National Case Number/Name: DI-2020-4534
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): Swedish
Original Source: Datainspektionen (in SV)
Initial Contributor: Charlotte Godhe

The Swedish DPA (Datainspektionen) held that it was not proportionate with regard to Article 6(1)(f) GDPR to conduct camera surveillance of all tenants in an apartment in order to investigate harassment and disturbances towards one tenant.

English Summary

Facts

The housing company set up a surveillance camera to film the door of a tenant who had been objected to harassment and disturbances for a long time. In the camera's recording area, another tenant’s door could be seen, as well as tenants walking in and out of the apartment house. The camera recording was without sound recording or real-time monitoring, and the recordings could only be accessed by five people within the company.

Dispute

Does the interest of camera surveillance to combat disturbances and harassment in an apartment building outweigh the right to the integrity of the tenants under Article 6(1)(f)?

Holding

The DPA held that Uppsalahem AB had processed personal data in breach of Article 6 (1) (f) GDPR by conducting camera surveillance of common areas in an apartment building.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

                                                              Decision Diary No. 1 (12)
                                                              2020-12-14 DI-2020-4534

                                                                                    Ert diarienr





                                                              Uppsalahem AB
                                                              Box 136

                                                              751 04 Uppsala








                    Uppsalahem AB - Supervision according to


                    the Data Protection Regulation


                    Content
                    Uppsalahem AB - Supervision according to the Data Protection Ordinance .................................. 1

                    The Data Inspectorate's decision ................................................ ..................................... 2

                    Report on the supervisory matter ............................................... ............................. 2

                    Motivation for decision ............................................... .............................................. 4

                       What is covered by the Data Inspectorate's examination of the case? .............................. 4

                       The Data Inspectorate's assessment ................................................ ........................ 5

                         Article 6 (1) (f) - balancing of interests ............................................ ...................... 5

                         Is the company's security interest justified? ............................................. .... 5

                         Is the surveillance necessary to safeguard the interest in surveillance? ........... 6

                         Do the interests of the data subjects outweigh the interests of the security guards? ............. 7

                       Choice of intervention ............................................... .............................................. 8

                         Penalty fee ................................................. .............................................. 9
                         Determination of penalty fee ............................................... ................. 9

                       Appendix ................................................. .................................................. ............... 11

                       Copy for information to: ............................................. ..................................... 11

                    How to appeal............................................... ........................................... 12










Postal address: Box 8114, 104 20 Stockholm E-mail: datainspektionen@datainspektionen.se
Website: www.datainspektionen.se Phone: 08-657 61 00Datainspektionen DI-2020-4534 2 (12)







                   The Data Inspectorate's decision

                   The Data Inspectorate states that Uppsalahem AB has processed
                   personal data in breach of Article 6 (1) (f) the Data Protection Regulation by:

                   conduct camera surveillance of common areas in an apartment building
                   and parts of dwellings in the same house between 25 February 2020 and 14

                   May 2020 when the interest in monitoring does not outweigh those registered
                   interests as well as fundamental freedoms and rights on the ground.


                   The Data Inspectorate decides on the basis of Articles 58 (2) and 83

                   the Data Protection Ordinance for violation of Article 6 (1) f) that Uppsalahem AB
                   shall pay an administrative sanction fee of SEK 300,000.




                   Report on the supervisory matter

                   On 9 March 2020, the Data Inspectorate received a complaint about
                   camera surveillance in an apartment building. The complaint alleges that

                   Uppsalahem AB conducts camera surveillance in an apartment building with one
                   camera mounted in such a way that it films straight towards the complainant's

                   apartment door. The Data Inspectorate has initiated supervision against Uppsalahem AB for the purpose
                   to investigate the scope of the surveillance and whether it

                   personal data processing that monitoring entails (hereinafter
                   "Surveillance") has legal support under Article 6 of the Data Protection Regulation.


                   Uppsalahem AB (hereinafter "the company") has mainly stated the following.

                   The company is responsible for personal data for monitoring. The camera has been
                   mounted in the residential building in the manner claimed in the complaint and filmed

                   the floor where the appellant lives. In the shooting area of the camera, two are visible
                   apartment doors clearly in the picture, one of which belongs to the complainant and the other

                   belongs to a resident of the house who has been subjected to disturbances and harassment.
                   The complainant's door is filmed from the side and the other door is filmed from the front.

                   If the complainant opens his apartment door, a narrow angle of the hall is filmed in
                   the apartment. If the other tenant opens his apartment door is filmed

                   the hall in the apartment.




                   REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016
                   on the protection of individuals with regard to the processing of personal data and on that
                   free flow of such data and repealing Directive 95/46 / EC (General

                   Data Protection Ordinance) .Data Inspectorate DI-2020-4534 3 (12)






                   The camera was installed in the apartment building on 25 February 2020 and

                   The surveillance has been going on around the clock since then until 14 May
                   2020. Surveillance takes place only with image recording, without real-time surveillance

                   or listening or recording sound. Access to the material is restricted
                   to five executives within the company - one lawyer, one trustee, two

                   housing supporter and a housing consultant - and the material is stored only
                   locally in the camera. Housing coordinator, housing consultant and manager

                   need access to the material in their work of handling
                   disturbance cases. A lawyer needs access to the material in cases where a legal

                   assessment needs to be made and whether materials need to be used as
                   evidence in disputes. To be able to take part in the material, you must load

                   download the media in place from the camera to an external device. Meanwhile then
                   the surveillance was ongoing, no access to the material has actually taken place, and
                   material has also not been shared with any external actor.


                   The purpose of the surveillance is to deal with the disturbances

                   which has been going on in the stairwell for a long time, but which escalated in the beginning
                   of 2019. It has been about potentially criminal behavior in the form of

                   vandalism and harassment as well as other types of disruptive behavior that do not
                   are necessarily criminal. The appellant has been singled out by other residents as

                   the one who is responsible for the problems. The camera has been aimed at one
                   apartment door belonging to a resident who has been particularly exposed to harassment

                   in order to identify the perpetrator when he is at the door.


                   The company supports its monitoring on the legal basis of balancing interests
                   pursuant to Article 6 (1) (f) of the Data Protection Regulation. In its balance of interests has

                   the company weighed its own interest in conducting surveillance against the individuals
                   interest in the protection of privacy. The company has stated that

                   the following circumstances have mainly been taken into account in a strengthening direction for
                   their guarding interest.


                        The landlord's obligation according to the Land Code, ch. 12 to take action

                          to cause disturbances in the rental property to cease and tenants
                          the right to compensation if the landlord does not take such measures,

                        the existing problems and the incidents that have occurred
                          the place,

                        the importance of identifying the perpetrator or perpetrators,
                        the potentially deterrent effect that surveillance could have

                          future incidents and the Swedish Data Inspectorate DI-2020-4534 4 (12)






                       the security-creating function the surveillance could have for them

                          residents who have been subjected to harassment and vandalism.


                  The company has stated that it has weighed its interest in surveillance against them
                  individuals' interest in not being monitored on site. The company has at the same time

                  stated that it has been assessed that the invasion of privacy that the surveillance entails
                  has been limited by the following measures taken in connection with

                  the surveillance.


                       The fact that staff at Uppsalahem do not have direct access to
                          recorded material as well

                       that access to material should only take place when there are strong reasons.


                  With this in mind, the company considers that the interest in surveillance outweighs
                  than the interest of privacy and that the surveillance is thus permitted according to article

                  6.1 f the Data Protection Regulation.



                  Justification of decision


                  What is covered by the Data Inspectorate's examination of the case?

                  The Data Protection Regulation contains a large number of rules that must be followed
                  processing of personal data, including those through

                  camera surveillance. Within the framework of this supervisory matter deals
                  The Data Inspectorate does not have all the rules and issues that can

                  updated in such a personal data processing as the current one
                  the surveillance entails. The examination is limited to the question of whether the company has

                  supported the treatment in any of the legal bases set out in
                  Article 6 of the Data Protection Regulation. The Data Inspectorate thus does not take

                  position on whether the company has followed or not followed any others
                  the provisions of the Data Protection Regulation in the context of this case, such as

                  for example, the provisions on the rights of data subjects under the Articles
                  12-22 Data Protection Ordinance. Supervision does not cover either
                  the provisions of the Camera Surveillance Act (2018: 1200), for example if

                  duty of permission, duty of disclosure or duty of confidentiality. Data Inspectorate DI-2020-4534 5 (12)







                    The Data Inspectorate's assessment


                    Article 6 (1) (f) - balancing of interests

                    The company has stated that the current monitoring is supported by Article 6 (1) f)
                    the Data Protection Regulation. There are three conditions that must be met
                                                        2
                    fulfilled for that to be the case. The first condition is that they
                    interests that the guardian intends to protect must be justified

                    interests. The second condition is that the surveillance is necessary to
                    protect the current interest or interests. The third condition is

                    that the data subject's fundamental freedoms and rights do not outweigh
                    the legitimate interest that the surveillance intends to protect. These props should

                    therefore be tried separately in the context of this case.


                    Is the company's security interest justified?

                    The first part of the assessment concerns the nature of the interests
                    the surveillance should protect. Not all conceivable interests could

                    achieved or protected by camera surveillance may be considered justified.
                    A legitimate interest is an interest that, in general, is enjoyed

                    protection of the legal system or is otherwise considered legitimate, ethical or
                    defensible. An interest protected by EU law or relevant national

                    right must, for example, be regarded as justified. The Data Inspectorate must therefore
                    take a position on whether the company's security interest can be considered

                    justified in this case.


                    The purpose of the surveillance in this case has been to come to fruition

                    with the disturbances that have occurred in the property during a longer
                    time. The disturbances have largely consisted of potentially criminal ones

                    attacks on residents' freedom, peace, health or property. The interest of that
                    prevent, prevent or detect crime is normally considered to be one
                                                                                                3
                    legitimate interest. The European Court of Justice has further ruled in case C-708/18 that a
                    tenant-owner association has a legitimate interest according to the elderly

                    data protection legislation to protect tenants' property, health
                    and life. There is no reason to assume that the entry into force of

                    The Data Protection Regulation has led to a change in the legal situation in that area.

                    It may further be assumed that a landlord has the same interest in relation to
                    their tenants that a tenant-owner association has in relation to theirs



                    Judgment of the European Court of Justice in Case C-13/16 Riga's Satikism paragraph 28.
                    Judgment of the European Court of Justice in Case C-708/18 TK paragraph 42. Data Inspectorate DI-2020-4534 6 (12)







                   members. The Data Inspectorate therefore assesses that the company's interest in

                   conducting on-site surveillance has been a legitimate interest.


                   Is surveillance necessary to safeguard the interest in surveillance?

                   Furthermore, surveillance must be necessary to protect the mentioned interests.
                   In this assessment, the Data Inspectorate must check that it is justified

                   the interest that has emerged in the case cannot reasonably be protected on an equal footing
                   effectively by other means which to a lesser extent interfere with the

                   fundamental freedoms and rights were registered, in particular the right to protection

                   for privacy and the right to the protection of personal data under Articles 7 and
                   8 of the EU Charter of Fundamental Rights. The condition that the processing of personal data must

                   be necessary shall be further tested together with the principle of
                   data minimization, as set out in Article 5 (1) (c) of the Data Protection Regulation. 4



                   It appears from the investigation in the case that the company has taken alternative and
                   less privacy-sensitive measures for camera surveillance before the camera

                   assembled. However, these measures have not had the intended effect. Then the camera
                   installed, the disturbances in the stairwell ceased in principle completely and

                   the direction. This suggests that the surveillance was necessary to protect the company
                   and the legitimate interests of tenants.



                   It must also be taken into account in the examination of whether the monitoring was necessary or
                   not if the camera has been used in a way that limits its intrusion

                   the privacy that surveillance entails without compromising that matter
                   would jeopardize the effectiveness of surveillance. In the present case,

                   the invasion of privacy is limited by the measures that the company has taken

                   applies to access to the recorded material. The company has also chosen to operate
                   surveillance only with a camera and at the place where it was judged that

                   the surveillance had the potential to give the greatest effect, which is compatible with
                   the principle of data minimization. At the same time, it could have been minimized

                   further data collection by masking parts of the camera

                   catchment area, especially the apartment doors that are clearly visible in the picture. MAN
                   had also for the same reason been able to consider mounting the camera so that

                   you filmed from a different angle or in some other way adjust the camera
                   catchment area. This would have made it possible to avoid filming in



                   3
                     Charter of Fundamental Rights of the European Union (2010 / C 83/02).
                   4 C-708/18 TC points 47-48.
                   5 C-708/18 TK, item 50.Datainspektionen DI-2020-4534 7 (12)







                   the dwellings on the ground floor, which has most likely happened below

                   the time the camera was in operation.


                   Taking into account the alternative measures that the company has taken before
                   the camera was mounted without effect, the Data Inspectorate assesses, however

                   overall that the monitoring was necessary to take advantage of the company's and
                   the legitimate interests of the residents.


                   Do the interests of the data subjects outweigh the interests of the security guards?

                   Initially, it can be stated that camera surveillance by definition
                   entails a restriction of the right to protection of personal data, which

                   guaranteed by Article 8 of the Statute of Rights. Because the coverage in this

                   the case has been conducted in close proximity to individuals' private homes, it has
                   also entailed a restriction of the right to respect for private and

                   family life and own housing guaranteed by Article 7 of the
                   the Charter of Rights. Because the surveillance has taken place on the property's first

                   floor level, all residents in the house have been subject to surveillance on the way to
                   and from his home throughout the period the camera was on. This applies

                   especially for the complainant and the accommodation in the apartment next to the complainant, because
                   their apartment doors are so clearly included in the camera's recording area.


                   It should also be taken into account that case law regarding the monitoring of common

                   spaces in apartment buildings have been restrictive. It has been described, for example

                   that security of entrances to apartment buildings - where the interest in privacy can
                   assumed to be slightly lower than in the present case - can be accepted only in pure
                                   6
                   exceptional cases. The European Data Protection Board (EDPB) has further stated that
                   the data subject should not reasonably expect to be subject to surveillance
                                                                 7
                   on private land or in living environments. These circumstances mean that
                   the interest in privacy at the site as a starting point weighs very heavily.


                   However, the interest in privacy is weakened somewhat by the fact that security

                   partly aimed at protecting the persons who have been the subject of surveillance

                   and by the fact that staff at the company did not have direct access to
                   the recorded material. In this context, the Data Inspectorate would like to remind

                   that it arrives at it during all personal data processing
                   personal data controller to implement routines that involve access



                   6 See the Data Inspectorate's decision of 21 June 2011 in case no. 1745-2010.
                   7 EDPB Guidelines 3/2019 on processing of personal data through video devices, p. 13Datainspektionen DI-2020-4534 8 (12)






                   to personal data only takes place when there are reasons for it. That the company in

                   the present case has had such a routine in place therefore does not affect
                   the interest in integrity in either a strengthening or weakening direction. By a

                   overall assessment, the Data Inspectorate considers that the integrity interest in
                   the place weighs very heavily.


                   With regard to the interest in surveillance, the Data Inspectorate finds no reason to

                   make any other assessment of the circumstances to be weighed than what
                   the company has done. In light of these, the Data Inspectorate assesses that

                   the interest in surveillance at the site weighs relatively heavily.


                   The company has thus had a significant security interest, but with consideration
                   to the very weighty interest in privacy, the Data Inspectorate assesses
                   that the interest in privacy outweighs. The Data Inspectorate therefore finds that

                   Uppsalahem AB has violated Article 6 of the Data Protection Ordinance by:
                   one has conducted camera surveillance to protect an interest that does not weigh

                   more important than the interests of the data subjects and fundamental freedoms and
                   rights on the spot.




                   Choice of intervention

                   Article 58 of the Data Protection Regulation lists all the powers that:
                   The Data Inspectorate has. According to Article 58 (2), the Data Inspectorate has a number
                   corrective powers, including warnings, reprimands or

                   limitations of treatment.


                   According to Article 58 (2) (i) of the Data Protection Regulation,
                   the supervisory authority shall impose administrative penalty fees in accordance with

                   with Article 83. Pursuant to Article 83 (2), administrative penalty fees,
                   depending on the circumstances of the individual case, is applied in addition to or in

                   instead of the measures referred to in Article 58 (2) (a) to (h) and (j)
                   Article 83 (2) (n) the factors to be taken into account in administrative decisions

                   penalty fees in general shall be imposed and in determining
                   the size of the fee.


                   Instead of penalty fees, in certain cases according to recital 148 to

                   data protection regulation a reprimand is issued instead of penalty fees
                   if it is a matter of a minor infringement. In the assessment, the Data Inspectorate DI-2020-4534 9 (12)






                   circumstances such as the nature, severity and

                   duration.


                   Penalty fee
                   The Data Inspectorate has above assessed that the company through its camera surveillance

                   of a floor in an apartment building, including apartment doors and parts of
                   housing, has violated Article 6 (1) (f) of the Data Protection Regulation.


                   In view of the processing of personal data by this supervision

                   includes has involved illegal camera surveillance concerning private individuals in its
                   home environment, it is not a question of a minor violation. The Data Inspectorate wants

                   in this context emphasize that the surveillance of residents' apartment doors and
                   parts of their homes have formed a particularly sensitive part of privacy
                   surveillance and that there is no reason to compensate for this

                   the penalty fee with a reprimand.


                   As the surveillance has ceased, it is not relevant to ban it in the future
                   the surveillance. For the same reason, it is also not relevant to impose

                   the company to limit the processing in a way that would make it legal.
                   There is thus no other corrective measure than penalty fees

                   current for the treatment that has taken place. The company must therefore be imposed on one
                   administrative penalty fee.


                   Determination of penalty fee

                   According to Article 83 (1) of the Data Protection Regulation, each supervisory authority shall:
                   ensure that the imposition of administrative penalty fees in each individual

                   cases are effective, proportionate and dissuasive. The administrative
                   the penalty fee may not, in accordance with Article 83 (3), exceed its amount

                   most serious violation if it is a question of one or the same
                   data processing or interconnected data processing.


                   Article 83 (2) of the Data Protection Regulation sets out all the factors that must:
                   taken into account when determining the size of the penalty fee. In the assessment

                   the size of the penalty fee shall take into account, inter alia, Article 83 (2)
                   a (nature, severity and duration of the infringement), b (intent or

                   negligence), g (categories of personal data), h (how the infringement came about
                   The Data Inspectorate's knowledge) and k (other aggravating or mitigating

                   factor such as direct or indirect financial gain)
                   Data Protection Ordinance.Data Inspectorate DI-2020-4534 1 0 (12)








                  Pursuant to Article 83 (5) (a) of the Data Protection Regulation, in the event of infringements of the
                  basic principles of treatment, including the conditions for consent,

                  according to articles 5, 6, 7 and 9, administrative penalty fees are imposed on up
                  to EUR 20 000 000 (twenty million) or, in the case of companies, up to 4

                  % of total global annual turnover for the previous financial year,
                  depending on which value is highest. According to the company's annual report for

                  In 2019, the company had sales of approximately 1,450,000,000 (one billion four hundred and fifty
                  million) during that financial year. 4% of that amount is 58,000,000

                  (fifty-eight million) kronor. Because this amount is less than 20,000,000
                  EUR, the penalty fee shall be set at an amount between 0 and

                  EUR 20 000 000.

                  The penalty fees must in each individual case be effective, proportionate

                  and deterrent. In the Data Inspectorate's assessment of the infringement
                  character, the following factors have been taken into account in an aggravating direction.


                       The violation has come to the Data Inspectorate's knowledge through

                          a complaint from an individual affected by the infringement.
                       Camera surveillance has taken place by tenants in their home environment, who

                          is dependent on the company.


                  The following factors have been considered in a mitigating direction.


                       The interest that the surveillance has been intended to protect has
                          assessed as a legitimate interest and the surveillance has been

                          necessary to safeguard this interest.
                       The violation has been committed through negligence rather than intentionally.

                       The infringement has been going on for a short time.


                  Overall, the Data Inspectorate finds that an efficient, proportionate and
                  deterrent penalty fee for the infringement found is 300,000

                  (three hundred thousand) kronor.


                  Uppsalahem AB must therefore pay an administrative penalty fee of 300
                  000 kronor.Datainspektionen DI-2020-4534 1 1 (12)







                  This decision was made by Director General Lena Lindgren Schelin after
                  presentation by Gustav Linder. At the final processing has also

                  unit manager Charlotte Waller Dahlberg participated.


                  Lena Lindgren Schelin, 2020-12-14 (This is an electronic signature)




                  Appendix
                  Appendix - How to pay a penalty fee



                  Copy for knowledge of:
                  Uppsala kommunDatainspektionen DI-2020-4534 1 2 (12)







                  How to appeal

                  If you want to appeal the decision, you must write to the Data Inspectorate. Enter i
                  the letter which decision you are appealing and the change you are requesting.

                  The appeal must have been received by the Data Inspectorate no later than three weeks from
                  the day you received the decision. If the appeal has been received in due time

                  the Data Inspectorate forwards it to the Administrative Court in Stockholm
                  examination.


                  You can e-mail the appeal to the Data Inspectorate if it does not contain

                  any privacy-sensitive personal data or data that may be covered by
                  secrecy. The authority's contact information can be found on the first page of the decision.