Datatilsynet (Denmark) - 2023-31-0053
From GDPRhub
| Datatilsynet - 2023-31-0053 | |
|---|---|
 | |
| Authority: | Datatilsynet (Denmark) |
| Jurisdiction: | Denmark |
| Relevant Law: | Article 15 GDPR Article 22 databeskyttelseslovens |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 24.06.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | Clemens Bar ApS |
| National Case Number/Name: | 2023-31-0053 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Danish |
| Original Source: | datatilsynet.dk (in DA) |
| Initial Contributor: | wp |
The DPA found that the CCTV installed for the purpose of crime prevention didn’t automatically exempted a data subject from having access to their data.
English Summary
Facts
A data subject filed an access request under Article 15 GDPR with Clemens Bar ApS (a controller). The data subject wished to access CCTV footage.
The controller refused the request, claiming the CCTV was installed in response to an order from the Licensing Board (Bevillingsnævnet). The Licensing Board is a body responsible for granting alcohol license to bars.
As explained by the controller, the CCTV served the purpose of crime prevention and the recordings were used by Police to criminal activity. The access to the CCTV footage would then disclose the location of CCTV and jeopardise its purpose. Thus, the controller called upon Article 22(2)(3)(4) of Data protection act, allowing for restricting access request, in particular, when the data subject interest was overridden by public interest, namely public security and crime prevention.
The data subject filed a complaint with the Danish DPA (Datatilsynet).
After receiving the complaint, forwarded by the DPA, the controller again refused to provide access to the data. Hence, the data subject filed another complaint against the controller.
During the proceedings, the controller sustained their reasoning. Additionally, the controller also mentioned that the answer to access request was not technically feasible, since the controller was unable to anonymise the image of other data subjects (blurring), without blurring the image of the data subject too. Afterwards, the controller stated a human error caused deletion of the data.
The data subject claimed the access request was related to potential violation of Article 244 of the Criminal Code.
Holding
The DPA upheld the complaint.
The DPA expressed “serious criticism” over deletion of data subject’s data. Once the controller deleted the data, the data subject lost possibility to lodge an effective complaint against the controller. Such a conduct amounted to violation of Article 5(1)(a) GDPR.
Moreover, the DPA explained that Article 22 of Data protection act, called upon by the data controller, didn’t apply to access request refusal. In particular, the controller didn’t consult the Policy whether the data disclosure would impede the CCTV purpose.
Furthermore, for the DPA, the fact that a CCTV footage contained the data of other data subjects shouldn’t automatically lead to refusing access to data. The footage could have been processed in such a way it contained less data, for example by splitting the footage in smaller pieces.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.
Skip the main navigation
Search
Night club receives serious criticism: Lack of insight into and deletion of television surveillance recordings
Date: 24-06-2024
Decision Private companies Serious criticism Complaint TV surveillance The right to access Basic principles
The Danish Data Protection Authority has made a decision in a case where a citizen complained that a nightclub refused to give him insight into television surveillance recordings. The Danish Data Protection Authority has expressed serious criticism of the nightclub, which deleted the recordings in question in close connection with the fact that the citizen's request for access had been refused.
Journal number: 2023-31-0053.
Summary
The Danish Data Protection Authority has made a decision in a case where a citizen complained that Clemens Bar ApS had refused to give him insight into television surveillance footage from the nightclub where he appeared.
The television surveillance at the nightclub was implemented to support the police's investigation and processing of criminal cases and to create security for Clemens Bar's guests in general.
Clemens Bar had refused to grant the access request on the grounds that access to the television surveillance footage could compromise the security of the nightclub and reduce the crime-fighting effect which is the purpose of the television surveillance, as the location of the cameras and blind spots could be revealed. Clemens Bar therefore only provides surveillance material at the request of the police in connection with the police's investigation of any criminal cases.
Clemens Bar also pointed out that it would not be possible to blur the other people on the recordings without also blurring complaints due to the large number of people who appeared on the recordings.
Clemens Bar had saved the television surveillance recordings in question as a result of the complaint to the Data Protection Authority, but due to a human error the nightclub had deleted the recordings before the authority had (completely) processed the case.
The Norwegian Data Protection Authority expresses serious criticism
The Danish Data Protection Authority found that Clemens Bar could not refuse to give the complainant insight with reference to the consideration of public interests.
The Danish Data Protection Authority laid, among other things, emphasis on the fact that it was only Clemens Bar who had made this assessment on his own initiative, and that this assessment was thus not supported by a statement from the police or the like.
However, the Danish Data Protection Authority found that there was insufficient basis for overriding Clemens Bar's assessment that the complainant's request for access to the television surveillance recordings in question could be rejected, as handing over the recordings could infringe the rights and freedoms of others.
In this connection, the Danish Data Protection Authority emphasized that it is a nightclub environment and that, according to the information provided, approx. 150 people from the recordings. The Norwegian Data Protection Authority also found that the recordings in question had been deleted, which meant that this issue could no longer be verified.
The Danish Data Protection Authority therefore found that there was a basis for expressing serious criticism that Clemens Bar - by having deleted the television surveillance recordings in question - had not handled the complainant's request in accordance with the basic principle of legality, fairness and transparency.
Decision
The Danish Data Protection Authority hereby returns to the case, where the complainant complained to the supervisory authority on 26 April 2023 that Clemens Bar ApS has not granted his request for access to television surveillance recordings. 2023
1. Decision
After a review of the case, the Danish Data Protection Authority finds that there is not a fully sufficient basis for overriding Clemens Bar's assessment that the complainant's request for access to the television surveillance recordings in question could be rejected because handing over the recordings would infringe the rights and freedoms of others, cf. Article 15 of the Data Protection Regulation[1] 4.
However, the Data Protection Authority finds that there are grounds for expressing serious criticism that Clemens Bar's handling of the complainant's request for access has not taken place in accordance with the rules in the data protection regulation, Article 5, subsection 1, letter a.
Below follows a closer review of the case and a rationale for the Data Protection Authority's decision.
2. Case presentation
On 26 April 2023, the complainant addressed the Danish Data Protection Authority with a complaint that Clemens Bar by letter of 28 March 2023 - with reference to section 22, subsection of the Data Protection Act. 2, Nos. 3 and 4 – had refused to give him insight into television surveillance footage from the nightclub. The letter states, among other things:
“…
The general right to data access, cf. GDPR's Article 15
As a rights subject, your right to data insight is seen to be based on Article 15 of the GDPR, which specifies your rights in relation to the provision of a copy of personally identifiable data about you, including a copy of video material. Clemens Bar fully recognizes your principled right of access.
In this connection, we must refer to the Data Protection Authority and their decision in journal number 2018-831-0004, where the authority, in a specific case concerning the clarification of the course of events regarding property damage, finds the duty subject responsible in relation to the delivery of video material, including mention of a duty placed with us as subject to the duty to properly obscure third-party persons who may appear on the video material.
However, since the television surveillance at Clemens Bar is not seen to have been set up on its own initiative, as can be seen in the aforementioned decision from the Data Protection Authority, but rather only as a result of an order from a public authority in relation to crime fighting, we have further investigated whether there are other interests that may override the right of access.
Exception provision to the right to access data, cf. Section 22 of the Data Processing Act
We must refer to the exception provision in Section 22 of the Data Processing Act, where this provision determines the extent to which the data controller may refrain from giving the registered person the right to access.
It can be seen in the legislative draft for this exceptional provision that in the consideration of an exception from the right of access pursuant to Article 15 of the regulation, on the one hand, the data subject's interest in getting to know the information is included, and on the other hand, it is seen that we, as the data controller, are obliged to considers which specific risks are associated with compliance with the right of access in each individual case. According to the provision, the limitation of the data subject's access to be made aware of the information mentioned in Article 15 of the regulation can only be done on the basis of a concrete weighing of the opposing interests.
Clemens Bar must state here that the purpose of the television surveillance at our nightclub is solely to prevent or solve criminal acts of any kind. There are no other purposes than crime fighting. In this connection, we can inform you that the TV surveillance rests on a legal obligation established based on considerations for the safety of the restaurant. The order for television surveillance is issued by a public authority.
It is also part of our assessment that the television surveillance is continuously handed over to the police, and that the material is used with high frequency in the courts for evidence in relation to crime-fighting purposes concerning, among other things, violence, theft, drugs and weapons.
It must therefore be argued that insight into television surveillance footage can reveal the location of cameras and any blind spots, and that there is therefore a real risk of compromising security at Clemens Bar and thus actually reducing the crime-fighting effect of the video surveillance order issued by public authority.
This appears from § 22, subsection of the Data Protection Act. 2, no. 3 and 4, i.a. that an exception to the regulation's Article 15 can be made if the data subject's interest in getting to know the information is found to give way to decisive considerations of public interest, including considerations of public safety and the prevention, investigation, detection or prosecution of criminal offenses or the execution of criminal sanctions, including protection against public safety.
In this connection, the Danish Data Protection Authority presents, respectively, in case with case number 2018-832-0009 and case with case number 2020-831-0028, concrete decisions on refusal of the right of access.
These two decisions are both seen to have a high precedential value in relation to the present request.
Decision on request for data insight
Clemens Bar has, after a concrete assessment, found that the consideration for you as registered in this specific case must give way to decisive considerations for public interests, including consideration for public safety and the prevention, investigation, detection or prosecution of criminal offenses or the enforcement of criminal sanctions , including protection against public safety.
We are therefore forced to reject your request for access to your records.
In our decision, we have emphasized that insight into the television surveillance footage will be able to reveal the location of cameras and any blind spots, which poses a risk of compromising security at Clemens Bar. It is part of our assessment that insight into television surveillance inside and outside the restaurant is suitable for compromising the safety of guests and staff, as it i.a. will reveal the location of surveillance equipment and blind spots, thus making television surveillance counterproductive and hampering its crime-fighting purpose.
We have also emphasized that you had not stated a special justification for your interest in gaining insight, for example by all or parts of the video material having to show a situation of particular importance, e.g. property damage, personal injury or property damage. You therefore only want to gain insight into your own behaviour.
On the basis of the foregoing, it must be stated that Clemens Bar considers it reasonable to refuse the request for data insight, since, on the one hand, there does not appear to be any special consideration that applies in relation to the interest in gaining insight into the video material - and on that side, we consider that your right of access in the specific case should give way to decisive considerations for safety, as this is a large nightclub, where many people will be gathered in a limited space, and where different types of crime can regularly occur , whereby i.a. guests may be exposed to significant danger.
It also follows from the order for TV surveillance, cf. grant to Clemens Bar, that the surveillance has been ordered by the Grants Board for reasons of combating criminality, and therefore, in order to fulfill the purpose of the surveillance, it has been sought as far as possible to place surveillance equipment hidden or discreetly. By giving you the desired insight into the TV surveillance, this consideration is compromised in a decisive way…”
Clemens Bar confirmed at the same time that the nightclub was still in possession of the TV surveillance footage and that the material would be stored as long as the case regarding access to it was ongoing at the Data Protection Authority.
On 7 July 2023, the Danish Data Protection Authority forwarded the complaint to Clemens Bar, so that in a letter to the complainant, the bar was given the opportunity to deal with the inquiry again, including in the light of the Danish Authority's practice.
On 13 July 2023, DAHL Advokatpartnerselskab (hereinafter 'DAHL') - on behalf of Clemens Bar - refused to give insight into the television surveillance recordings again, citing the previous justification.
On 14 July 2023, the complainant complained again to the Data Protection Authority, in which connection the authority has received two opinions from DAHL Advokatpartnerselskab.
2.1. Complainant's comments
The complainant has generally stated that he requested access to the television surveillance footage in question in order to clarify whether there had possibly been a violation of Section 244 of the Criminal Code in connection with a doorman escorting him out of the nightclub.
2.2. Clemens Bar's remarks
DAHL has submitted comments on the case on behalf of Clemens Bar.
DAHL has generally stated that Clemens Bar is not obliged to hand over the television surveillance recordings in question to complainants due to decisive considerations for public safety and the prevention, investigation, detection and prosecution of criminal offences, cf. section 22, subsection of the Data Protection Act. 2, nos. 3 and 4, as well as for the protection of the rights and freedoms of others, cf. the data protection regulation, article 15, subsection 4, and section 22, subsection of the Data Protection Act. 2, No. 9.
DAHL has stated that Clemens Bar carries out television monitoring, as Clemens Bar is ordered to do so by the Licensing Board according to the board's alcohol license for the nightclub. The TV monitoring takes place according to instructions from the police.
The purpose of television surveillance is to ensure public safety and to prevent, investigate, detect and prosecute criminal offences.
In order to fulfill the purpose of the TV surveillance, it is sought to the greatest extent possible to place the TV surveillance equipment hidden and discreet.
In this connection, DAHL has stated that insight into the surveillance material will be able to reveal the location of cameras and any blind spots, and that this will entail a real risk of compromising security at Clemens Bar and reducing the crime-fighting effect which is the purpose of the television surveillance .
The television surveillance at the nightclub has been implemented to support the police's investigation and processing of criminal cases and to create security for Clemens Bar's guests in general. When it comes to nightclubs, especially at peak times, there will be many people under the influence of alcohol gathered in a limited space for an entire evening and night, and there will be loud music and alcohol, which is why disturbances and commotion can quickly arise. It is assumed that these special circumstances for nightclubs are also the reason why Clemens Bar is required to have television surveillance in the first place. It is therefore considered that the purpose of the television surveillance is lost if insight is given into recordings from the surveillance.
In support of this, DAHL has referred to the Danish Data Protection Authority's cases regarding Metro Service (2018-832-0009) and Blue Water Arena in Esbjerg (2020-832-0028), where the Danish Data Protection Authority found that in the specific cases it was justified to reject the complainant's request for insight, as the complainant's interest in gaining insight had to give way to decisive considerations of public safety.
DAHL has further stated that Clemens Bar only provides surveillance material at the request of the police in connection with the police's investigation of any criminal cases. Clemens Bar's purpose for the television surveillance is to fulfill the mandate in the grant, while the police have a significantly greater interest in the television surveillance itself, since it is necessary for the police's investigative work. Handing over any television surveillance material to others than the police should therefore be done at the request of the police's assessment.
DAHL has also stated that from the television surveillance recordings from the period in question, which the complainant wants insight into, it appears approx. 150 people, and that it would therefore not be possible to obscure the other registered persons from the recordings without also obscuring complaints. The same applies to the delivery of still images. For that reason alone, Clemens Bar cannot provide insight into the television surveillance recordings.
Finally, DAHL has stated that Clemens Bar is no longer in possession of the television surveillance recordings in question, which is due to a regrettable human error on the part of the nightclub.
There is no backup of the surveillance material, and it is not possible to reconstruct the material.
3. Reason for the Data Protection Authority's decision
3.1
The Danish Data Protection Authority assumes that complaints emerged from the television surveillance recordings in question from Clemens Bar.
It follows from the data protection regulation article 15, subsection 3, that the data controller must provide a copy of the personal data that is processed.
The starting point is thus that the registered person must have a copy of the personal data that is processed about him. If personal data is processed as part of television surveillance, the data subject will therefore - in connection with the response to a request for access - as a starting point receive a copy of the recordings (including any audio recordings) from which the data subject appears.
However, Article 15 of the Data Protection Regulation does not apply if one of the exceptions in Section 22 of the Data Protection Act applies. Exemption from the provisions of Article 15 of the Data Protection Ordinance can thus, in accordance with the Data Protection Act § 22, subsection 2, is done if the data subject's interest in getting to know the information is found to give way to decisive considerations of public interest, including in particular to:
public safety, prevention, investigation, detection or prosecution of criminal offenses or enforcement of criminal sanctions, including protection against and prevention of threats to public safety, protection of the rights and freedoms of the data subject or others
The right to receive a copy as referred to in the Data Protection Regulation, Article 15, paragraph 3, may not infringe the rights or freedoms of others, cf. Article 15, subsection 4.
If other data subjects appear in the recordings, these must be taken into account, i.a. because the registered person who requests access only has the right to be given information about himself. If other persons appear, these must be obscured.
If the persons are placed in some of the images in such a way that the blurring/covering of another person will in practice also cover the image of the person requesting insight, it is not really possible to provide insight into the image sequences where this may be the case. It may therefore also be necessary to split the video into smaller image sequences, which can then be handed out.
3.2.
Clemens Bar has stated that the complainant does not have the right to access because his interest in getting to know the information is found to have to give way to decisive considerations of public interests, including the public interests referred to in Section 22, subsection of the Data Protection Act. 3, 4 and 9.
In this connection, Clemens Bar has stated that insight into the surveillance material will be able to reveal the location of cameras and any blind spots, and that this will entail a real risk of compromising security at Clemens Bar and reducing the crime-fighting effect which is the purpose of television the surveillance.
The Data Protection Authority does not find that Clemens Bar could, on that basis, refuse to give the complainant insight.
The Danish Data Protection Authority has emphasized that it is only Clemens Bar who has made this assessment on his own initiative, and that this assessment is thus not supported by a statement from the police or the like.
In this connection, the Data Protection Authority notes that the data controller in the case of the Blue Water Arena in Esbjerg (2020-832-0028) had, according to the information, been in dialogue with the National Police about the security implications of handing over television surveillance recordings.
The Data Protection Authority has also emphasized that this case differs from the cases about Metro Service (2018-832-0009) and Blue Water Arena in Esbjerg (2020-832-0028), in that the number of people who frequent Clemens Bar on a daily basis is considerably lower. It is thus not every security concern that can justify that an exception can be made to the right of access, as it must be a question of decisive considerations.
3.3.
Clemens Bar has also stated that it would not be possible to obscure the other registered persons from the recordings without also obscuring the complainants, because the television surveillance recordings from the period in question, which the complainant wants access to, show approx. 150 people.
After a review of the case, the Danish Data Protection Authority finds that there is not a fully sufficient basis for overriding Clemens Bar's assessment that the complainant's request for access to the television surveillance recordings in question could be rejected because handing over the recordings would infringe the rights and freedoms of others, cf. Article 15 of the Data Protection Regulation 4.
The Danish Data Protection Authority has emphasized the fact that it is a nightclub environment, and that according to the information it appeared approx. 150 people. In this connection, the Danish Data Protection Authority must also note that the recordings in question have been deleted, so that this issue can no longer be verified.
3.4.
The Danish Data Protection Authority therefore also finds that Clemens Bar – by having deleted the TV surveillance recordings in question – has not handled the complainant's request for access in accordance with the rules in the Data Protection Regulation, Article 5, subsection 1, letter a, which gives the authority reason to express serious criticism.
It thus follows from the data protection regulation's article 5, subsection 1, letter a, that personal data must be processed legally, fairly and in a transparent manner in relation to the data subject ("legality, fairness and transparency").
When a data subject has requested access to information about himself and thus activated the exercise of his rights pursuant to Article 15, and the data controller does not comply with the request, then the data controller is - in the opinion of the Danish Data Protection Authority - basically obliged to ensure that the data subject can exercise their rights according to Section 39 of the Data Protection Act and Article 79 of the Data Protection Regulation.
The data subject must therefore, as a starting point, have the opportunity to exercise his right to complain about the failure to comply with the request to the Danish Data Protection Authority, cf. Section 39 of the Data Protection Act, or bring the case before a court, cf. Article 79 of the Data Protection Regulation, with a view to giving the data controller orders to comply with the data subject's request.
It is the opinion of the Danish Data Protection Authority that it is contrary to the principle of legality, reasonableness and transparency in Article 5, subsection 1 of the Data Protection Regulation. 1, letter a, if the data controller deletes information about the data subject in close connection with the data subject's request for access being refused, as the data controller thereby unjustifiably deprives the data subject of the opportunity to verify whether the data subject has the right to access the information, at the Data Protection Authority and the courts.
It is then the Danish Data Protection Authority's assessment that, by deleting the television surveillance footage, Clemens Bar has unlawfully denied the complainant the opportunity to verify whether he had the right to gain insight into the information at the Danish Data Protection Authority or the courts, with the possibility of giving Clemens Bar an injunction to comply with the complainant's request.
[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and on the free exchange of such data and on the repeal of Directive 95/46/EC (general regulation on data protection).
The Norwegian Data Protection Authority
Carl Jacobsens Vej 35
2500 Valby
Tel. 33 19 32 00
dt@datatilsynet.dk
About us
About the Norwegian Data Protection AuthorityPresseHome pagePrivacy policyAvailability statement
Shortcuts
Guidance on GDPRCall usNewsletterThe National Whistleblower Scheme
Follow us
The Norwegian Data Protection Authority on LinkedIn
Night club receives serious criticism: Lack of insight into and deletion of television surveillance recordings
Date: 24-06-2024
Decision Private companies Serious criticism Complaint TV surveillance The right to access Basic principles
The Danish Data Protection Authority has made a decision in a case where a citizen complained that a nightclub refused to give him insight into television surveillance recordings. The Danish Data Protection Authority has expressed serious criticism of the nightclub, which deleted the recordings in question in close connection with the fact that the citizen's request for access had been refused.
Journal number: 2023-31-0053.
Summary
The Danish Data Protection Authority has made a decision in a case where a citizen complained that Clemens Bar ApS had refused to give him insight into television surveillance footage from the nightclub where he appeared.
The television surveillance at the nightclub was implemented to support the police's investigation and processing of criminal cases and to create security for Clemens Bar's guests in general.
Clemens Bar had refused to grant the access request on the grounds that access to the television surveillance footage could compromise the security of the nightclub and reduce the crime-fighting effect which is the purpose of the television surveillance, as the location of the cameras and blind spots could be revealed. Clemens Bar therefore only provides surveillance material at the request of the police in connection with the police's investigation of any criminal cases.
Clemens Bar also pointed out that it would not be possible to blur the other people on the recordings without also blurring complaints due to the large number of people who appeared on the recordings.
Clemens Bar had saved the television surveillance recordings in question as a result of the complaint to the Data Protection Authority, but due to a human error the nightclub had deleted the recordings before the authority had (completely) processed the case.
The Norwegian Data Protection Authority expresses serious criticism
The Danish Data Protection Authority found that Clemens Bar could not refuse to give the complainant insight with reference to the consideration of public interests.
The Danish Data Protection Authority laid, among other things, emphasis on the fact that it was only Clemens Bar who had made this assessment on his own initiative, and that this assessment was thus not supported by a statement from the police or the like.
However, the Danish Data Protection Authority found that there was insufficient basis for overriding Clemens Bar's assessment that the complainant's request for access to the television surveillance recordings in question could be rejected, as handing over the recordings could infringe the rights and freedoms of others.
In this connection, the Danish Data Protection Authority emphasized that it is a nightclub environment and that, according to the information provided, approx. 150 people from the recordings. The Norwegian Data Protection Authority also found that the recordings in question had been deleted, which meant that this issue could no longer be verified.
The Danish Data Protection Authority therefore found that there was a basis for expressing serious criticism that Clemens Bar - by having deleted the television surveillance recordings in question - had not handled the complainant's request in accordance with the basic principle of legality, fairness and transparency.
Decision
The Danish Data Protection Authority hereby returns to the case, where the complainant complained to the supervisory authority on 26 April 2023 that Clemens Bar ApS has not granted his request for access to television surveillance recordings. 2023
1. Decision
After a review of the case, the Danish Data Protection Authority finds that there is not a fully sufficient basis for overriding Clemens Bar's assessment that the complainant's request for access to the television surveillance recordings in question could be rejected because handing over the recordings would infringe the rights and freedoms of others, cf. Article 15 of the Data Protection Regulation[1] 4.
However, the Data Protection Authority finds that there are grounds for expressing serious criticism that Clemens Bar's handling of the complainant's request for access has not taken place in accordance with the rules in the data protection regulation, Article 5, subsection 1, letter a.
Below follows a closer review of the case and a rationale for the Data Protection Authority's decision.
2. Case presentation
On 26 April 2023, the complainant addressed the Danish Data Protection Authority with a complaint that Clemens Bar by letter of 28 March 2023 - with reference to section 22, subsection of the Data Protection Act. 2, Nos. 3 and 4 – had refused to give him insight into television surveillance footage from the nightclub. The letter states, among other things:
“…
The general right to data access, cf. GDPR's Article 15
As a rights subject, your right to data insight is seen to be based on Article 15 of the GDPR, which specifies your rights in relation to the provision of a copy of personally identifiable data about you, including a copy of video material. Clemens Bar fully recognizes your principled right of access.
In this connection, we must refer to the Data Protection Authority and their decision in journal number 2018-831-0004, where the authority, in a specific case concerning the clarification of the course of events regarding property damage, finds the duty subject responsible in relation to the delivery of video material, including mention of a duty placed with us as subject to the duty to properly obscure third-party persons who may appear on the video material.
However, since the television surveillance at Clemens Bar does not appear to have been set up on its own initiative, as can be seen in the aforementioned decision from the Data Protection Authority, but rather solely as a result of an order from a public authority in relation to crime fighting, we have further investigated whether there are other interests that may override the right of access.
Exception provision to the right to access data, cf. Section 22 of the Data Processing Act
We must refer to the exception provision in Section 22 of the Data Processing Act, where this provision determines the extent to which the data controller can refrain from giving the registered person the right of access.
It can be seen in the legislative draft for this exceptional provision that in the consideration of an exception from the right of access pursuant to Article 15 of the regulation, on the one hand, the data subject's interest in getting to know the information is included, and on the other hand, it is seen that we, as the data controller, are obliged to considers which specific risks are associated with compliance with the right of access in each individual case. According to the provision, the limitation of the data subject's access to be made aware of the information mentioned in Article 15 of the regulation can only be done on the basis of a concrete weighing of the opposing interests.
Clemens Bar must state here that the purpose of the television surveillance at our nightclub is solely to prevent or solve criminal acts of any kind. There are no other purposes than crime fighting. In this connection, we can inform you that the TV surveillance rests on a legal obligation established based on considerations for the safety of the restaurant. The order for television surveillance is issued by a public authority.
It is also part of our assessment that the television surveillance is continuously handed over to the police, and that the material is used with high frequency in the courts for evidence in relation to crime-fighting purposes concerning, among other things, violence, theft, drugs and weapons.
It must therefore be argued that insight into television surveillance footage can reveal the location of cameras and any blind spots, and that there is therefore a real risk of compromising security at Clemens Bar and thus actually reducing the crime-fighting effect of the video surveillance order issued by public authority.
This appears from § 22, subsection of the Data Protection Act. 2, no. 3 and 4, i.a. that an exception to the regulation's Article 15 can be made if the data subject's interest in getting to know the information is found to give way to decisive considerations of public interest, including considerations of public safety and the prevention, investigation, detection or prosecution of criminal offenses or the execution of criminal sanctions, including protection against public safety.
In this connection, the Danish Data Protection Authority presents, respectively, in case with case number 2018-832-0009 and case with case number 2020-831-0028, concrete decisions on refusal of the right of access.
These two decisions are both seen to have a high precedential value in relation to the present request.
Decision on request for data insight
Clemens Bar has, after a concrete assessment, found that the consideration for you as registered in this specific case must give way to decisive considerations for public interests, including consideration for public safety and the prevention, investigation, detection or prosecution of criminal offenses or the enforcement of criminal sanctions , including protection against public safety.
We are therefore forced to reject your request for access to your records.
In our decision, we have emphasized that insight into the television surveillance footage will be able to reveal the location of cameras and any blind spots, which poses a risk of compromising security at Clemens Bar. It is part of our assessment that insight into television surveillance inside and outside the restaurant is suitable for compromising the safety of guests and staff, as it i.a. will reveal the location of surveillance equipment and blind spots, thus making television surveillance counterproductive and hampering its crime-fighting purpose.
We have also emphasized that you had not stated a special justification for your interest in gaining insight, for example by all or parts of the video material having to show a situation of particular importance, e.g. property damage, personal injury or property damage. You therefore only want to gain insight into your own behaviour.
On the basis of the foregoing, it must be stated that Clemens Bar considers it reasonable to refuse the request for data insight, since, on the one hand, there does not appear to be any special consideration that applies in relation to the interest in gaining insight into the video material - and on that side, we consider that your right of access in the specific case should give way to decisive considerations for security, as this is a large nightclub, where many people will be gathered in a limited space, and where different types of crime can regularly occur , whereby i.a. guests may be exposed to significant danger.
It also follows from the order for TV surveillance, cf. grant to Clemens Bar, that the surveillance has been ordered by the Grants Board for reasons of combating criminality, and therefore, in order to fulfill the purpose of the surveillance, it has been sought to the greatest extent possible to place surveillance equipment hidden or discreetly. By giving you the desired insight into the TV surveillance, this consideration is compromised in a decisive way…”
Clemens Bar confirmed at the same time that the nightclub was still in possession of the TV surveillance footage and that the material would be stored as long as the case regarding access to it was ongoing at the Data Protection Authority.
On 7 July 2023, the Danish Data Protection Authority forwarded the complaint to Clemens Bar, so that in a letter to the complainant, the bar was given the opportunity to deal with the inquiry again, including in the light of the Danish Authority's practice.
On 13 July 2023, DAHL Advokatpartnerselskab (hereinafter 'DAHL') - on behalf of Clemens Bar - refused to give insight into the television surveillance footage again, citing the previous justification.
On 14 July 2023, the complainant complained again to the Data Protection Authority, in which connection the authority has received two opinions from DAHL Advokatpartnerselskab.
2.1. Complainant's comments
The complainant has generally stated that he requested access to the television surveillance footage in question in order to clarify whether there had possibly been a violation of Section 244 of the Criminal Code in connection with a doorman escorting him out of the nightclub.
2.2. Clemens Bar's remarks
DAHL has submitted comments on the case on behalf of Clemens Bar.
DAHL has generally stated that Clemens Bar is not obliged to hand over the television surveillance recordings in question to complainants due to decisive considerations for public safety and the prevention, investigation, detection and prosecution of criminal offences, cf. section 22, subsection of the Data Protection Act. 2, nos. 3 and 4, as well as for the protection of the rights and freedoms of others, cf. the data protection regulation, article 15, subsection 4, and section 22, subsection of the Data Protection Act. 2, No. 9.
DAHL has stated that Clemens Bar carries out television surveillance, as Clemens Bar is ordered to do so by the Licensing Board according to the board's alcohol license for the nightclub. The TV monitoring takes place according to instructions from the police.
The purpose of television surveillance is to ensure public safety and to prevent, investigate, detect and prosecute criminal offences.
In order to fulfill the purpose of the TV surveillance, it is sought to the greatest extent possible to place the TV surveillance equipment hidden and discreet.
In this connection, DAHL has stated that insight into the surveillance material will be able to reveal the location of cameras and any blind spots, and that this will entail a real risk of compromising security at Clemens Bar and reducing the crime-fighting effect which is the purpose of the television surveillance .
The television surveillance at the nightclub has been implemented to support the police's investigation and processing of criminal cases and to create security for Clemens Bar's guests in general. When it comes to nightclubs, especially at peak times, there will be many people under the influence of alcohol gathered in a limited space for an entire evening and night, and there will be loud music and alcohol, which is why disturbances and commotion can quickly arise. It is assumed that these special circumstances for nightclubs are also the reason why Clemens Bar is required to have television surveillance in the first place. It is therefore considered that the purpose of the television surveillance is lost if insight is given into recordings from the surveillance.
In support of this, DAHL has referred to the Danish Data Protection Authority's cases concerning Metro Service (2018-832-0009) and Blue Water Arena in Esbjerg (2020-832-0028), where the Danish Data Protection Authority found that in the specific cases it was justified to reject the complainant's request for insight, as the complainant's interest in gaining insight had to give way to decisive considerations of public safety.
DAHL has further stated that Clemens Bar only provides surveillance material at the request of the police in connection with the police's investigation of any criminal cases. Clemens Bar's purpose for the television surveillance is to fulfill the mandate in the grant, while the police have a significantly greater interest in the television surveillance itself, since it is necessary for the police's investigative work. Handing over any television surveillance material to others than the police should therefore be done at the request of the police's assessment.
DAHL has also stated that from the television surveillance recordings from the period in question, which the complainant wants insight into, it appears approx. 150 people, and that it would therefore not be possible to obscure the other registered persons from the recordings without also obscuring complaints. The same applies to the delivery of still images. For that reason alone, Clemens Bar cannot provide insight into the television surveillance recordings.
Finally, DAHL has stated that Clemens Bar is no longer in possession of the television surveillance recordings in question, which is due to a regrettable human error on the part of the nightclub.
There is no backup of the surveillance material, and it is not possible to reconstruct the material.
3. Reason for the Data Protection Authority's decision
3.1
The Danish Data Protection Authority assumes that complaints emerged from the television surveillance recordings in question from Clemens Bar.
It follows from the data protection regulation article 15, subsection 3, that the data controller must provide a copy of the personal data that is processed.
The starting point is thus that the registered person must have a copy of the personal data that is processed about him. If personal data is processed as part of television surveillance, the data subject will therefore – in connection with the response to a request for access – as a starting point receive a copy of the recordings (including any audio recordings) from which the data subject appears.
However, Article 15 of the Data Protection Regulation does not apply if one of the exceptions in Section 22 of the Data Protection Act applies. Exemption from the provisions of Article 15 of the Data Protection Regulation can thus be made in accordance with Section 22, subsection of the Data Protection Act. 2, is done if the data subject's interest in getting to know the information is found to give way to decisive considerations of public interest, including in particular to:
public safety, prevention, investigation, detection or prosecution of criminal offenses or enforcement of criminal sanctions, including protection against and prevention of threats to public safety, protection of the rights and freedoms of the data subject or others
The right to receive a copy as referred to in the Data Protection Regulation, Article 15, paragraph 3, may not infringe the rights or freedoms of others, cf. Article 15, subsection 4.
If other data subjects appear in the recordings, these must be taken into account, i.a. because the registered person who requests access only has the right to be given information about himself. If other persons appear, these must be obscured.
If the persons are placed in some of the images in such a way that the blurring/covering of another person will in practice also cover the image of the person requesting insight, it is not really possible to provide insight into the image sequences where this may be the case. It may therefore also be necessary to split the video into smaller image sequences, which can then be delivered.
3.2.
Clemens Bar has stated that the complainant does not have the right to access because his interest in getting to know the information should give way to decisive considerations of public interests, including the public interests referred to in Section 22, subsection of the Data Protection Act. 3, 4 and 9.
In this connection, Clemens Bar has stated that insight into the surveillance material will be able to reveal the location of cameras and any blind spots, and that this will entail a real risk of compromising security at Clemens Bar and reducing the crime-fighting effect, which is the purpose of television the surveillance.
The Data Protection Authority does not find that Clemens Bar could, on that basis, refuse to give the complainant insight.
The Danish Data Protection Authority has emphasized that it is only Clemens Bar who has made this assessment on his own initiative, and that this assessment is thus not supported by a statement from the police or the like.
In this connection, the Data Protection Authority notes that the data controller in the case of the Blue Water Arena in Esbjerg (2020-832-0028) had, according to the information, been in dialogue with the National Police about the security implications of handing over television surveillance footage.
The Data Protection Authority has also emphasized that this case differs from the cases about Metro Service (2018-832-0009) and Blue Water Arena in Esbjerg (2020-832-0028), in that the number of people who frequent Clemens Bar on a daily basis is considerably lower. It is thus not every security concern that can justify that an exception can be made to the right of access, as it must be a question of decisive considerations.
3.3.
Clemens Bar has also stated that it would not be possible to obscure the other registered persons from the recordings without also obscuring the complainants, because the television surveillance recordings from the period in question, which the complainant wants access to, show approx. 150 people.
After a review of the case, the Danish Data Protection Authority finds that there is not a fully sufficient basis for overriding Clemens Bar's assessment that the complainant's request for access to the television surveillance recordings in question could be rejected because handing over the recordings would infringe the rights and freedoms of others, cf. Article 15 of the Data Protection Regulation 4.
The Danish Data Protection Authority has emphasized the fact that it is a nightclub environment, and that according to the information it appeared approx. 150 people. In this connection, the Danish Data Protection Authority must also note that the recordings in question have been deleted, so that this issue can no longer be verified.
3.4.
The Danish Data Protection Authority therefore also finds that Clemens Bar – by having deleted the TV surveillance recordings in question – has not handled the complainant's request for access in accordance with the rules in the data protection regulation, article 5, subsection 1, letter a, which gives the authority reason to express serious criticism.
It thus follows from the data protection regulation's article 5, subsection 1, letter a, that personal data must be processed legally, fairly and in a transparent manner in relation to the data subject ("legality, fairness and transparency").
When a data subject has requested access to information about himself and thus activated the exercise of his rights according to Article 15, and the data controller does not comply with the request, then the data controller is - in the opinion of the Danish Data Protection Authority - basically obliged to ensure that the data subject can exercise their rights according to Section 39 of the Data Protection Act and Article 79 of the Data Protection Regulation.
The data subject must therefore, as a starting point, have the opportunity to exercise his right to complain about the failure to comply with the request to the Danish Data Protection Authority, cf. Section 39 of the Data Protection Act, or bring the case before a court, cf. Article 79 of the Data Protection Regulation, with a view to giving the data controller orders to comply with the data subject's request.
It is the opinion of the Danish Data Protection Authority that it is contrary to the principle of legality, reasonableness and transparency in Article 5, subsection 1 of the Data Protection Regulation. 1, letter a, if the data controller deletes information about the data subject in close connection with the data subject's request for access being refused, as the data controller thereby unjustifiably deprives the data subject of the opportunity to verify whether the data subject has the right to access the information, at the Data Protection Authority and the courts.
It is then the Danish Data Protection Authority's assessment that, by deleting the television surveillance footage, Clemens Bar has unlawfully denied the complainant the opportunity to verify whether he had the right to gain insight into the information at the Danish Data Protection Authority or the courts, with the possibility of giving Clemens Bar an injunction to comply with the complainant's request.
[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and on the free exchange of such data and on the repeal of Directive 95/46/EC (general regulation on data protection).
