KR - Mål nr 1552-22
| KamR Stockholm - Mål nr 1552-22 | |
|---|---|
 | |
| Court: | KamR Stockholm (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 5 GDPR Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6(1)(f) GDPR Article 13 GDPR Article 14 GDPR |
| Decided: | 26.01.2023 |
| Published: | 26.01.2023 |
| Parties: | Storstockholms Lokaltrafik (SL) Integritetsmyndigheten (IMY) |
| National Case Number/Name: | Mål nr 1552-22 |
| European Case Law Identifier: | |
| Appeal from: | Förvaltningsrätten i stockholm (Sweden) Mål nr 21905-21 |
| Appeal to: | Unknown |
| Original Language(s): | Swedish |
| Original Source: | Kammarrätten (in Swedish) |
| Initial Contributor: | Pantalaimon1337 |
The wording of Article 13 suggests that some kind of deliberate action by the data subject to be regarded as having been collected from him. This cannot be the case when personal data are collected by means of the body-worn cameras in question.
English Summary
Facts
The Swedish Privacy Authority (IMY) decided on 21 June 2021 that AB Storstockholms Lokaltrafik (SL) would pay an administrative fine of SEK 16 million under the General Data Protection Regulation of which - SEK 4 000 000 relates to SL's use of body-worn cameras to preventing and documenting threats and violence, through the use of pre-recording technology for one minute, - SEK 8 000 000 relates to SL's use of body-worn cameras to ensure the identity of passengers liable to pay a surcharge, and - SEK 4 000 000 relates to SL's failure to provide information to data subjects.
SL first intended to use the body-worn cameras on 4-10 ticket inspectors in the metro during a test period starting from December 2018. Test period was extended and later introduced permanently. The body-worn cameras are used since they became permanent by about 55 ticket inspectors on weekdays and 20 ticket inspectors on public holidays across the network. The technology works as follows a camera and microphone continuously record images and sound. The cameras have a circular memory that allows any video footage older than one minute to be is automatically cleared unless the ticket inspector activates a recording. Then the footage from one minute back from when the recording was activated (so-called automatic pre-recording). The ticket inspector has been instructed to activate recording when the to issue a surcharge or when threatening or violent situations arise. The footage from the camera is uploaded after the shift to a server where it reviewed by a few evidence administrators.
The case was appealed to Stockholms förvaltningsrätt, where they dismissed the administrative fine regarding against SL's use of body-worn cameras to preventing and documenting threats and violence, through the use of pre-recording technology for one minute, Förvaltningsrätten considers that the evidence supports that SL's use of body cameras with a one-minute pre-recording is both necessary and proportionate to document and prevent threats and violence.
Though, the use of body cameras to ensure the identity of the passengers were not proportional. In an overall assessment Förvaltningsrätten therefore considers that SL's use of body-worn cameras for to ensure the identity of the person liable to pay a surcharge was not compatible with the General Data Protection Regulation. The Administrative Court agrees with IMY's assessment that SL violated Article 6(1)(f), 5(1)(a) and 5(1)(c) of the GDPR .
Additionally, Förvaltningsrätten agreed with IMY in its decision for SL's failure to provide information to data subjects. Förvaltningsrätten relies heavily on the previously published guidance from EDPB in its Guidelines 3/2019 on how data subjects should be informed about video-surveillance. The guidelines state, inter alia, that a gradual or combination of methods may be used in light of the amount of information to be provided. For video-surveillance, the most important information should then be displayed on the warning sign itself (first level), while additional mandatory information can be provided by other means (second level), such as a complete information sheet or a digital source referred to by the warning sign.
Conversely, the case was appealed to Kammarrätten, which had a different interpretation of article 13
Holding
Kammarrätten first took at textual approach to article 12-14 GDPR. Article 13 states that if personal data relating to a data subject is collected from the data subject, the controller shall, when the personal data are obtained, provide certain information to the data subject, while Article 14 specifies the information that shall be provided if the personal data have not been obtained from the data subject.
The first question Kammarrätten must consider is whether the collection of personal data by means of a body-worn camera is to be regarded as the data is collected from the data subject.
Kammarrätten notes two different sources: 1) The Article 29 Working Party, now the European Data Protection Board, has in its guidelines on transparency under the GDPR adopted on 29 November 2017, stated that personal data to be considered as obtained from data subjects includes data obtained through observation by means of cameras, for example (p. 26) and that Article 13 is thus applicable.
2) The Court noted that the European Court of Justice in a judgment of 11 December 2014 concerning camera surveillance carried out by a private individual (C-212/13, EU:C:2014:2428) indicated as applicable law, inter alia, the provision that now found in Article 14 of the General Data Protection Regulation. The case concerned a fixed camera filming, inter alia, a public road.
The Case-law from the EU indicated that it's in fact article 14 GDPR which is the appropriate article to consider in this scenario. The wording of Article 13 - "collected from the data subject" - suggests that that some kind of deliberate action by the data subject for the personal data to be regarded as having been collected from him. This cannot be considered to be the case when personal data are collected by means of the body-worn cameras in question. Kammarrätten therefore considered that the wording of the provision, taken together with the ruling of the European Court of Justice, suggests that Article 13 is not applicable.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
CLAIMS, M.M. The Swedish Privacy Agency (IMY) demands that the administrative the penalty fee of SEK 16 million must be determined. IMY believes that AB Greater Stockholm's Lokaltrafik (SL) appeal must be rejected. SL primarily requests that no administrative penalty fee be imposed. IN secondly, it is requested that the decided penalty fee be set at one significantly lower amount. WHAT THE PARTIES PROVIDE IMY IMY brings forward i.a. following. There is no legal basis for SL's camera surveillance using pre-recording technology for that long as one minute in the context of threatening or violent situations. The It is not clear from the documentation submitted by SL that a one-minute pre-recording is necessary and proportionate to achieve the purpose. As a comparison it appears from the Police Authority's guidelines for camera use that the police body cameras use 30 seconds of pre-recording of image but not sound. Even if the activities differ, it cannot be considered necessary and proportionately for SL to use a longer pre-recording time than the police. The use of the pre-recording technique means that material is recorded continuously while the ticket inspectors move throughout SL's geographical area area and in all types of traffic. That a ticket inspector has a so-called badge on the arm, it is not certain that you as a traveler will pay attention. The Court of Appeal in Stockholm has in a judgment addressed the burden of proof but has not touched on the question of the importance of the principle of responsibility for the placement of the burden of proof. The starting point should be that the burden of proof lies with IMY when it applies the question of whether there are conditions for imposing a penalty fee. When it THE COURT OF CHAMBER IN STOCKHOLM VERDICT Page 3 Department 01 Case No. 1552-22 applies to questions about whether a personal data controller complies with the requirements regarding personal data, however, the principle of liability must be taken into account. The personal data controller has an obligation to show that i.a. the principles of legality and data minimization in Article 5 of the EU Data Protection Regulation, 2016/679, (data protection regulation) is followed. SL has not been able to show that these principles are adhered to. That violations of the current provisions of the regulation may entail penalty fees are clearly stated in the regulation. The circumstance that SL began and also expanded its use of body-worn cameras during the course of the inspection is important for the assessment of the sanction fee, which also expressed by the administrative court. The Administrative Court has also made one correct assessment of the issue of processing time. SL SL brings forward i.a. following. There is a lack of relevant practice, guidelines and recommendations that speak for IMY's assessment. It is indisputable that the processing of personal data when recording is activated during an ongoing threatening or violent situation is necessary and proportionate. The reality and conditions for ticket inspectors is that they know threatening or violent incidents must first prioritize putting themselves in safety. Activation of the body camera may therefore be de-prioritised and the recording may thus be delayed. The use of body-worn camera to ensure identity of travelers who have to pay a surcharge is not disproportionate from the outside circumstances. The intrusion into personal integrity that it entails must be considered limited based on travelers' awareness of surveillance within public transport and the technical and organizational security measures that apply. THE COURT OF CHAMBER IN STOCKHOLM JUDGMENT Page 4 Department 01 Case No. 1552-22 After the pilot project and during the course of the supervisory case has the ticket controllers with which a first information layer has been equipped a badge that informs that camera surveillance is taking place. Information is provided in addition, partly on the website, partly on the receipt when the surcharge is issued. The possible violation means that all relevant information does not left in the right place or in the right order must take into account the circumstances are considered limited. The principle of liability in the Data Protection Regulation is not one rule of evidence. The burden of proof, as well as the responsibility for investigation, rests with interventions against an individual as the main rule on the decision-making authority. The general principle of legal certainty under EU law stipulates that all regulations, especially those prescribing sanctions, must be clear and precise In the absence of guiding practice, it has not been possible to assess with sufficient certainty about the use of body-worn cameras for current purposes would mean that a penalty fee would be imposed, or the amount of the penalty fee. Administrative law does not have enough extent considering IMY's long processing time in the case. REASONS FOR THE COURT OF COURT'S DECISION What the goal applies to and starting points for the trial The first question in the case is whether SL should impose a penalty fee on them grounds invoked by IMY. If the assessment is that SL should be imposed penalty fee, the next question is to test the size of the penalty fee. It must be clearly stated that there are conditions for imposing a certain one administrative sanction fee and it is IMY that has the burden of proof. THE COURT OF CHAMBER IN STOCKHOLM JUDGMENT Page 5 Department 01 Case No. 1552-22 In order to assess the size of the penalty fee, a position must first be taken the seriousness of the violations and then whether there are mitigations or aggravating circumstances. In conclusion, an assessment of whether the penalty fee is effective, proportionate and dissuasive. The Court of Appeal's assessment Use of body-worn cameras with pre-recording technology to prevent and document threats and violence In light of the type of situations in which pre-recording is actualized and when it is also a question of using the material to document crimes the Court of Appeal makes the same assessment as the Administrative Court in regard to SL's use of body-worn cameras with a pre-recording time of one minute to prevent and document threats and violence. What IMY stated about The use of the police authority, which has other duties and powers of body-worn cameras does not cause any other assessment. So there is not grounds for imposing an administrative penalty fee in this part. Use of body-worn cameras to ensure the identity of travelers who must pay a surcharge The Court of Appeal considers, like the administrative court, that the basis does not provide support that it is necessary to routinely film with image and audio recording to ensure the traveler's identity every time a surcharge is printed. The Court of Appeal therefore makes the same assessment as administrative law regarding SL's use of body-worn cameras for to ensure the identity of travelers who must pay surcharges. In this part, there are therefore conditions for imposing an administrative penalty fee. THE COURT OF CHAMBER IN STOCKHOLM JUDGMENT Page 6 Department 01 Case No. 1552-22 Information to registered users According to IMY and the administrative court, SL has breached its obligation to i in accordance with Article 13 of the Data Protection Regulation, inform the data subjects information to be provided if the personal data is collected from the registered. Through the deficiencies in the information provided by SL has also violated the principle of transparency in Article 5.1 of the regulation. The data subject's right to information is regulated in Articles 12–15 i data protection regulation. Article 13 states that if personal data which relating to a registered person is collected from the registered person, it shall personal data controller, when the personal data is obtained, provide certain information to the registered. Article 14 states which information is must be provided if the personal data has not been obtained from it registered. The extent of the information obligation and the possibilities for exceptions to this obligation differ between regulations. The there is no definition in the data protection regulation of the concepts collected from respectively received from the registered. The Article 29 group, now the European Data Protection Board, has in its guidelines on transparency according to the data protection regulation adopted on November 29, 2017, stated that personal data to be counted as collected from the data subjects includes data collected through observation using e.g. cameras (p. 26) and that Article 13 is thus applicable. The first question the Court of Appeal must decide is about collection of personal data using a body-worn camera is to be considered that the data collected from the data subject. The Swedish Camera Surveillance Act (2018:1200) does not specify in what legal text or preparatory works which article the law relies on THE COURT OF CHAMBER IN STOCKHOLM JUDGMENT Page 7 Department 01 Case No. 1552-22 the information requirement for camera surveillance. Neither gives the reasons in data protection regulation support for Article 13 to be applicable in such cases treatment that is current in the target. The Court of Appeal notes that the European Court of Justice in a judgment on 11 December 2014 regarding camera surveillance carried out by a private person (C-212/13, EU:C:2014:2428) as the applicable law stated i.a. the provision which is now found in Article 14 of the Data Protection Regulation. The goal was one camera which was permanently mounted and which filmed e.g. a public road. The wording of Article 13 – collected from the data subject – indicates as follows the Court of Appeals that some type of deliberate action is required from it registered for the personal data to be considered to have been collected from him. This cannot be considered the case when personal data is collected by means of the current body-worn cameras. The Court of Appeal therefore considers that the wording of the provision, taken together with the ruling of the European Court of Justice, argues that Article 13 is not applicable. What is stated in Article 29- Against this background, the group's guidelines have no decisive significance. IMY thus had no reason to impose a penalty fee in this part on the basis that SL breached its obligation to provide information according to Article 13. The size of the penalty fee The Court of Appeal has made the assessment that SL's treatment of personal data to identify travelers who must pay surcharges have entailed a violation of the data protection regulation. It has been about one extensive personal data processing of a large number of data subjects in a large part of public transport. The treatment has been going on for a relatively long time and the Court of Appeal considers that it is a serious violation. What SL has stated that this was done without intent and not through negligence does not change this assessment.
