OVG Rheinland-Pfalz - 10 A 10302/21
| OVG Rheinland-Pfalz - 10 A 10302/21 | |
|---|---|
 | |
| Court: | OVG Rheinland-Pfalz (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 4(2) GDPR Article 58(2)(f) GDPR Article 58(6) GDPR Article 28(3) Directive 95/46/EC § 38(5)(2) BDSG a.F. |
| Decided: | 25.06.2021 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 10 A 10302/21 |
| European Case Law Identifier: | ECLI:DE:OVGRLP:2021:0625.10A10302.21.00 |
| Appeal from: | VG Mainz (Germany) 1 K 584/19.MZ |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Landesrecht online Rheinland-Pfalz (in German) |
| Initial Contributor: | n/a |
A German Higher Administrative Court found that a switched-off surveillance camera does not fall within the scope of the GDPR. Furthermore, Article 58(2)(f) GDPR does not authorise a DPA to order the removal of a (switched off) camera.
English Summary
Facts
The controller erected an LED billboard on a private car park. As there had been regular vandalism there in the past, the controller set up various cameras that operated around the clock and partially recorded the public traffic area. The DPA ordered, among other things, that the data processing by one of the cameras be stopped and that this camera be dismantled.
The controller objected to this order. The court of first instance (VG Mainz - 1 K 584/19.MZ) ruled that the discontinuation order was lawful, but that the dismantling order was unlawful. The controller accepted this decision and, in particular, accepted that he would no longer be allowed to switch on the camera.
In contrast, the defendant appealed against the annulment of the dismantling order.
Holding
The appeal was unsuccessful.
The Higher Administrative Court of Rhineland-Palatinate (OVG Rheinland-Pfalz) ruled that, firstly, the scope of application of the GDPR was not opened for the switched-off camera. Secondly, Article 58(2)(f) GDPR does not authorise the ordering of the dismantling of a (decommissioned) camera.
Scope of Application of the GDPR not Opened
In the court's opinion, the scope of application of the GDPR is not opened. There was no processing within the meaning of Article 4(2) GDPR.
Video recordings and their temporary storage are indisputably data processing, but a deactivated camera does not process data (any longer). In the second instance, the operator of the LED board no longer objected to the order of discontinuance. The order has become unappealable. In the absence of any indications of continued operation contrary to the order, the court held that it was to be assumed that the camera was and remained deactivated.
No Authorisation Under Article 58(2)(f) GDPR
Pursuant to Art. 58(2)(f) GDPR, the supervisory authority has all corrective powers allowing it to impose a temporary or definitive limitation on processing, including a ban. The DPA made use of this power by ordering to deactivate the camera and therefore to stop the processing. Article 58(2)(f) GDPR does not establish a further-reaching power to also order the dismantling of the camera.
According to its unambiguous wording, the norm only authorises the supervisory authority to temporarily or definitively limit or prohibit processing. Just like the prohibition in the predecessor provision of § 38 (5)(2) the old version of the German Data Protection Act (BDSG a.F.), the restriction or prohibition refers to a behaviour - the data processing - but does not extend to the removal of the associated hardware. In addition to the wording, the court also cites Recital 129 GDPR, according to which a ban may only be imposed in application of the principle of proportionality if less drastic measures do not promise success. In this respect, the ban represents the ultima ratio of corrective measures. In this respect, a broadening interpretation of the concept of prohibition is not possible. This also results from a comparison with the other measures provided for in Article 58(2) GDPR: Reprimands (lit. b)) and instructions according to lit. (d) show that the ban is one of the most burdensome measures for controllers anyway.
The court also rejected the DPA’s view that Article 58(2)(f) GDPR empowers the ordering of mining as a "technical and organisational measure in the processing environment". In this respect, Articles 24(1), 25(1) and 32(1) GDPR do not establish isolated obligations, but always refer to a data processing operation. This is not the case with a deactivated camera.
A authorisation does also not follow from the principle of effet utile under EU law. The court states that it cannot be inferred from the legislative history of Article 58(2)(f) GDPR that an unwritten authorisation that goes beyond the standardised powers is required for the full effectiveness of the processing ban. Whereas the predecessor provision of Article 28(3) Directive 95/46/EC still provided for relatively broad powers of investigation and interference, which were then open to implementation by the individual Member States, Article 58 GDPR contains 26 concrete powers of investigation, redress and authorisation. In this respect, it cannot be assumed that the legislator deliberately did not include a power that is also the most intrusive. Nor can anything to the contrary be inferred from the explanatory memorandum to the GDPR. In particular, there are no indications that a corrective power in the form of a command to act was to be created in addition to the corrective powers previously provided exclusively as prohibitions.
The fact that the deactivated camera exerts a so-called "surveillance pressure" (as in the case of a camera dummy) does not constitute an authorisation. At most, this represents a violation of the general personal rights of the individual, which must be asserted in civil law with claims for defence, injunctive relief and damages.
The decision was also not precluded by the fact that the camera could be put back into operation at any time. Germany has not made use of the opening clause provided for in Article 58(6)(1) GDPR to establish additional powers for the supervisory authority.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Action against a data protection order for the dismantling of a surveillance camera
Editorial
A camera that is switched off does not fall within the scope of the General Data Protection Regulation. Moreover, Article 58(2)(f) of the GDPR (juris: TEU 2016/679) does not authorise ordering the removal of a switched-off surveillance camera.(para.21)(para.22)
Proceedings
preceding VG Mainz, 24 September 2020, Ref: 1 K 584/19.MZ, Judgment
Tenor
The appeal of the defendant is dismissed.
The defendant is to bear the costs of the proceedings.
The judgment is provisionally enforceable with respect to the costs.
The appeal is not admitted.
Facts
1
The parties are in dispute about an order under data protection law for the removal of a video camera.
2
The plaintiff is the owner of a plot of land with a shopping centre and a car park in an industrial estate in B... . On the car park, which can be reached via a branch from the passing federal road ... , the plaintiff has erected a double-sided LED advertising board worth approximately 200,000 euros on two concrete pillars, which is monitored by a total of four video cameras mounted on the board. Two of the cameras each cover one side of the billboard, the other two cameras are directed at the respective area in front of the billboard. One camera films the car park and the shopping centre, the other surveillance camera (video camera 01) - which is the only one at issue in the appeal proceedings - films the area where the B ... joins the car park. The recordings of the cameras, which are operated around the clock and to which the plaintiff has access from a computer in his office, are stored in a separately locked recording device inside the installation for 48 hours and then automatically deleted.
3
By decision of 23 November 2018, the defendant warned the plaintiff regarding the data processing by video camera 01 pursuant to Article 58(1)(b) of the General Data Protection Regulation - DS-GVO - (paragraph 1), ordered the plaintiff pursuant to Article 58(2)(f) of the DS-GVO to cease data processing by this camera and to dismantle the camera (paragraph 2) and to prove the dismantling pursuant to Article 58(1)(a) of the DS-GVO by providing an appropriate photograph (paragraph 4). Furthermore, he ordered the plaintiff to restrict the data processing by camera 02 to the period outside the opening hours of the surrounding shops (clause 3) and to prove this by means of a printout or a photograph of the corresponding settings (clause 5) as well as to direct the video cameras 03 and 04 in such a way that the street, the car park and the residential building partially visible on them no longer fall within the coverage angle of the video cameras (clause 6) and to prove this by means of screen printouts (clause 7). The defendant set the plaintiff a deadline of 15 December 2018 to take these measures and threatened to impose a penalty payment of €5,000 for failure to comply with the order to remove the video cameras.
4
The plaintiff filed a lawsuit on 26 June 2019, essentially claiming that the video surveillance was lawful. The cameras served to protect the billboard from damage, after there had been burglaries in shops of the shopping centre, damage to property by graffiti, disposal of waste oil and cases of hit and run on the premises in the past, among other things. Only the interaction of all four cameras ensures effective protection of the advertising installation. Furthermore, the order to dismantle camera 01 was unlawful because its deactivation was sufficient to prevent further data processing.
5
The plaintiff has applied for
6
annul the orders or measures ordered in paragraphs 1 to 7 of the defendant's decision of 23 November 2018 and the threats of coercive measures ordered in paragraph 9 of the decision.
7
The defendant has applied for
8
dismiss the action,
9
and essentially argued that the order to cease operations and to dismantle camera 01 was necessary because the plaintiff was not authorised to monitor the public traffic area. As a result, a considerable number of unlawful processing operations had taken place. The monitoring of the traffic area was a state task, the performance of which by the plaintiff impaired the rights of road users without reference to concrete criminal conduct. The mere switching off of the camera was not sufficient, because the camera, if it remained on the board as a de facto dummy, caused an impermissible surveillance pressure. Only by removing the camera could it be ensured that its operation would not be resumed. With regard to the other cameras, a restriction of operation to times outside business hours (camera 02) or a change in the orientation of the cameras exclusively towards the billboard (cameras 03 and 04) was necessary in order to eliminate the violations of data protection law.
10
By decision of 24 September 2020, the Administrative Court annulled the order to dismantle camera 01 as well as paragraphs 4 and 9 of the contested decision and dismissed the remainder of the action. In its reasoning, it stated that the monitoring of the area where the B... joins the car park was unlawful due to the lack of consent of the persons concerned pursuant to Art. 6 para. 1 UA 1 sentence 1 lit. a DS-GVO. The data processing was also not justified according to Art. 6 para. 1 UA 1 lit. f DS-GVO, in particular it was not necessary during the opening hours of the shopping centre. The targeted surreptitious surveillance of persons on public streets, roads and squares was inadmissible in principle. The surveillance of traffic areas by camera 01, which is precise to the person and the number plate, is carried out regularly, without any reason, and is not readily recognisable to passing motorists who obviously do not want to interfere with the plaintiff's property. Although a particular risk situation for the billboard outside the opening hours of the shopping centre was to be assumed, the interests of the persons concerned worthy of protection outweighed the interest of the plaintiff in the protection of his property. For this reason, both the warning and the order to stop the operation of camera 01 were lawful. In contrast, the dismantling of this camera could not be based on Article 58(2)(f) of the GDPR, because this provision only allowed the supervisory authority to restrict or prohibit data processing temporarily or permanently. The prohibition of data processing referred to a specific action, but not to the existence of a - switched off - data processing system. It was true that the defendant could only verify to a limited extent whether the camera was actually switched off. As far as the defendant referred to difficulties in effectively enforcing the law, it had to be pointed out that the German legislator was at liberty to provide the supervisory authority with additional powers pursuant to Article 58(6), first sentence, of the GDPR. Irrespective of this, a switched-off camera does not process any data, so that the scope of application of the General Data Protection Regulation is not opened.
11
In its appeal, which was admitted by the Senate and limited to the annulment of the order to dismantle camera 01, the defendant argues that the scope of application of the General Data Protection Regulation is open. The order to dismantle the camera constituted a prohibition of processing within the meaning of Article 58(2)(f) of the GDPR. Although a switched-off camera does not process any data, the material scope of application of the General Data Protection Regulation also extends to the processing environment in the form of technical and organisational measures with an indirect connection to data processing operations. Unlike a mere dummy, a (merely) deactivated camera remains fully functional. The risk of unauthorised or unlawful processing emanating from it was not to be assessed as significantly lower for a data subject than during operation, since merely switching it on was just as easy as misappropriation during ongoing operation. Based on the so-called risk-based approach, the legislator does not only consider the risk emanating from the processing itself, but also the risk emanating from the processing environment. Therefore, a processing ban could also address the processing environment. Moreover, the dismantling order proved to be proportionate; another equally suitable but less intrusive measure could not be considered. A mere cessation of operations was not recognisable from the outside, was not verifiable for the defendant and therefore contradicted the efficiency requirement. The mere prohibition of processing, the circumvention of which could not be verified, could not effectively prevent violations of the GDPR.
12
The defendant claims that the Court should
13
to also dismiss the action against the dismantling order in No. 2 of the order of 23 November 2018, amending the judgment under appeal.
14
The applicant claims that the Court should
15
dismiss the appeal,
16
and submits that the scope of application of the General Data Protection Regulation is not open. According to Article 2(1) of the GDPR, the regulation applies to the processing of data wholly or partly by automatic means. Since a camera that is switched off does not record anything and does not process any personal data, the General Data Protection Regulation does not apply. The power standard of Article 58(2)(f) of the GDPR also does not apply because the prohibition refers to a specific action and is not linked to the mere existence of a - switched-off - data processing system. The German legislature has not yet created a national provision in the sense of Article 58(6) of the GDPR that goes beyond the remedial powers of the GDPR. Regardless of this, the contested order proves to be disproportionate in any case. Instead of the removal, the defendant could have demanded proof of the disconnection - in accordance with the provisions in paragraphs 5 and 7 of the order - by means of photographs and a printout on the setting of the camera control. Conversely, the plaintiff had no means of a lesser intensity of intervention to protect his property.
17
For further details of the facts and the dispute, reference is made to the contents of the court file as well as to the contents of the administrative file submitted by the defendant.
Reasons for the decision
18
The defendant's appeal is unsuccessful. The order to dismantle camera 01 in paragraph 2 of the decision of 23 November 2018, which is the only thing still at issue in the appeal proceedings, is unlawful and was therefore rightly annulled by the Administrative Court. The deactivated camera is already not subject to the scope of application of the General Data Protection Regulation (1.). Moreover, Article 58(2)(f) of the GDPR cannot be considered as an enabling basis for the order to dismantle the camera. A broader interpretation of this provision, as made by the defendant, is not possible (2.).
19
The scope of application of the General Data Protection Regulation is not open.
20
According to Art. 2(1) GDPR, the Regulation applies to the processing of personal data wholly or partly by automatic means and to the processing otherwise than by automatic means of personal data which are stored or are intended to be stored in a filing system. According to Art. 4 No. 2 of the GDPR, "processing" means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. This is lacking in the present case.
21
It is true that video recordings and their temporary storage by a surveillance camera are data processing operations within the meaning of Article 4 of the GDPR. However, no data are (any longer) processed by the camera in question 01. This is because the cessation of the operation of this camera ordered in No. 2 of the decision of 23 November 2018 has become final after the Administrative Court dismissed the action in this respect, the plaintiff did not apply for leave to appeal in this respect and also did not join the defendant's appeal pursuant to § 127 of the Code of Administrative Procedure (Verwaltungsgerichtsordnung - VwGO). If the camera is switched off, a processing of personal data does not (or no longer) take place - since there are no indications for a continued operation that contradicts the order and since the defendant has not submitted any such indications. The factual scope of application of the General Data Protection Regulation pursuant to Article 2(1) of the GDPR is not opened with regard to the merely existing but deactivated camera (see Polenz in: Simitis/Hornung/Spiecker gen. Döhmann, Datenschutzrecht, 1st edition 2019, Annex 1 to Art. 6 para. 43; also: Datenschutzkonferenz, Orientierungshilfe Videoüberwachung durch nicht-öffentliche Stellen, 17 July 2020, No. 1.1, p. 5).
22
2 Irrespective of this, Article 58(2)(f) of the GDPR does not authorise the ordering of the dismantling of the camera that has been shut down; a broader interpretation of the provision, as the defendant undertakes, is not possible.
23
a) Pursuant to Article 58(2)(f) of the GDPR, the supervisory authority has all remedial powers in the event of a data protection breach, which - only - allow it to impose a temporary or definitive restriction on processing, including a ban. The respondent made use of this power by ordering the cessation of data processing by camera 01; this order is final. Article 58(2)(f) of the GDPR does not establish a further-reaching power to order the dismantling of the camera. Rather, according to its clear wording, the provision only authorises the supervisory authority to temporarily or completely restrict or prohibit processing. Just like the prohibition in the predecessor provision of Section 38 (5) sentence 2 of the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG), old version, the restriction or prohibition refers to a conduct - the processing of data - but does not extend to the removal of the associated hardware (in this sense, already with respect to Section 38 (5) BDSG, old version: VG Oldenburg, judgment of 12 March 2013 - 1 A 3850/12 -, juris, marginal no. 22; Nguyen in: Gola, DS-GVO, loc. cit., Art. 58, marginal no. 20).
24
b) Contrary to the defendant's view, the instruction to dismantle a deactivated camera cannot be subsumed under the concept of prohibition within the meaning of the provision. According to Recital 129, fourth sentence, a prohibition pursuant to Article 58(2)(f) of the GDPR may only be imposed in application of the principle of proportionality if less restrictive measures such as the restriction of processing do not promise success. If the prohibition thus represents the ultima ratio of the remedial measures under Article 58(2)(f) of the GDPR (cf. Simitis/Horn/Spiecker, loc. cit., Art. 58. para. 40; VGH Baden-Württemberg, order of 22 January 2020 - 1 S 3001/19 - juris, para. 61), a broader interpretation of the concept of prohibition in the sense of a significantly more intrusive requirement to remove a deactivated camera is ruled out. This applies all the more as the prohibition under Article 58(2)(f) of the GDPR is already one of the most burdensome measures for the data processor compared to the other measures from the catalogue of Article 58(2), such as warnings (cf. lit. b) and instructions on future conduct (lit. d).
25
c) Contrary to the defendant's opinion, Art. 58(2)(f) GDPR also does not authorise the ordering of dismantling as a "technical-organisational measure in the processing environment". It is true that the controller is obliged to ensure by appropriate technical and organisational measures, inter alia, that the processing is carried out in accordance with the GDPR (Art. 24(1) GDPR), that data protection principles such as data minimisation are effectively implemented (Art. 25(1) GDPR) and that a level of protection appropriate to the risk is ensured (Art. 32(1) GDPR). However, the obligation to implement such measures, the necessity of which depends on the respective risks of the processing of personal data concerned (so-called risk-based approach, cf. recitals 75 and 76 of the GDPR), does not exist in isolation. Rather, the specified technical and organisational measures, as well as the restrictions and prohibitions, always relate to data processing operations whose compatibility with the GDPR they are intended to ensure. However, such processing operations do not take place with a deactivated camera, as explained. In the absence of data processing operations, an indirect processing link justifying the order, as alleged by the defendant, cannot be established either.
26
d) Nor can a remedial power in the sense of a removal order be based on the principle of effectiveness under Union law, according to which it is incumbent on the Member States as well as the national courts when applying Union law to ensure the full effect of its provisions ("effet utile", see ECJ, Judgment of 17 September 2002 - C-253/00 -, juris, para. 28 with further references). There is nothing in the legislative history of the GDPR to suggest that the provisions of data protection law require further protection through an additional - non-standardised - power to order the uninstallation of data processing systems in order to be fully effective beyond the processing prohibition in Article 58 (2) (f) of the GDPR. Article 58 of the GDPR replaced Article 28(3) of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Data Protection Directive - DPD), which, in comparison, standardised relatively crude powers of investigation and intervention as well as the right of action and the power of notification of the supervisory authorities. In contrast to the powers under Art. 28(3) DS-RL, the scope and effectiveness of which depended substantially on the specifications of the national legislator in the individual national implementing laws and could therefore diverge considerably between the Member States (cf. Ehmann/Selmayr, Datenschutz-Grundverordnung, 2. Auflage 2018, Art. 58, para. 1), the legislator has regulated the powers of the supervisory authority in Art. 58 GDPR for the first time uniformly and with direct applicability throughout Europe in order to establish a uniform level of data protection within the EU (cf. Commission Explanatory Memorandum, COM (2012) 11, p. 2). In view of the significantly expanded and specified remedial powers compared to the predecessor provision of Section 28 (3) of the Data Protection Directive - Article 58 of the Data Protection Regulation provides for 26 specific powers of investigation, remedy and authorisation - it cannot be assumed that the legislator inadvertently failed to standardise a requirement to uninstall hardware - which also significantly exceeds the intensity of the remedial powers provided for - and that this loophole would be contrary to the system and would now have to be closed via the principle of "effet utile". This applies in particular because the question of whether the supervisory authority is also authorised to order the dismantling of a camera was already disputed under the validity of Article 28 (3) of the Data Protection Directive or Section 38 (5) of the Federal Data Protection Act (BDSG), old version (cf. Nguyen in Gola, loc. cit., Art. 58, marginal no. 20 with further references, VG Oldenburg, judgment of 12 March 2013 - 1 A 3850/12 -, loc. cit.). However, despite the already known problems, an explicit authorisation basis for a dismantling order has not found its way into the General Data Protection Regulation. On the contrary, the legislative explanatory memorandum on the powers of the supervisory authority (at the time of drafting still regulated in Art. 53 of the Regulation) merely states that Art. 53 - partly based on the predecessor regulation of Art. 28 (3) of the Data Protection Directive - regulates the powers of the supervisory authority with "some new aspects, including the power to impose administrative sanctions" (cf. legislative explanatory memorandum of the Commission, loc. cit., p. 14). There are no indications that a remedial power in the form of a command to act (to dismantle a data processing system) should be created in addition to the remedial powers previously provided exclusively as a prohibition or restriction.
27
e) Finally, the fact that a so-called surveillance pressure emanates from the switched-off camera 01 just as from a dummy does not justify the assumption of a power of the defendant to order the dismantling. Insofar as video surveillance interferes with the general right of personality of the individual in its manifestation as the right of informational self-determination, possible claims for defence, injunctive relief and damages are to be asserted by the person concerned in civil law proceedings (cf. Data Protection Conference, Orientation Guide Video Surveillance by Non-Public Bodies of 17 July 2020, loc. cit, No. 1.3 with further references to civil court case law; VG Oldenburg, judgement of 12 March 2013 - 1 A 3850/12 - juris, marginal no. 24; Simitis/Hornung/Spiecker, Datenschutzrecht, loc.cit., Annex 1 to Art. 6, marginal no. 43).
28
f) Insofar as the defendant claims that an isolated ban on processing would not be able to effectively counter violations of the General Data Protection Regulation because the plaintiff could put the camera back into operation at any time without the supervisory authority being able to control this and without the plaintiff being able to comply with its accountability obligation pursuant to Article 5(2) of the General Data Protection Regulation, in view of the clear wording of the provision, it must be referred to Article 58(6) sentence 1 of the General Data Protection Regulation. 58 (6), first sentence, of the GDPR, according to which each Member State is free to provide by law that its supervisory authority has additional powers in addition to those listed in paragraphs 1 to 3, which, however, must not impair the effective implementation of Chapter VII of the GDPR (also: Nguyen in: Gola, DS-GVO, op. cit, Art. 58, marginal no. 20 a.E.). The national legislator has so far only made use of this opening clause in the form of Section 40 (3) sentence 3 and (6) sentence 2 BDSG (cf. Simitis/Hornung/Spiecker gen. Döhmann, loc. cit., Art. 58, marginal no. 74), but not with regard to the authorisation to issue a removal order.
29
If the order to remove the camera on the basis of Article 58 (2) (f) of the GDPR is ruled out, it is no longer relevant what the parties have to say about the proportionality of the removal order.
30
The decision on costs is based on § 154 (2) VwGO.
31
The decision on the provisional enforceability of the judgment on account of the costs finds its legal basis in § 167 (2) VwGO.
32
The appeal was not to be allowed because there were no grounds under § 132.2 VwGO.
33
Decision
34
The value of the subject-matter of the appeal proceedings is set at € 5,000.00 (section 52 (2) Court Costs Act).
