Persónuvernd (Island) - 2021020374
From GDPRhub
| Persónuvernd - 2021020374 | |
|---|---|
| [[File:|center|250px]] | |
| Authority: | Persónuvernd (Island) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 09.02.2021 |
| Decided: | 04.09.2023 |
| Published: | 04.09.2023 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 2021020374 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Icelandic |
| Original Source: | Persónuvernd (in IS) |
| Initial Contributor: | co |
The Icelandic DPA held that the Directorate of Fisheries acted in violation of Article 6(1) GDPR and Article 5(1)(a) GDPR by recording the crew of a fishing vessel during an inspection.
English Summary
Facts
The Icelandic Directorate of Fisheries (the controller) is a public body responsible, among other things, to supervise fishing activities by fishing vessels and conduct inspections, partially without prior notification. The data subject and his employees were fishing, when they realised they were being filmed by a vessel of the Directorate of Fisheries. The data subject, as the captain of the vessel, later received a letter by the controller reprimanding the crew for unlawful fishing activities against the Icelandic law on treatment of marine stocks making reference to the recordings in question. The controller was in fact able to identify the vessel and its crew by using a powerful binoculars camera.
The data subject felt that his right to privacy had been violated by the controller and thus filed a complaint with the Icelandic DPA on 9 February 2021.
Holding
The Icelandic DPA considered that the recording in question did not amount to electronic surveillance as defined in the Icelandic Law on Data Protection, since that requires the monitoring to be continuous or repeated on a regular basis. Still, the DPA held that all processing activities must be carried out in accordance with one of the legal bases set out in Article 6(1) GDPR and the principles of processing of Article 5(1) GDPR. The DPA specified that in order for the recording carried out by the Fisheries Directorate to be based on Article 6(1)(c) GDPR, there must be a clear provision in the law that allows for such processing to take place.
In this case, the Act regulating the working of the Directorate of Fisheries, allows the Directorate to carry out inspections on fishing activities in Icelandic waters by accessing the vessels. Such Act was amended in 2022, adding a provision that explicitly allows the Directorate to use cameras for recording while carrying out its inspection duties. Yet, the monitoring in question took place in March 2020, when the above mentioned amendment had not been adopted yet. For this reason, the DPA concluded that the Act in question cannot be applied retroactively and thus at the time of the inspection, there was no legal basis for processing personal data by means of a camera under Article 6(1) GDPR. Hence, the Directorate of Fisheries had acted in violation of Article 6(1) GDPR.
In addition to this, the Icelandic DPA held that since the inspection by the Directorate of Fisheries was carried out without previously informing the data subject, thus secretly, such processing should be considered in violation of the principle of transparency of processing enshrined in Article 5(1)(a) GDPR and against the provisions of Article 12 GDPR and Article 13 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Solutions Processing of personal information by the Fisheries Agency Case no. 2021020374 4.9.2023 All processing of personal data must fall under one of the authorized provisions of the Personal Protection Act as well as be compatible with all the principles of the Personal Protection Regulation that personal data is processed in a lawful, fair and transparent manner towards the data subject. In this case, the complainant was not warned about the inspection and it was considered that the inspection by the Norwegian Fisheries Agency was carried out secretly and therefore did not comply with the transparency requirement of the privacy regulation. ---- Personal protection ruled in a case where a complaint was made about electronic monitoring by the Norwegian Fisheries Agency. More specifically, a complaint was made about the filming of an employee of the Fisheries Agency who pointed a camera with binoculars at the complainant and his employees while they were on board a fishing vessel while fishing outside the public domain. The conclusion of the Personal Protection Agency was that there was no electronic monitoring by the Norwegian Fisheries Agency, as there was no continuous or repeated monitoring. All processing of personal information must nevertheless be authorized by law, but according to the legal provisions that were in force when the said processing of personal information took place, the inspection of the Norwegian Fisheries Agency should be carried out by inspectors in person. The processing of personal information by the Norwegian Fisheries Agency was therefore not considered to be compatible with the law on personal protection and processing of personal information. Considering the changes that have taken place in the current rights and authorizations of the Norwegian Fisheries Agency for the processing of personal data, there was no reason to direct instructions to the Norwegian Fisheries Agency in the ruling. Ruling On September 4, 2023, Personal Protection issued the following ruling in case no. 2021020374: i Procedure 1. Outline of a case On February 9, 2021, Personal Protection received a complaint from [B]'s lawyer, on behalf of [A] (hereinafter the complainant), about the video recordings of the Norwegian Fisheries Agency of the fishing vessel [...]. By letter, dated On June 28, 2021, the Norwegian Fisheries Agency was invited to provide explanations regarding the complaint. The Norwegian Fisheries Agency's response letter was received by Personal Protection on July 9, 2021, together with an accompanying document. By letter, dated On October 4, 2021, the complainant was given the opportunity to comment on the explanations provided by the Norwegian Fisheries Agency. The complainant's comments were received by letter, dated October 29, 2021. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling. 2. Complainant's point of view The complainant bases his complaint on the fact that his privacy was violated by the filming of an employee of the Fishery Agency, who pointed a camera with a telescope at him and his employees while they were on board a fishing vessel while fishing outside the public domain. The Norwegian Fisheries Agency has referred to the video recordings in question in the agency's letter in which the ship's operator was reprimanded for violating Act no. 57/1996, on handling marine resources. According to the legal registration, it is known which persons were crew members on the ship in question when the recordings were in progress, but among the registered persons was the complainant, who was registered as the ship's captain. The complainant is based on the fact that the employees of the state's supervisory bodies only have the authorizations for supervision that are specifically specified in the law. The Norwegian Fisheries Agency's investigative authority does not include covert videos of people outside the public domain with the aim of revealing criminal conduct. 3. The Fisheries Agency's point of view In the response letter from the Norwegian Fisheries Agency, it is pointed out that the video recordings in question are rather blurry, that the ship's registration number or its name cannot be seen, and that the people on board are also not identifiable. The Norwegian Fisheries Agency therefore believes that the video recordings in question do not contain personally identifiable information. The Norwegian Fisheries Agency does not consider the aforementioned processing of personal information to be covered by electronic monitoring as defined in Article 3. Act no. 90/2018, on personal protection and the processing of personal information, since it is not a matter of monitoring that is ongoing or repeated regularly. In the responses of the Norwegian Fisheries Agency, it is also stated that the agency handles the implementation of Act no. 57/1996, on handling marine resources. From the beginning, the organization has primarily based its fishing control on manned control, where fishing inspectors go around the country or out to sea with fishing vessels. With increased technological development, fishing control methods have developed. Among other things, powerful binoculars, which have equipment to attach to them mobile phones for taking pictures, were used during the monitoring of hunting inspectors. The control is carried out in such a way that fishing inspectors are stationed on the coast near the fishing grounds of vessels fishing close to shore. If they see a violation during the fishing, they turn on a recording device attached to another telescope. The Office of Fisheries is based on the fact that the organization is required by law to supervise fishing and to process the above information, i.e. on m. the processing of information about a criminal act, therefore falls under its statutory role. The Fisheries Agency is a public institution bound by administrative law and must therefore investigate and obtain the necessary evidence before making a decision in a case. According to the nature of the case, the Fisheries Agency's inspection is partially carried out without prior notification. In cases where a case goes to formal proceedings, however, the parties to the case are always informed of the handling of the case and given the opportunity to familiarize themselves with the case's documents and make comments. Only when a case goes to formal proceedings is the recording of the footage saved in the Fisheries Agency's document processing system, but other copies are deleted. The data is stored in the Fisheries Agency's file system, which is access controlled, and only those who need it for their work in the investigation of the case have access to the data. II. Assumptions and conclusion 1. Scope – Responsible party Scope of law no. 90/2018, on personal protection and processing of personal information, and regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thus the authority of Personal Protection, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partially or fully automated and the processing of personal data that is or is to become part of a file by methods other than automatic. Personal information is information about an identified or identifiable person, and a person is considered identifiable if it is possible to identify him, directly or indirectly, with reference to his identity or one or more factors that are characteristic of him, cf. Number 2. Article 3 of the Act and number 1 Article 4 of the regulation. Processing refers to an operation or series of operations where personal data is processed, whether the processing is automatic or not, cf. Number 4. Article 3 of the Act and number 2 Article 4 of the regulation. As explained in the explanations to Article 3. bill according to law no. 90/2018 and in point 26 of the preamble of Regulation (EU) 2016/679, the essence of the concept of personal information relates to the fact that information can be attributed to an individual, directly or indirectly. In order for information to be personally identifiable (traceable), all methods that can reasonably be expected to be used by the responsible party or another party to identify the person in question must be taken into account. It follows from this that if it is possible to link the complainant to the footage in question, such as by taking into account the legal registration of a ship of which he is the registered owner or crew member, or, as the case may be, taking into account other circumstances, the footage of him can be considered personal information , cf. Article 3, number 2 of the Act and number 1 Article 4 of the regulation. This case concerns a video recording of the fishing vessel [...], while it was fishing close to shore. It is clear that the Norwegian Fisheries Agency was aware of the vessel in question. The Norwegian Fisheries Agency could then find out who the owner of the ship was, and thus the owner of the company, with a simple search in the Swedish Transport Agency's ship register. Regarding this issue, the processing of personal data falls under the authority of the Personal Protection Agency. The person responsible for the processing of personal information is compatible with Act no. 90/2018 is the named responsible party. As stated here, Fiskistofa is considered to be the party responsible for the processing in question. 2. Legality of processing and result Electronic monitoring is monitoring that is continuous or repeated regularly and includes monitoring of individuals with remote or automatic equipment and is carried out in public or in an area that is normally visited by a limited group of people, cf. Number 9. Article 3 Act no. 90/2018. It is clear that the use of the recording equipment, which is fixed to the telescope and used by the Norwegian Fisheries Agency for monitoring, is neither continuous nor repeated regularly. In the opinion of the Data Protection Authority, this is not a case of electronic monitoring according to the referenced legal provision. All processing of personal information must nevertheless fall under one of the authorization provisions of Article 9. Act no. 90/2018, cf. Paragraph 1 Article 6 of regulation (EU) 2016/679. When the government works with personal data, it is best to refer to number 3. of the legal article, cf. Section c of the regulatory clause, which stipulates that processing may be permitted if it is necessary to fulfill a legal obligation that rests on the controller, and section 5. of the legal article, cf. Clause e of the regulatory clause, which prescribes that processing may be permitted if it is necessary for work carried out in the public interest or in the exercise of official authority exercised by the responsible party. When assessing whether the processing of personal data is based on the 3rd or 5th item. Article 9 of the law, it is important to keep in mind that according to item 3 it is assumed that the legislator has decided clearly in the law that certain processing shall take place. When based on number 5. on the other hand, it is assumed that the government has a certain amount of scope to assess which processing is necessary to implement the statutory tasks of the relevant government authority with reference to the public interest and the exercise of public authority. In addition to authorization according to the above, the processing of personal data must be compatible with all the principles of paragraph 1. Article 8 Act no. 90/2018, cf. Paragraph 1 Article 5 of regulation (EU) 2016/679. Among other things, it is stipulated that personal data must be processed in a legal, fair and transparent manner towards the data subject, cf. Number 1. of the legal provision. In connection with the assessment of transparency during processing, according to the aforementioned principle, it may also be necessary to consider provisions on the responsible party's educational obligation towards the data subject, cf. Article 17 Act no. 90/2018 and 12.-14. art. of regulation (EU) 2016/679. When evaluating authorization for processing, provisions in other laws that are applicable in each case must also be taken into account. In Article 2 Act no. 36/1992, on the Norwegian Fisheries Agency, states that the Norwegian Fisheries Agency shall be in charge of the implementation of the Act on the management of fisheries and monitoring of fisheries, as further stipulated in the law on the subject. Then it says in paragraph 1. Article 13 Act no. 57/1996, on dealing with marine resources, that the Norwegian Fisheries Agency and inspectors in its service supervise the implementation of the law. Then in the 1st paragraph Article 8 The Act stipulates that inspectors from the Norwegian Fisheries Agency are allowed access to fishing vessels, transport equipment, fishing facilities and warehouses that are necessary to weigh the catch or supervise its weighing. In paragraph 1 Article 10 Act no. 79/1997, on fishing in Iceland's fishing territorial waters, states that the fisheries inspectors of the Norwegian Fisheries Agency are permitted to go on fishing trips with fishing vessels and that their captains are obliged to provide them with all assistance and facilities on board their vessels so that they can supervise fishing. The Fisheries Agency is also entrusted with monitoring the implementation of Act no. 116/2006, on fisheries management, cf. Paragraph 1 Article 18 of the law. The processing of personal data to which the complaint relates took place on March 25, 2020. With Article 8. Act no. 85/2022, on amendments to the Act on the Norwegian Fisheries Agency, no. 36/1992, the legislator authorized the Office of Fisheries to use remote-controlled aircraft in its inspection duties equipped with cameras for recording or other remote-controlled equipment that can collect information. However, such authorization was not granted until June 15, 2022, when the aforementioned amending law was approved by Althingi, and therefore Personal Protection cannot rely on it when resolving this complaint. According to the legal provisions that were in force when the said processing of personal data took place, the supervision of the Norwegian Fisheries Agency should be carried out by inspectors in person who would be granted access to the necessary places, e.g. ships, transport vehicles, warehouses or other premises. In view of the above, it is the conclusion of the Data Protection Authority that at the time the said processing of personal data took place, there was no authorization for the processing according to Article 9. Act no. 90/2018, cf. Paragraph 1 Article 6 of regulation (EU) 2016/679. According to the provisions of the above-mentioned laws, which are supervised by the Norwegian Fisheries Agency, the agency is not permitted to carry out secret surveillance. The inspection of the Norwegian Fisheries Agency was carried out by recording videos of the complainant, where he was fishing near the coast, with powerful binoculars. The complainant was not specifically warned that the Fisheries Agency was monitoring him. It will therefore be considered that the inspection by the Norwegian Fisheries Agency was in fact carried out with secrecy and thus not compatible with the transparency requirement of item 1. Paragraph 1 Article 8 Act no. 90/2018, cf. point a, paragraph 1 Article 5 of regulation (EU) 2016/679. Then it will not be considered that the processing has been in accordance with the provisions of the legislation on educational obligations, cf. 1.-2. paragraph Article 17 of the Act and 12.-13. art. of the regulation. With reference to all of the above, it is the conclusion of the Data Protection Authority that at the time the Norwegian Fisheries Agency processed the complainant's personal information, there was no authorization for the processing according to Article 9. Act no. 90/2018, cf. Paragraph 1 Article 6 of regulation (EU) 2016/679. Then the processing did not comply with the 1st item. Paragraph 1 Article 8 of the law on transparency, cf. point a, paragraph 1 Article 5 of the regulation, or 1.-2. paragraph Article 17 of the Act and 12.-13. art. of the regulation on compulsory education. Is this conclusion in accordance with the decision of the Personal Protection Authority in case no. 2021030579, where a complaint was made about the video footage of the Fisheries Agency using drones during surveillance work. Like the above articles, law no. 85/2022 amended the Act on the Norwegian Fisheries Agency, no. 36/1992. On the basis of new legal provisions, which can now be found in Article 2. of the latter act, in the opinion of the Data Protection Authority, it must be considered that the use of recording equipment attached to binoculars by the Norwegian Fisheries Agency for surveillance work can now be based on the authorization clause of section 3. Article 9 Act no. 90/2018. At the same time, it will be considered that individuals can now be aware that monitoring of remotely controlled aircraft or other remotely controlled equipment can be carried out by the Norwegian Fisheries Agency during monitoring tasks and that their personal data can be processed for that reason. Considering the changes that have taken place in the current rights and authorizations of the Norwegian Fisheries Agency for the processing of personal data, there is no reason to direct instructions to the Norwegian Fisheries Agency in this ruling. Ruling: The Norwegian Fisheries Agency's processing of personal information about [A] did not comply with Act no. 90/2018, on personal protection and processing of personal information, cf. regulation (EU) 2016/679. Privacy, September 4, 2023 Valborg Steingrímsdóttir Edda Úríður Hauksdóttir
