Persónuvernd (Island) - 2021061342
From GDPRhub
| Persónuvernd - 2021061342 | |
|---|---|
| [[File:|center|250px]] | |
| Authority: | Persónuvernd (Island) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 4(1) GDPR Law on processing of personal information for law enforcement purposes (lög nr. 75/2019 um vinnslu persónuupplýsinga í löggæslutilgangi) Law on protection of personal information (Lög nr 90/2018 um persónuvernd og vinnslu persónuupplýsinga) |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 20.09.2024 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 2021061342 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Icelandic |
| Original Source: | Icelandic DPA (Iceland) (in IS) |
| Initial Contributor: | wp |
The DPA held that the oral disclosure of a data subject’s personal data by a policeman does not fall within the scope of the GDPR.
English Summary
Facts
A policeman was assigned to supervise a public CCTV. He recorded footage from that CCTV and shared it with his colleagues. The footage showed a data subject.
The data subject lodged a complaint with the Islandic DPA (Persónuvernd) against the Police (the controller). According to the data subject, unauthorised persons had access to their personal data, in particular data subject’s location and travel habits. Allegedly, the footage was also shown to the data subject's colleagues. Also the data subject claimed the policeman recorded the footage using his phone.
The Inspector General of Police explained that the data subject was suspected of not abiding the law. Because of that, it was necessary to inform policemen about the data subject’s movement in a specific area. Also, it was denied that the sharing of data subject’s data with their colleagues took place. The policeman disclosed the data only orally.
Holding
The DPA dismissed the case.
Firstly, the DPA underlined that processing activities performed by the police or other law enforcement authorities were in principle covered by the Law on processing of personal information for law enforcement purposes (lög nr. 75/2019 um vinnslu persónuupplýsinga ílöggæslutilgangi).
Secondly, the DPA found there was no proof the alleged violations occurred. There was no basis to claim that the processing fell within the scope of the law on processing of personal information for law enforcement purposes, since the alleged disclosure was done orally. Moreover, the disclosure of personal data orally was also not covered by the Law on protection of personal information (Lög nr 90/2018 um persónuvernd og vinnslu persónuupplýsinga).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
Solutions Complaint about the processing of personal information by police officers in the capital area Case no. 2021061342 20.9.2024 Complaints were made about the processing of personal information by police officers in the capital area. The complainant in the case claimed that the police officer, who was responsible for monitoring and control of [...] at that time, had recorded material from a surveillance camera on his phone and distributed that information to unauthorized persons, e.g. [...] Personal data protection considered it unproven that processing of personal information had taken place in an automatic manner or processing of information that was or was to become part of a file and also unproven that processing of personal information had taken place that falls within the scope of Act no. 75/2019 on the processing of personal information for law enforcement purposes and thus the authority of the institution. Ruling about a complaint about the processing of personal information by police officers in the capital area, in case no. 2021061342: Procedure On June 16, 2021, Personal Protection received a complaint from [...] (hereinafter the complainant) about a police officer's recording on his phone of footage from surveillance cameras [...] and sharing the material with unauthorized persons. The complaint specifically relates to the fact that an employee of the police in the capital region (hereafter also LRH) has distributed information about the complainant, i.e. on m. about [...] to irrelevant, among other things to [...]. He then recorded footage from a surveillance camera on his phone and showed [...].Privacy invited the National Police Commissioner and the police in the capital region to comment on the complaint by letters, on the one hand on June 13, 2022 and on the other on September 21 of the same year, and their answers were received by letters on 30 June 2022 and 23 November 2022. The Personal Protection Agency then gave the complainant the opportunity to express comments on the responses of the National Police Commissioner and LRH by letter on 24 November 2022. In accordance with the explanations given, the last identified letter from the Personal Protection Agency stated that if if answers are not received within the deadline, it will be considered that the complainant has dropped the complaint and the case will then be canceled and therefore closed in the Personal Protection's file. No answers were received from the complainant within the stated deadline, and the case was therefore dropped and closed. When the complainant was informed of the closure of the case, the complainant explained that [...] and therefore could not act within the deadline and requested that the case be reopened. Personal protection agreed to the complainant's request and reopened the case and informed the parties about it. The complainant was also given a deadline to submit his comments and they were received by e-mail on February 22, 2023. When resolving the case, all the above-mentioned documents have been taken into account, although not all of them are separately explained in the following ruling. The handling of the case has been delayed for the above reasons and due to the heavy workload at Personal Protection and personnel changes at the agency. Disputes There is a dispute as to whether an employee of the police in the capital region, who was responsible for monitoring and controlling [...] at that time, recorded material from a surveillance camera on his phone and sent it to [the complainant's employer] and whether he was authorized to share information about activities and trips of the complainant to [...]. Party point of view Main views of the complainant The complainant was an employee of [...] He believes that at that time, a police officer, who had access to camera and security systems [...] due to his work, used material from said systems and distributed information about the complainant to unauthorized parties, e.g. [of the complainant's colleagues]. The complainant claims to have experienced that employees of [...] and police officers other than the one mentioned above had information about his travels through [...]. In that regard, the complainant specifically refers to [...]. [...] it was then generally known where [...] the complainant had stayed and what he had been doing. It was known to everyone [...]. The complainant also knew that footage had been recorded on the phone of this particular police officer and that it had been shown to the complainant's colleagues. The main points of view of the Inspector General of Police According to the explanations of the National Police Commissioner, the monitoring and security of [...] was the responsibility of the police in the capital area at the time the alleged incidents took place on [...]. [...] Responsibility for the use and interaction of LRH employees with the system was therefore the responsibility of LRH at the time when the events of this case took place. The main points of view of the Police in the capital area[...][...] The complainant was an employee [...]. LRH interfered with him quite a few times because it was believed that he was not following the law [and rules]. The incidents in question were of such a nature that it was deemed necessary that [...] be informed about his travels and activities in the area. The employees of LRH have given [the complainant's employer] the information in question orally. There is nothing at LRH that the sharing of the information took place in such a way that an LRH employee recorded a video on his phone and showed it to others. Assumptions and conclusion Personal protection rulings in disputes concerning law no. 75/2019 on the processing of personal information for law enforcement purposes. The scope of the law is discussed in Article 3. of them, but it states that the law applies to the processing of personal data by competent authorities for law enforcement purposes. It also states that the law applies to the processing of personal information that is partially or fully automated and to the processing by methods other than automatic of personal information that is or is to become part of a file. what is explained above, there is no word on whether an employee of the police in the capital region recorded a video on his phone from a recording from a surveillance camera [...] and shared it in digital form to others. According to the respected authorities of the Personal Protection Agency, the organization does not consider it necessary to investigate further in this regard. It is therefore considered unproven that there has been processing of personal information that is considered automatic in part or in whole, or processing of personal information that was or was to become part of a file. In that case, it is also considered unproven that the processing of personal information that falls under the scope of Act no. 75/2019, cf. Article 3 of the law. In this regard, it is necessary to consider that the scope of law no. 90/2018 on personal protection and processing of personal information is defined in a similar way in Article 4. of that law and the oral transmission of personal information, alone, generally does not fall under the scope of the Personal Protection Act, cf. previous decisions of the Data Protection Authority, e.g. in case no. 2018010086. Ruling: It is unproven that the police in the capital area processed the complainant's personal information in a manner that falls within the scope of Act no. 75/2019 on the processing of personal information for law enforcement purposes. Privacy, September 4, 2024 Valborg Steingrímsdóttir Emma Adolfsdóttir
