Persónuvernd - 2020010724

Persónuvernd - 2020010724
Authority:	Persónuvernd (Iceland)
Jurisdiction:	Iceland
Relevant Law:	Regulation no. 322/2001 on the processing of personal information by the police
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	01.03.2021
Published:	17.03.2021
Fine:	None
Parties:	Icelandic National Police
National Case Number/Name:	2020010724
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Icelandic
Original Source:	Personuvernd (in IS)
Initial Contributor:	n/a

The Icelandic DPA ruled in a case regarding the use of audio and video recording equipment in police cars by the police in the capital area in 2017 and 2018. The decision finds that the complainant's right to information, including the police's obligation to provide information, was respected in 2017 but not in 2018.

English Summary

Facts

On 15 September 2018, the DPA received a complaint about the three cases of processing of personal data by the police in the capital area using audio and video recording equipment in a police car. The complainant complained about three separate incidents on 2017, 2018 and 2018, all of which concerned alleged audio and video recordings in police cars after the complainant was forced to get into the cars. In all cases, the complainant argued that the audio and video recordings made in the police cars were illegal and that he was not informed that the recordings would take place until long after his conversation with the police officers in each case.

The police answered that recording equipment in police cars, so-called eyewitness, and body cameras, fall under the category of electronic monitoring within the meaning of the Privacy Act. Authorizations for the police to conduct electronic surveillance are based on the general rules of Act no. 90/2018 on personal protection and processing of personal information and Act no. 75/2019 on the processing of personal information for law enforcement purposes and rules set according to them.

According to the police, in the first incident, the recording was only limited to what happened in front of the police car, and not when the complainant had entered the police car. The recording is silent but it is clearly reported that the complainant had been informed that a recording of audio and video was in progress. In the second incident, the audio recording was missing and therefore it is not possible to verify what took place between the police officers and the complainant. However, the documents in the case do not state that the complainant was not informed that the recording of the audio and video was in progress. The third incident involved a police car that was not equipped with witness equipment.

Holding

The DPA held with regard to the first incident that it has been stated in the responses of the police that the recording was silent and limited only to what had happened in front of the police. A police report which is one of the documents in the case, stated that the complainant was informed that the recording of audio and video was taking place. Therefore, in the opinion of the DPA, the complainant was provided with the knowledge to which he was entitled according to Art. Article 8 of Regulation no. 322/2001 on the processing of personal information by the police.

As for the second incident, a video recording took place in the police car when the complainant was in it, but an audio recording is missing. The police do not have any evidence to show that the complainant was informed that the recording was made on audio and video. According to the DPA, it is therefore not possible to establish what took place between the police officers and the complainant. The police in the capital area will be considered to have to bear the brunt of not being able to show that the knowledge has been provided. For that reason, the DPA considered that the liability of the police in the capital area has not been fulfilled and the complainant was not provided with the knowledge to which he was entitled according to Art. Article 8 of Regulation no. 322/2001 on the processing of personal data by the police. The DPA also concluded that the police has not shown that the processing of personal data in question has complied with the principles of the first paragraph Article 8 Act no. 90/2018.

In view of the above, the conclusion of the DPA is that the processing of the complainant's personal information about the complainant by the police in the capital area in 2017 was in accordance with Act no. 77/2000 on personal protection and handling of personal information and Regulation no. 322/2001 on the processing of personal information by the police.

However, the processing by the police in the capital area of ​​personal information about the complainant in 2018 did not comply with Act no. 90/2018 on personal protection and processing of personal information and Regulation no. 322/2001 on the processing of personal information by the police.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.

Processing of personal data by the police using audio and video recording equipment in police cars
Case no. 2020010724
17.3.2021
The Data Protection Authority has issued a ruling in a case regarding the use of audio and video recording equipment in police cars with the police in the capital area. On the one hand, it was an incident in the time of the older Personal Data Protection Act no. 77/2000 and on the other hand in the time of Act no. 90/2018 on personal data protection and the processing of personal data when the complainant was forced to get into a police car. The ruling finds that in both cases, the complainant's right to information, including the police's obligation to provide information, had complied with Regulation no. 322/2001 on the processing of personal information by the police. According to it, the data subject has, among other things, the right to be informed of what information about him is or has been processed and the purpose of the processing. With regard to the previous incident, it was considered that despite the lack of sound on the recording, the complainant had been provided with the knowledge to which he was entitled according to the regulation, but reference was made to registration in a police report in this regard. However, it was not considered that the police had provided evidence showing that the complainant had been informed that the recording was made on audio and video in the latter incident, but that the recording was also missing. In the opinion of the Data Protection Authority, it was therefore not considered possible to verify what took place between the police officers and the complainant, and the police were deemed to have to bear the burden of not being able to show that the knowledge had been provided. For that reason, the Data Protection Authority considered that the liability of the police in the capital area, cf. Paragraph 2 Article 8 Act no. 90/2018 has not been fulfilled.

Ruling

On March 1, 2021, the Data Protection Authority announced the following decision in case no. 2020010724 (former case no. 2018010540).

I.
Procedure

1.
Outline of case
On 15 September 2018, the Data Protection Authority received a complaint from [A] (hereinafter referred to as the complainant) about the processing of personal information by the police in the capital area using audio and video recording equipment in a police car in three cases when it was transferred to a police car.

By letter dated On 2 January 2019, repeatedly on 14 February and 19 March, the police in the capital area were invited to provide explanations regarding the complaint. The answer was by letter dated. May 8, 2019. By letter dated On 13 May, repeatedly on 13 June, the complainant was given the opportunity to comment on the views of the police in the capital area. The complainant's comments were received by e-mail on 26 June 2019. During the period from 28 August 2019 to 9 December 2019, however, some e-mail communication took place with the complainant, partly due to his addition to the original complaint. By letter dated 19 December 2019, repeated 23 January 2020, 17 March s.á. and by telephone on 20 April this year, the police in the capital area were invited to provide explanations regarding the complainant's additional complaint. The answer was by letter dated. May 12, 2020. By e-mails on 11 and 12 June 2020, the Data Protection Authority requested further information from the police in the capital area. The reply was received by e-mail on 12 and 15 June. By letter dated January 12, 2021, the Data Protection Authority requested further information from the police in the capital area and received a reply by e-mail on February 19.

In resolving the case, all of the above documents have been taken into account, although not all of them are specifically described in the following ruling.

The handling of the case has been delayed due to significant work by the Data Protection Authority, in addition to which the number of complaints was increased during the proceedings.

2.
The complainant's views
The complainant complains about three separate incidents on [...] 2017, [...] 2018 and [...] 2018, all of which concern alleged audio and video recordings in police cars after the complainant was forced to get into the cars. In all cases, the complainant relies on the fact that the audio and video recordings made in the police cars were illegal and that he was not informed that the recordings would take place until long after his conversation with the police officers in each case. The complaint also relates to the fact that the police officers' working methods with the complainant had violated the General Penal Code no. 19/1940 and the Police Act no. 90/1996.

3.
The views of the police in the capital area
The police in the capital area refer to the fact that recording equipment in police cars, so-called eyewitness, and body cameras, fall under the category of electronic monitoring within the meaning of the Privacy Act. The aforementioned equipment collects electronic video recordings on a central basis on the National Commissioner of Police's wide network. Authorizations for the police to conduct electronic surveillance are based on the general rules of Act no. 90/2018 on personal protection and processing of personal information and Act no. 75/2019 on the processing of personal information for law enforcement purposes and rules set according to them. Reference is also made to the second paragraph. Article 82 Act no. 88/2008 on the handling of criminal cases, which stipulates that it is permitted to record sound, take pictures of people and monitor them for the purpose of investigations in public or in places to which the public has access without the conditions of Art. and the first paragraph. Article 84 the same law is complied with. It is based on the fact that the processing of personal data by the police takes into account the duties and role of the police authorities as defined in the second paragraph. Article 1 Police Act no. 90/1996. The police in the capital area have extensive responsibilities under police law, such as safeguarding public safety, maintaining law and order, as well as ensuring the legal security of citizens. The police are also intended to work to expose crimes, stop illegal conduct and follow up cases in accordance with what is laid down in the Criminal Procedure Act or other laws. maintain law and order as well as ensure the legal security of citizens. The police are also intended to work on the whistleblowing of crimes, stop illegal conduct and follow up cases in accordance with what is laid down in the Code of Criminal Procedure or other laws. maintain law and order as well as ensure the legal security of citizens. The police are also intended to work on the whistleblowing of crimes, stop illegal conduct and follow up cases in accordance with what is laid down in the Code of Criminal Procedure or other laws.

The purpose of using the witness equipment and body cameras and consequently the processing of the information is, among other things, to fulfill these legal obligations, cf. 3. tölul. Paragraph 1 Article 9 Privacy Act no. 90/2018. The purpose is to obtain better evidence and thus increase the quality of investigations, increase the likelihood that criminals can be identified and shed light on the facts of the case when there is a dispute over a description of an incident on the scene. The office's rules of procedure for the testimony, [...], stipulate that when the instrument is used, it shall notify the person who interferes that the apparatus is in operation.

The police's answers state that in the first incident complained of, which took place [...] in 2017, the recording is only limited to what was in front of the police car, and not when the complainant had entered the police car. The recording is silent but clearly stated in a police report, dated. [...] 2017, that the complainant had been informed that a recording of audio and video was in progress. In the second incident, which took place [...] 2018, there is a video recording but the recording was missing and therefore it is not possible to verify what took place between the police officers and the complainant. However, the documents in the case do not state to the police that the complainant was not informed that the recording of the audio and video was in progress. The third incident, which took place [...] in 2018, involved a [police car that] is not equipped with witnesses.

II.
Assumptions and conclusion

1.
Delimitation of a case
The complaint under discussion in this case relates on the one hand to the processing of personal information about the complainant by the police in the capital area and on the other hand to the fact that the police officers' working methods with the complainant have violated the General Penal Code no. 19/1940 and the Police Act no. 90/1996. In view of the powers of the Data Protection Authority, this ruling is limited to the processing of personal information by the police in the capital area. The ruling therefore does not cover whether the police officers have in their work violated the Penal Code or the Police Act in the incidents to which the complaint relates, as its resolution falls outside the scope of the Data Protection Authority.

This ruling does not apply to the incident complained of and which took place [...] 2018. In that case, it was a police car that is not equipped with audio and video recording equipment. It was therefore not a case of processing personal information that falls within the remit of the Data Protection Authority for resolution, and that part of the complaint is therefore dismissed.

The complaint only covers audio and video recordings in police cars, but the answers of the police in the capital area also relate to the arrangements and rules regarding body cameras. In view of the fact that a complaint is limited to audio and video recordings in police cars, this ruling is limited to the subject of the complaint.

2.
Scope - legal transposition - responsible party
The first incident covered by this ruling occurred before the entry into force of the current Act, no. 90/2018, on personal protection and the processing of personal information, on 15 July 2018. The coverage and content of this ruling in this case is therefore based on the provisions of the previous Act, no. 77/2000, on personal protection and handling of personal information.

Scope of the Old Personal Data Protection Act, no. 77/2000, Coll. Paragraph 1 Article 3 of that Act, and thereby the powers of the Data Protection Authority, cf. Paragraphs 1 and 2 Article 37 of the Act, covered any electronic processing of personal information, as well as manual processing of such information, which were or were to become part of a file.

According to para. Article 3 Act no. 77/2000, certain provisions of the Act did not apply to the processing of personal data concerning the activities of the state in the field of penitentiary, including the provisions of Art. on the complainant's right to information. However, it should be noted that according to Art. the then valid regulation no. 322/2001, on the processing of personal data by the police, set on the basis of the third paragraph. Article 45 Act no. 77/2000, it applied to the electronic processing of personal information by the police for the benefit of police work. In Article 8 of the Regulation provides for the right to information of individuals. According to the provision, the data subject had the right to be informed of what information about him is or has been processed, the purpose of the processing and who receives, has received or will receive information about him.

The latter incident occurred after the entry into force of the current Act, no. 90/2018 on personal data protection and processing, which entered into force on 15 July 2018. The Act also enacted Regulation (EU) 2016/679 (the General Data Protection Regulation), as amended and incorporated into the EEA Agreement.

According to para. Article 4 Act no. 90/2018, the Act and Regulation (EU) 2016/679 do not apply to the processing of personal data by the state in preventing, investigating, prosecuting or prosecuting criminal offenses or enforcing criminal sanctions. On the other hand, it should be noted that when the incident took place on [...] 2018, certain provisions of the Act on the Processing of Personal Data that concerned the state's activities in the field of penitentiary applied, cf. Provisional Provisions III, including Articles 3 and 39 and Article 42. their. The provisions of Article 17 of the Act, which stipulates the right of access and information of individuals, was, on the other hand, not among the provisions that applied to such processing.

According to Temporary Provision II in Act no. 90/2018, hold regulations issued by the Minister on the basis of the previous Act no. 77/2000 on personal protection and handling of personal information, its validity does not contravene Act no. 90/2018 or Regulation (EU) 2016/679. In comments on the provision in the bill that became Act no. 90/2018 states that this is a collection of rules, some of which are of great significance, such as Regulation no. 322/2001.

It follows from the above that with regard to the latter incident, the complainant's right to information according to Regulation no. 322/2001.

According to the first paragraph. Article 39 Act no. 90/2018, the Data Protection Authority supervises the implementation of those Acts, Regulation (EU) 2016/679, special provisions in laws dealing with the processing of personal data and other rules on the subject, cf. a similar provision in the first paragraph. Article 37 Act no. 77/2000. It follows from this provision that when both the incidents complained of took place, Regulation no. 322/2001 and the Data Protection Authority supervised its implementation.

The person responsible for the processing of personal information complies with Act no. 90/2018 is named the responsible party. According to item 6 of Article 3. of the Act refers to an individual, legal entity, government authority or other party who decides alone or in collaboration with other purposes and methods of processing personal information, cf. Point 7 of Article 4 of the Regulation, cf. and a similar provision in point 4 of Article 2. older law no. 77/2000. As such, the police in the capital area are considered to be responsible for the processing in question.

3.
Legality of processing
All processing of personal data must be based on one of the sources specified in Article 9. Act no. 90/2018, on personal protection and the processing of personal information, cf. Paragraph 1 Article 8 Act no. 77/2000. In the case under discussion here, Article 9, point 3, is the most important consideration. Act no. 90/2018, Coll. before point 3 of the first paragraph. Article 8 Act no. 77/2000. According to that provision, personal data may be processed in order to fulfill a legal obligation that rests with the responsible party.

In addition to relying on adequate authorizations under the Personal Data Protection Act, all processing of personal data must also comply with all the principles of the Act, including that they are processed in a lawful, fair and transparent manner towards the data subject, cf. 1. tölul. Paragraph 1 Article 8 Act no. 90/2018, Coll. and point 1. Paragraph 1 Article 7 Act no. 77/2000.

As stated above, the complainant's right to information, including the police's obligation to provide information according to Regulation no. 322/2001 on the processing of personal information by the police. According to Art. the data subject has the right to be informed of what information about him is or has been processed, the purpose of the processing and who receives, has received or will receive information about him.

There are also rules of procedure for the police in the capital area regarding the handling of so-called witness equipment. According to Art. of these rules, the police shall make it clear to those who are involved in the recording, as soon as circumstances allow, that equipment is used for audio and / or video recording. The rules of procedure thus assume that the person in question is provided with information and training that certain processing of personal information takes place with certain equipment.

By Act no. 90/2018 imposes an increased and independent obligation on the responsible party, which means that the responsible party is responsible for ensuring that the processing of personal information always complies with the principles of the data protection legislation and he shall be able to demonstrate this, cf. Paragraph 2 Article 8 Act no. 90/2018. Personal information shall be processed in a lawful, fair and transparent manner towards the data subject, cf. 1. tölul. Paragraph 1 Article 8 Act no. 90/2018. The precondition for processing to be considered fair according to the above is that it is transparent to the data subject, which includes requirements for the data subject to know about the processing and receive information about it. As stated above, the complainant had the right to know about the processing of personal information about him in accordance with Article 8. of Regulation no. 322/2001, Coll. Provisional Provision II of Act no. 90/2018.

With regard to the previous incident covered by this ruling, dated [...] 2017, it has been stated in the responses of the responsible party that the recording was tied to what was in front of the police car but is not a recording of when the complainant had entered the car. Then the recording was silent. A police report which is one of the documents in the case, and on which the police department is based, states that the complainant was informed that the recording of audio and video was taking place. Therefore, in the opinion of the Data Protection Authority, it will be considered that the complainant was provided with the knowledge to which he was entitled according to Art. Article 8 of Regulation no. 322/2001 on the processing of personal information by the police.

As for the latter incident, dated [...] 2018, it has been revealed that a video recording took place in the police car when the complainant was in it, but an audio recording is missing. The police do not have any evidence to show that the complainant was informed that the recording was made on audio and video. It is therefore not possible to establish what took place between the police officers and the complainant. The police in the capital area will be considered to have to bear the brunt of not being able to show that the knowledge has been provided. For that reason, the Data Protection Authority considers that the liability of the police in the capital area, cf. Paragraph 2 Article 8 Act no. 90/2018 has not been fulfilled.

Therefore, in the opinion of the Data Protection Authority, it will be considered that the complainant was not provided with the knowledge to which he was entitled according to Art. Article 8 of Regulation no. 322/2001 on the processing of personal data by the police when the incident [...] 2018 took place. It is also the opinion of the Data Protection Authority that the responsible party has not shown that the processing of personal data in question has complied with the principles of the first paragraph. Article 8 Act no. 90/2018, Coll. Paragraph 2 the same provision.

In view of the above, the conclusion of the Data Protection Authority is that the processing of the complainant's personal information about the complainant by the police in the capital area on [...] 2017 was in accordance with Act no. 77/2000 on personal protection and handling of personal information and Regulation no. 322/2001 on the processing of personal information by the police.

However, the processing by the police in the capital area of ​​personal information about the complainant on [...] 2018 did not comply with Act no. 90/2018, on personal protection and processing of personal information and Regulation no. 322/2001 on the processing of personal information by the police.


Ú r s k u r ð a r o r ð:
The aspect of complaint [A] relating to an incident on [...] 2018 is dismissed.

The processing of personal information about [A] by the police in the capital area by the police in the capital area on [...] 2017 was in accordance with Act no. 77/2000 on personal protection and handling of personal information and Regulation no. 322/2001 on the processing of personal information by the police.

The processing by the police in the capital area of ​​personal information about [A] on [...] 2018 was not in accordance with Act no. 90/2018, on personal data protection and processing, and Regulation no. 322/2001 on the processing of personal information by the police.


In Privacy, March 1, 2021


Helga Þórisdóttir Vigdís Eva Líndal