Rb. Noord-Nederland - 22-3460
Rb. Noord-Nederland - 22-3460 | |
---|---|
Court: | Rb. Noord-Nederland (Netherlands) |
Jurisdiction: | Netherlands |
Relevant Law: | Article 5 GDPR Article 6(1)(f) GDPR |
Decided: | 09.01.2025 |
Published: | 14.01.2025 |
Parties: | |
National Case Number/Name: | 22-3460 |
European Case Law Identifier: | ECLI:NL:RBNNE:2025:83 |
Appeal from: | Autoriteit Persoonsgegevens |
Appeal to: | |
Original Language(s): | Dutch |
Original Source: | Rechtbank Noord-Nederland (in Dutch) |
Initial Contributor: | elu |
A court reduced a fine by the DPA concerning the controller’s live streaming of a village from €500 to €375. The reason for the reduction of the fine was the excessive duration of the procedure, i.e. almost 4.5 years.
English Summary
Facts
An individual, the controller, broadcasted a live stream with a video footage, installed on their initiative, of their village on their website. This livestream was taken with two cameras and broadcasted on the controller´s website.
Multiple data subjects advanced complaints before the DPA due to the filming of private houses in the controller´s livestream.
Consequently, the DPA started an investigation and, eventually, imposed a fine of €500 to the controller due to the lack of a legal basis for the processing as per Article 5(1)(a) and 6 GDPR.
The DPA upheld the decision after the controller´s objection.
Thus, the controller appealed the decision in front of the Rechtbank Noord-Nederland (hereinafter: District Court) and argued that the processing activity could be based on an legitimate interest in accordance with Article 6(1)(f) GDPR.
Holding
The District Court admitted the appeal to the DPA decision.
Data processing under Article 6(1)(f) GDPR
The District Court started its analysis by stating that it is undisputed that personal data was processed. The controller claimed that the processing was based on a legitimate interest as per Article 6(1)(f) GDPR. The controller listed different legitimate interests at stake in the case at hand:
- The controller ´s own interest to promote the old village, national monuments and iconic buildings;
- Different local authorities´ interest to attract tourists for economic gains,
- The interest of the Municipality of De Fryske Marren as the municipality´s bridge operator uses the live stream when operating bridges;
- The neighborhood police officer´s interest in using the live stream to determine the duty rooster;
- The social interest of sick, elderly and interested people at home to watch the activity in the centre from home. To support this claim, the controller brought a petition of 941 people asking to keep the live streaming going.
- Third parties´ interest to maintain public order and safety through the processing.
On the other hand, the data subject who advanced the complaint considered that, even with the legal basis of Article 6(1)(f) GDPR, should be ceased due to their objection to it.
The District Court considered that, as considered in C-252/21 - Meta Platforms and Others, this ground of justification must be interpreted restrictively, as the processing of personal data on this ground may be lawful without a data subject's consent to the processing of personal data.
The District Court approached the applicability of Article 6(1)(f) GDPR with a three tier step analysis:
1. The interest pursued by the controller is a legitimate interest
The District Court considered all the aforementioned legitimate interests claimed by the controller. The District Court agreed with all the findings of the DPA on the legitimate grounds listed by the controller.
2. The processing of the personal data is necessary to serve that legitimate interest
The District Court considered that, it stems from C- 634/21 SCHUFA and C-252/21 - Meta Platforms and Others, that, when assessing the data processing´s necessity to pursue a legitimate interest, a court must consider whether the alleged legitimate interest that exists in data processing cannot reasonably be achieved by means less prejudicial to the fundamental rights laid out in Article 7 and 8 Charter of Fundamental Rights of the European Union.
The District Court agreed with the DPA and considered that the continuous display of the home of data subjects on the live stream perceived by data subjects as a major invasion of their privacy, which “makes them feel fearful and unsafe”.
By broadcasting the live stream, the controller violated the right to respect for private life and the right to protection of personal data of residents displayed on the live stream.
The District Court found that the right to personal data protection of data subjects recognizable while they were in public space was infringed. This infringement is less intrusive than the infringement of the fundamental rights and freedoms of residents of houses depicted on the live stream.
3. A balance between the interests of the controller and the data subjects must be struck
In C-252/21 - Meta Platforms and Others, the CJEU considered that the condition that the interests or the fundamental rights and freedoms of the data subject must not override the legitimate interest of the controller.
The District Court agrees with the DPA and considers that the interests, fundamental rights and fundamental freedoms of the persons involved in the data protection outweigh the legitimate interest of the controller. Particularly important is that the infringement of the right to respect for private life and the right to personal data protection is systematic, intrusive and extensive.
The District Court found that the legitimate interests pursued by the claimant and third parties are not proportionate to the nature of the interests infringed by the processing of personal data.
To conclude, the District Court considered that Article 6(1)(f) GDPR cannot be considered a relevant legal basis for the data processing by the controller. Moreover, the District Court considered it appropriate for the DPA to impose a fine.
Amount of the Administrative Fine and Duration of the Procedure
However, the controller also advanced a claim for the mitigation of the administrative fine as it constantly cooperated with the DPA´s investigation. However, the District Court agreed with the amount of the fine imposed.
Alongside this claim for a fine reduction, the controller argued that the duration of the procedure exceeded the reasonable time period (as decided in Raad van State 201805612/1/V6 ECLI:NL:RVS:2019:3203). In fact, the proceedings began with the first request for enforcement in 2016, while the intention to proceed with enforcement happened in August 2019, for a total of four years and five months. The District Court considered that the reasonable time for proceedings is generally two years, meaning that in the case at hand, the proceedings has exceed the reasonable time limit for two years and five months.
Therefore, the District Court considered the appeal on this point well-founded and annuls the decision of the DPA of fining the controller €500, and, instead, imposes a fine of €375 to the controller.
Furthermore, the District Court orders the DPA to reimburse the controller a court fee of €365 and to cover their legal costs, amounting to €3,174.50.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Authority Rechtbank Noord-Nederland Date of ruling 09-01-2025 Date of publication 14-01-2025 Case number 22-3460 Areas of law Administrative law Special features First instance - multiple Content indication GDPR. Enforcement. Imposition of administrative fine and order subject to penalty for the unlawful processing of personal data by means of broadcasting a livestream with images of a village centre. Sources Rechtspraak.nl Enriched judgment Judgment COURT OF NORTH NETHERLANDS Headquarters Groningen Administrative law case number: LEE 22/3460 judgment of the multi-member chamber of 9 January 2025 in the case between [plaintiff] , [place of establishment] , plaintiff (authorized representatives: Mr. E.E. Troll and Mr. R. van Es), and the Dutch Data Protection Authority, the AP (authorized representatives: Mr. W. van Steenbergen and Mr. O.S. Nijveld). The following third parties are participating in the case: [third party 1] and [third party 2] from [place of residence] (authorized representative: Mr. A. van Beelen). Introduction 1. In this ruling, the court assesses the claimant's appeal against the imposition of an administrative fine and a penalty payment order for a violation of the General Data Protection Regulation (the GDPR). 1.1. With the decision of 9 July 2021, the AP imposed an administrative fine of €500 and a penalty payment order on the claimant. With the contested decision of 11 August 2022, the AP upheld this decision. 1.2. The AP responded to the appeal with statements of defence. 1.3. The claimant submitted additional grounds. 1.4. Third parties also responded in writing. 1.5. The court heard the appeal at a hearing on 9 October 2024. The following participated: the claimant, represented by [person concerned 1] and [person concerned 2], the claimant's representatives, the AP's representatives and third parties and their representatives. Facts and formation of the decision 2. The claimant broadcast a live stream with video images of the village centre of [place] on a website belonging to it. The video images were broadcast with a delay of approximately one minute and were made with two fixed cameras placed at the initiative of the claimant. The first camera was attached to the [building] as of 15 November 2014 and this camera recorded the through waterway “ [waterway] ” in [place]. The second camera was connected to a building located at [address] in [place] as of 1 June 2016 and this camera recorded images of “ [the harbour] ”. 2.1. On 13 October 2016, third parties submitted an enforcement request to the AP, because they believe that the claimant is unlawfully processing (her) personal data by broadcasting the live stream. According to third parties, it is important that the front view of their home and their sailing boat in the harbour are shown on the livestream. The AP rejected this enforcement request by decision of 26 January 2017. 2.2. On 1 November 2018, the AP received an enforcement request (complaint) about the livestream from a resident of a home that is also shown on the livestream. 2.3. On 25 March 2019, third parties submitted a new enforcement request (complaint) to the AP about unlawful processing of personal data by the claimant. 2.4. On 28 March 2019, the AP informed the claimant that, following the receipt of complaints, it had started an investigation to determine whether the claimant had lawfully deployed two cameras. The AP gave the claimant the opportunity to indicate on the basis of which processing basis from the GDPR it processes personal data.1 2.5. In the investigation report of 2 July 2019, the AP concluded that the claimant unlawfully processes personal data by broadcasting the livestream. 2.6. On 28 August 2019, the AP informed the claimant that it intends to impose an administrative fine of €500 and a penalty payment order for the unlawful processing of personal data. 2.7. In the decision of 9 July 2021, the AP imposed an administrative fine of €500 and a penalty payment order on the claimant for the unlawful processing of personal data in the period from 21 February 2019 to 9 July 2021. According to the AP, it is important for this that the claimant cannot rely on one of the processing grounds required in the GDPR for the processing of the personal data.2 2.8. In the contested decision of 11 August 2022, the AP declared the claimant's objection unfounded. The claimant appealed against this decision. 2.9. On 9 August 2022, the AP informed the claimant that it intended to collect the penalty. 2.10. On 6 September 2022, the claimant stopped broadcasting the livestream. 2.11. On 16 September 2022, the AP informed the claimant that, as a result of the termination of the livestream, and thus the termination of the processing of personal data, the AP would not collect the penalty of €2,000. Assessment by the court 3. The court is of the opinion that the AP was right to conclude that the claimant had processed personal data unlawfully. However, the court does pass over a lack of motivation in the contested decision.3 In addition, the court rules that the claimant's appeal is nevertheless well-founded, because the reasonable term for handling the appeal has been exceeded. In view thereof, the court reduces the administrative fine imposed on the claimant. The claimant will also receive compensation for her legal costs due to the passing of the lack of motivation and the exceeding of the reasonable term. The court will explain below how it arrived at this conclusion and what the consequences of this conclusion are. Authority to lodge an appeal 4. The court considers that the claimant's board confirmed the appeal lodged by [person concerned 1] by letter dated 10 July 2023. In view thereof, there are no grounds for the conclusion that the appeal was lodged on behalf of the claimant, given its articles of association, by a director who was not authorised to do so independently. Inability to pay court fees 5. The claimant has requested exemption from payment of the court fees due to inability to pay. To this end, she has stated that she has €500 at her disposal and that other income is only obtained through donations and sponsorship for the projects organised by the claimant. 5.1. The court sees no grounds in the claimant's argument for granting the appeal based on inability to pay. The documents submitted by the claimant do not show that she is unable to pay the court fee. The fact that the claimant wishes to spend her financial resources on projects organised by her cannot in itself lead to that conclusion either. Since the claimant has paid the court fee after the provisional rejection of the appeal based on inability to pay by the court clerk's letter of 13 January 2023, the rejection of the request does not prevent the substantive assessment of the appeal. 5.2. The court rejects the appeal based on inability to pay for the court fee. Procedural interest in penalty payment order 6. With the primary decision of 9 July 2021, the AP imposed a penalty payment order on the claimant aimed at ending the unlawful processing of the personal data by means of broadcasting the livestream. The AP has attached a four-week grace period to this order. For each week that the claimant has not complied with the order after this period, she will forfeit €500, up to a maximum of €2,000. With the contested decision, the AP has upheld this order. 6.1. The court is faced with the question of whether the claimant has a procedural interest in the assessment of the penalty payment order on appeal, because the AP waived the collection of the penalty payment by e-mail of 16 September 2022. The court answers this question in the affirmative, because the AP stated at the hearing, when asked, that the penalty payment will still be collected when it is established that the order may be imposed and when the claimant resumes the livestream. In view of this, the court is of the opinion that the assessment of the imposition of the order subject to penalty payment is of factual significance for the claimant.4 The dispute 7. The parties do not disagree on the fact that the claimant, in its capacity as controller, has processed personal data by broadcasting the livestream. It is important for this that persons and homes in the village centre of [place] were recognisably shown when broadcasting the livestream on a website belonging to the claimant. However, the parties are divided on the question of whether the claimant can rely on a basis from the GDPR for this processing of personal data that makes the processing of personal data permitted. Has the claimant unlawfully processed personal data? 8. In the contested decision, the AP, also referring to the investigation report of 2 July 2019, determined that the claimant unlawfully processed personal data by broadcasting the livestream on a website belonging to it. To this end, the investigation report states that the AP recorded weekly images of the livestream in the period from 21 February 2019 to 14 March 2019. According to the AP, these images show people and surrounding homes. The people shown can be recognised and identified on the basis of these images. According to the AP, this recognisability is increased by the fact that the livestream is situated in a village with more than 10,000 inhabitants. Part of the private lives of the residents of homes shown on the livestream are also broadcast with the livestream. The AP also determined that both the website on which the livestream is broadcast and another website of the claimant do not have a privacy policy. According to the AP, the claimant cannot rely on one of the processing grounds mentioned in Article 6, paragraph 1, of the GDPR for the processing of personal data that takes place when broadcasting the livestream.5 8.1. The claimant states that the processing of personal data is lawful because she and third parties have a legitimate interest in the processing of personal data as referred to in Article 6, first paragraph, opening sentence and under f, of the GDPR. The processing is also necessary for the protection of these interests and the required balancing of interests, according to the claimant, is also in her favour. For that reason, the administrative fine and order subject to penalty payments were wrongly imposed. The claimant has explained that, partly in view of this, she wishes to resume broadcasting the livestream. 8.1.1. According to the claimant, the legitimate interest consists primarily of her own interest in promoting [place], in particular the old village centre, the national monuments and the iconic buildings. The claimant also states that she is protecting the legitimate interests of third parties. These interests consist primarily of the interest that the [place] Entrepreneurs' Association, the Hospitality Promotion Foundation, VVV Waterland van Friesland, the province of Friesland and the [place] Business Association also have in promoting [place]. These promotional interests are aimed at attracting tourists for the sake of economic gain. Secondly, the claimant states that it represents the interests of the municipality of De Fryske Marren, because the bridge keeper of this municipality uses the livestream when operating the bridges. In support, the claimant refers to the decision of 25 March 2014, with which the board of mayor and aldermen of the municipality of De Fryske Marren granted the claimant a subsidy of €2,000 for the installation of the camera at the [building]. Thirdly, the local police officer has an interest in the processing, because the livestream enables him to determine the duty roster based on the current image in the village centre. Fourthly, the livestream enables the sick, the elderly and interested parties at home and abroad to view the image of and the events in the village centre from home. In this way, the livestream meets a social need of those who are in isolation, those who do not have the possibility to come to [place] and those who wish to view the activity in the centre from home. In support of this interest, the claimant refers to a petition signed by 941 people that aims to continue the livestream and e-mails addressed to the claimant with a similar content. Finally, third parties have a legitimate interest in the processing because the maintenance of public order and safety, the prevention of vandalism and the orderly course of shipping traffic benefit from – the preventive effect that emanates from – the broadcasting of the livestream. 8.2. Third parties argue that the claimant must cease processing personal data on the basis of Article 6, first paragraph, opening sentence and under f, of the GDPR if data subjects, such as third parties, object to that processing. This is only different if compelling legitimate grounds have been put forward that outweigh the interests, rights and freedoms of the data subject.6 According to third parties, there is no such (compelling) legitimate interest. The promotional interests of the claimant and third parties can thus be equated with the economic interest in advertising and thus the interest in “direct marketing”. Third parties point out that, as data subjects, they have an absolute right to object to processing for the purpose of direct marketing.7 This also means that the personal data may no longer be processed for the interests pursued by the claimant. 8.3. The court considers that the GDPR provides that the principles regarding the processing of personal data, insofar as relevant here, entail that personal data must be processed in a manner that is lawful, fair and transparent with respect to the data subject. Personal data must also be collected for specific, explicit and legitimate purposes and may not be further processed in a manner that is incompatible with those purposes. Furthermore, the processing of personal data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed.8 The controller is responsible for compliance with these principles and has an accountability obligation with respect to that compliance.9 8.4. It also follows from the GDPR that the processing of personal data is only lawful if at least one of the conditions mentioned in Article 6 of the GDPR is met. One of these conditions is that the processing of personal data is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.10 8.4.1. It follows from the judgment in Meta Platforms and Others of the Court of Justice of the European Union (CJEU) that this justification must be interpreted restrictively, as the processing of personal data on this ground can be lawful without a data subject having given consent to the processing of personal data.11 8.4.2. For this article to be successfully invoked, three conditions must therefore be met. The first step is that the interest pursued by the controller is a legitimate interest. If this is the case, it must then be assessed whether the processing of the personal data is necessary for the purposes of that legitimate interest (the second step). This involves testing proportionality and subsidiarity: is the infringement for the data subjects in proportion to the purpose to be served by the processing and can the purpose be achieved in a less detrimental way for the data subjects? The third step is that a balance must be struck between the interests of the controller and the data subjects.12 8.4.3. It is primarily up to the controller to state what the interest in the processing is, why the processing is necessary and that he must act accordingly. It is up to the AP to assess what the controller actually does, to see whether the stated interests correspond with this and are actually served by the processing and whether these are justified. The AP must carry out this test in the first step.13 Step 1 9. The claimant first argues that the AP wrongly failed to take into account all the interests represented and submitted by the claimant in the assessment in step 1. According to the claimant, the AP only recognised the claimant's promotional interest in the contested decision. According to the claimant, the assessment in step 1 was therefore incomplete. Referring to a ruling by the Division, the claimant states that the imposition of the administrative fine and the order subject to penalty payments cannot be upheld for that reason alone.14 9.1. The AP states that the interests that the claimant can in principle represent have been taken into account in the contested decision. According to the AP, this concerns – in short – the promotional interest of the claimant and third parties and the social interest of third parties. 9.2. The court is of the opinion that the AP, in its assessment of step 1 in the contested decision, took into account all the interests that the claimant can in principle represent. To this end, the court considers the following. 9.3. The claimant argues that the interests of government agencies that are represented by the claimant were wrongly not recognized by the AP in the contested decision. According to the claimant, the fact that a government agency cannot rely on the basis from Article 6, first paragraph, opening sentence and under f, of the GDPR when processing personal data does not exclude that it can promote the interest of that government agency by relying on this processing basis. According to the claimant, it is only important on which processing basis it can rely with regard to the personal data that it processes. In support of this, the claimant refers to an opinion of the Article 29 Working Party (WP29) from 2014 on the interpretation of the concept of a “legitimate interest” as included in a provision preceding Article 6, paragraph 1, opening sentence and under f, of the GDPR.15 According to the claimant, this opinion does not imply that the interests of government agencies, being a third party as referred to in the definition included for this purpose in the GDPR, cannot constitute a legitimate interest where these interests are served by a controller who can itself invoke the application of Article 6, paragraph 1, opening sentence and under f, of the GDPR.16 9.3.1. In the court’s opinion, the AP was right not to take into account the interests that government agencies have in the processing of personal data by the claimant in the assessment in the first step. It follows from Article 6, paragraph 1, of the GDPR that government bodies cannot rely on the processing basis in Article 6, paragraph 1, opening sentence and under f, of the GDPR with regard to the lawfulness of the personal data processed by them in the context of the performance of their tasks. In view thereof, the systematics of the GDPR, in the opinion of the court, prevent the claimant from representing the interests of those government bodies by relying on this processing basis in order to arrive at a lawful processing of personal data. It is also important in this respect that government bodies must rely on the processing basis in Article 6, paragraph 1, opening sentence and under e, of the GDPR. That article provides a narrower definition of the interests that may be a reason for arriving at a lawful processing than Article 6, paragraph 1, opening sentence and under f, of the GDPR. Contrary to what the claimant argues, the court sees no grounds in the opinion of WP29 for a different judgment. The fact that this opinion does not explicitly exclude the possibility that private controllers can represent the interests of government bodies by invoking Article 6, paragraph 1, opening sentence and under f, of the GDPR is, also in view of the above, not sufficient. 9.3.2. In view of the foregoing, the claimant's argument that the AP wrongly considers it important that its articles of association also stand in the way of promoting the interests of government agencies does not require further discussion. The same applies to the claimant's position that the AP wrongly stated that these interests must be expressly assigned to it before it may promote that interest and to the argument that the AP wrongly stated that the claimant has not complied with this with regard to the interests of government agencies that it promotes. 9.3.3. Taking into account the foregoing, the AP has rightly excluded the interests of third parties put forward by the claimant, consisting of the interests of the local police officer, the bridge keeper of the municipality of Fryske Marren, the province of Friesland and the government agencies whose task it is to maintain public order and safety, from the assessment in the first step. 9.4. The claimant has further stated that the importance of shipping traffic has not been sufficiently recognised by the AP. This shipping traffic uses the livestream to check whether there are berths available in the port. 9.4.1. The court notes that the claimant has put forward the interest of the shipping traffic for the first time in the appeal. The claimant has not disputed this with reasons. For that reason, this argument cannot lead to the conclusion that the AP wrongly left this interest out of the assessment in step 1 in the contested decision. 9.4.2. Regarding the question of whether the court can nevertheless take this interest into account in the appeal when assessing whether the claimant has a legitimate interest in the processing of personal data, the court considers the following. The GDPR stipulates that the purposes of the processing must already be specifically and explicitly described and justified at the time of collecting personal data. Personal data may also not be further processed in a manner that is incompatible with those purposes.17 It also follows from the GDPR that insofar as personal data are collected directly from a data subject (which is not the case with the claimant), when obtaining the personal data, the controller must provide the data subject with information about the legitimate interests of the controller or of a third party if the processing is based on Article 6, first paragraph, opening sentence and under f, of the GDPR.18 In the court's opinion, it can be inferred from this that only interests that are actually and clearly represented to the data subjects at the time of processing can be taken into account when assessing whether a successful appeal can be made to this processing basis. 9.4.3. The claimant has not complied with this by referring to the interest of shipping traffic. This interest was first stated by the claimant on appeal. It has not been demonstrated that the claimant actually and clearly represented this interest to the data subjects at the time of the processing of personal data in the period for which the violation was established. For that reason, the court will disregard this stated interest in the further assessment of the question of whether the claimant can successfully invoke Article 6, first paragraph, opening sentence and under f, of the GDPR. 9.5. The court further notes that the AP stated in the contested decision that the claimant, given the explanation it provided, is pursuing the goal of displaying (promoting) atmospheric images live to as wide an audience as possible by processing personal data. In the contested decision, the AP, referring to the primary decision of 9 July 2021, considered that pursuing this objective in principle contributes to the claimant's promotional interests, which are aimed at attracting tourists, and that displaying those images – in extension of that – meets a social need.19 In the court's opinion, it follows from this that the AP took into account the claimant's promotional interests, the parallel promotional interests of third parties and the social interest of third parties in its assessment of steps 1 to 3. Also in view of the considerations under 9.3. and 9.4., the court finds that the AP has thus taken into account the interests that the claimant can in principle promote from the assessment of the first step. For that reason, there are no grounds for the judgment that the AP wrongly left interests put forward by the claimant out of the assessment (in a timely manner). The claimant's argument included under 9. is therefore unsuccessful. The court will assess whether that assessment holds up below. 9.6. With regard to the assessment in step 1, the claimant further argued that the AP wrongly concluded in the contested decision that it did not have a legitimate interest, on the grounds that the interests that the claimant represents are not legally enforceable. According to the claimant, the concept of legitimate interest should be interpreted more broadly and also includes commercial interests, to which the promotional interest of the claimant and third parties can in any case be equated. 9.7. In its appeal, the AP, referring to the judgment of the Court of Justice of the European Union in the Royal Dutch Lawn Tennis Association, adopted the amended position that the promotional interest of the claimant and third parties and the social interest of third parties are a legitimate interest as referred to in Article 6, first paragraph, opening sentence and under f, of the GDPR. In view of this judgment, according to the AP, it can no longer be stated that only a legally enforceable interest can be regarded as a legitimate interest.20 9.8. The court, like the AP, is of the opinion that the contested decision is inadequately motivated insofar as it states that the promotional interest of the claimant and third parties and the social interest of third parties are not a legitimate interest as referred to in Article 6, first paragraph, opening sentence and under f, of the GDPR. Contrary to what the claimant argues, the court sees reason to disregard this shortcoming by applying Article 6:22 of the General Administrative Law Act (the Awb). In this regard, the court considers the following. 9.8.1. In the contested decision, the AP, also referring to the primary decision of 9 July 2021, included considerations regarding the investigation into and assessment of steps 2 (necessity) and 3 (weighing of interests). According to the AP, the assessment of these steps, both viewed in isolation, shows that the claimant has processed personal data unlawfully. The court, in view of the considerations under 10. and 11., is of the opinion that the AP has made a correct assessment of these steps and has therefore rightly concluded that the claimant has violated the GDPR. The fact that the AP wrongly concluded in the contested decision that the claimant (also) does not comply with step 1 therefore does not lead to the conclusion that the claimant has lawfully processed personal data and that there has been no violation. 9.9. The claimant's argument that steps 2 and 3 cannot be assessed because no investigation was conducted into steps 2 and 3 in the investigation report of 2 July 2019, fails. To this end, the court considers it important that the AP, in the contested decision, also referring to the primary decision of 9 July 2021, investigated and assessed steps 2 and 3. The court is also of the opinion that the investigation report meets the requirements set for it in the General Administrative Law Act.21 For example, the report contains a date, a statement of the name of the offender, the violation and the regulation violated and an indication of the place and time of the violation. The mere fact that the decision-making process following the investigation report included additional motivation and research with regard to steps 2 and 3 does not therefore in itself mean that the investigation report was drawn up in violation of the provisions of Article 3:2 of the General Administrative Law Act. It is also important that the AP has gathered sufficient knowledge with the investigation report about the manner in which the claimant processed personal data by establishing which images were broadcast by the claimant with the livestream in the period to which the violation established by the AP relates and what can be observed on those images. These findings in the investigation report have not been disputed by the claimant either. 9.9.1. The AP has further stated that the decisions that are before the Court in these appeal proceedings deviate from the decisions that were subject to assessment in the judgment of the Division and the District Court of Midden-Nederland in the (higher) appeal of VoetbalTV.22 The AP argues that it made an assessment of steps 2 and 3 in the decision-making that is at issue in these appeal proceedings, unlike in the decision-making in the cases of VoetbalTV. The court considers that whatever the AP's position may be, given the above considerations there are already no grounds for the conclusion that the contested decision was reached in a careless manner. 9.10. The claimant's position that it is not possible to assess steps 2 and 3 because the AP assessed steps 2 and 3 in a biased manner by already judging that step 1 is unsuccessful, is also unsuccessful. The mere fact that the AP also made an assessment of steps 2 and 3, after having judged that step 1 was unsuccessful, is not sufficient for this purpose. The claimant has not put forward any concrete points of reference with regard to which the AP shows bias in its assessment of steps 2 and 3. The court will assess below whether the AP was right to conclude that the processing of personal data is not necessary in view of the legitimate interests of the claimant and third parties and that the balancing of interests is also to the detriment of the claimant. Step 2 10. In the contested decision, the AP, referring to the reasoning in the primary decision of 9 July 2021, concluded that the processing of personal data is not strictly necessary for the protection of legitimate interests. It is important that the requirements of subsidiarity and proportionality are not met. In the primary decision, the AP considered that promoting the village of [place] and meeting the associated social need can also be achieved with less drastic means than continuously broadcasting a live stream. According to the AP, there are various (non) digital ways to promote the village without processing personal data. This could include promotion on the claimants' website and promotion through press and printed matter. To the extent that the claimant insists on the live stream, the cameras must be positioned in such a way that the promotion takes place without processing personal data. According to the AP, the processing of personal data is also not proportionate. To this end, it is important that personal data are continuously processed that can be followed live by everyone. According to the AP, this is not in reasonable proportion to the interests that the claimant serves with the processing. 10.1. The claimant is of the opinion that the processing of personal data is necessary for the interests it represents. Firstly, the livestream is necessary for the promotion of the village of [place], because it attracts tourism and increases economic well-being. According to the claimant, the livestream is the most effective means of representing this interest. Viewing the images contributes to the sense of community, helps to get a feel for the atmosphere and provides an up-to-date picture. According to the claimant, the livestream also creates a certain sense of urgency, which makes livestream viewers want to be part of what is happening in [place]. This attracts more attention than brochures with outdated photos. According to the claimant, this option reaches far fewer people. The cameras are placed at a great distance, cannot zoom in and do not record images. According to the claimant, this complies with the principle of minimal data processing. The livestream is also necessary for the sick, elderly and other residents and interested parties who cannot be physically present and are, for example, in social isolation. 10.2. The third party, together with the AP, takes the position that the processing of personal data is not necessary for the protection of legitimate interests. 10.3. It follows from the case law of the ECJ that, when assessing whether the processing of personal data is necessary for the protection of the legitimate interest, the court must examine whether the alleged legitimate interest in the processing of the data cannot reasonably be achieved just as effectively by other means that are less injurious to the fundamental rights and freedoms of the data subjects, in particular the right to respect for private life and the right to protection of personal data as guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (the Charter).23 The necessity of the processing must also be examined in conjunction with the principle of data minimisation.24 On the basis of that principle, personal data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed. 10.4. The court finds that the AP has rightly determined that the processing of personal data is not necessary for the legitimate interests pursued by the claimant. In doing so, the court attaches the following importance. 10.5. In the investigation report of 2 July 2019, the AP determined that the livestream, and also taking into account the quality of the video images broadcast, showed recognisable persons in public spaces. Because the livestream is situated in a village with over 10,000 people, the video images can be used to identify which persons are in the image. According to the AP, surrounding homes are also recognisably shown in the image. 10.6. In the contested decision, the AP, also referring to the primary decision of 9 July 2021, added that the manner in which personal data is processed constitutes an infringement of the personal privacy of the persons concerned. It is important to note that by broadcasting the livestream, part of the private lives of residents of homes shown on the livestream are visible to the claimant and third parties who watch the livestream. According to the AP, this constitutes a far-reaching form of processing personal data. Although no special personal data is processed, there is processing of sensitive personal data relating to the data subjects and their private lives. 10.7. The continuous display of – the coming and going to – the home of third parties on the livestream was experienced by third parties as a major invasion of their personal privacy. Third parties explain that they experience the fact that they can be continuously watched by everyone as frightening and unsafe. Third parties also note that they never requested the livestream, but that they are nevertheless confronted with the negative consequences thereof. Third parties emphasise that they did not agree to the claimant's proposal to blur or block the part of the image of the livestream on which their home is displayed. According to third parties, this method of displaying the video images has drawn even more attention to the home and to themselves. According to third parties, this is evident from the negative reactions and questions that they have received, partly as a result of the use of the blur screen that they did not want. 10.8. The court finds, also in view of the above, that the claimant has committed a far-reaching infringement of the right to respect for private life and the right to protection of personal data of residents of homes shown on the livestream by processing personal data by means of broadcasting the livestream. With regard to the claimant's argument that the blurred display of the home means that the fundamental rights and freedoms of the persons concerned are less infringed, the court considers as follows. The images included in appendix 10 of the investigation report of 2 July 2019 and appendix 2 to the response of third parties of 23 November 2021 in the objection show that the homes - of third parties, among others - were not (completely) vague, blocked or displayed as a black bar during the period for which the infringement was established. For that reason, the court sees no reason to assume that, as a result of the way in which the video image was set up, there has been a reduced infringement of the fundamental rights and freedoms of residents of homes shown on the livestream during the period in which the infringement was established. In this context, the court does take into account the declarations of no objection that were issued to the claimant by residents of homes shown on the livestream. However, that does not alter the fact that it has been demonstrated that the residents of at least two homes have made it known that they do not agree to their homes being shown. 10.8.1. The court also finds that the right to protection of personal data of data subjects who are recognisably shown while they were in public space has been infringed. This infringement is less intrusive than the infringement of the fundamental rights and freedoms of residents of homes shown on the livestream, because, unlike data subjects who are in their private home, one may not consider oneself (completely) unseen in public space. However, this does not alter the fact that the processing of personal data of these data subjects must also take place in a lawful, proper and transparent manner.25 10.9. In the court's opinion, the interests that the claimant pursues with the processing can reasonably be achieved just as effectively with other means that affect the rights and freedoms of others to a lesser extent. The AP rightly considered that drawing attention to (the events in) the village centre of [place] – for the purpose of attracting tourists and meeting social needs – can reasonably be achieved with a combination of many less drastic means. This includes in any case putting videos online or live streaming specific events that take place in [place] and, for example, promoting them by publishing press and printed matter. The court also attaches importance to the fact that the cameras can be adjusted in various less drastic ways. For example, by positioning the cameras in such a way that only the public space is shown or by displaying them so vaguely that individuals can no longer be identified from the images. 10.9.1. The court does not agree with the claimant that continuously broadcasting the livestream is the most effective means of promoting [location]. In this regard, it should be recalled that it is up to the claimant to prove that it collects personal data in a lawful, proper and transparent manner with regard to the data subjects.26 In view of this, it is up to the claimant to substantiate its claim that continuously broadcasting the livestream is necessary because this means best meets the interests it represents with concrete data. This single claim, also in view of the considerations under 10.9., therefore provides insufficient grounds for the conclusion that other and less drastic means are less effective when it comes to representing the legitimate interests of the claimant. 10.9.2. In assessing the necessity, the court also attaches importance to the fact that, in its opinion, the processing of personal data does not comply with the principle of minimum data protection. The processing of personal data, in particular where respect for the privacy of data subjects is at stake, is not relevant to the legitimate interests pursued by the claimant. According to the court, it is not clear that displaying parts of the private lives of data subjects is necessary for and contributes to the interests that the claimant pursues by drawing attention to the – events in the – village centre of [place] online. 10.10. The claimant's argument fails. Step 3 11. The claimant has stated that there is a great deal of consensus about and need for the livestream in [place] and far beyond. In support of this, the claimant has referred to a petition aimed at preserving the livestream that has been signed by 941 people. The claimant also refers to emails with questions about the reason why the livestream was terminated and whether it can be resumed. According to the claimant, it is also important that almost all residents of buildings shown on the livestream have given a written or oral statement of no objection. This shows that the use of the cameras is clearly recognized and expected in the community. According to the claimant, this broadly supported (general) interest should be given great weight. According to the claimant, this also follows from the opinion of WP29.27. On the other hand, the claimant, insofar as relevant here, has only received complaints from third parties. According to the claimant, the interests served by the processing therefore outweigh the individual interest of third parties. 11.1. The court considers that it follows from the judgment in Meta Platforms et al. of the CJEU that the condition that the interests or fundamental rights and freedoms of the person concerned by data protection may not outweigh the legitimate interest of the controller or a third party implies a balancing of the conflicting rights and interests involved that in principle depends on the circumstances of the specific case.28 11.2. The continuous broadcasting of the livestream has a systematic, intrusive and extensive character on the private lives of residents who object to their home being shown on the livestream. As considered in 10.8., this constitutes a far-reaching infringement of the right to respect for private life and the right to protection of personal data of these persons. In this regard, the AP also referred to a statement by a local resident who stated that she felt compelled to move because of the livestream, because the livestream facilitated her being followed by unwanted people. According to the AP, this underlines the risks and impact of streaming camera images on the lives of these data subjects and their interest in being protected from them. According to the AP, the fact that other residents have indicated that they have no objection to broadcasting the livestream does not detract from this impact. 11.3. As considered under 10.8.1., the right to protection of personal data of data subjects who are recognizably depicted while they were in public space has also been violated. First of all, this processing of personal data takes place without data subjects (being able to) give permission for this. The fact that data subjects are in public space does not mean that they reasonably expect their personal data to be processed by means of broadcasting a livestream. Despite the warning signs placed by the claimant, passers-by will not always be aware of the fact that they can be followed online by anyone. In view of this, there is no reasonable relationship between the controller and the data subject. This processing also does not take place in a lawful, transparent and proper manner for the data subjects. The fact that the processing only continues as long as someone is in the picture and that no further images are stored does indeed mitigate the consequences of the processing of these data subjects, but this does not eliminate the infringement of the protection of personal data of these data subjects. 11.4. On the other hand, it is also apparent from the petition and e-mails submitted by the claimant that broadcasting the livestream meets a broadly supported need for the livestream. This need exists on the one hand in the interest of the claimant and third parties to attract tourists and on the other hand in the social need to get a picture of what is happening in [place]. 11.5. In view of the above, the court, together with the AP, is of the opinion that the interests, fundamental rights and fundamental freedoms of the persons involved in data protection outweigh the legitimate interest of the claimant and third parties. Of particular importance in this respect is that there is a far-reaching infringement of the right to respect for privacy and the right to protection of personal data of data subjects. The legitimate interests pursued by the claimant and third parties are not in reasonable proportion to the nature of the interests that are infringed by the processing of personal data. 11.6. The claimant's argument fails. Conclusion 12. Taking into account the above considerations, the court is of the opinion that the AP was right to conclude that the claimant cannot rely on the processing basis from Article 6, first paragraph, opening sentence and under f, of the GDPR with regard to the personal data processed by it. The reason for this is that the processing of personal data is not necessary for the legitimate interests of the claimant and third parties and the legitimate interests of the claimant and third parties do not outweigh the interests of data subjects. For that reason, the AP has rightly determined that the claimant has violated the GDPR by unlawfully processing personal data.29 In view of this, the AP is authorized to take enforcement action by imposing an administrative fine30 and an order subject to penalty payments.31 Principle of trust 13. The claimant further argues that the AP has acted in violation of the principle of trust. According to the claimant, the AP made concrete and unambiguous commitments to her by rejecting the first enforcement request from third parties in the legally unassailable decision of 26 January 2017. In this decision, the AP states that it sees no reason to take enforcement action, because the claimant has taken additional measures by expanding the blur screen and it is not plausible that persons around the homes are recognizable in the image. According to the claimant, these commitments mean that the AP sees no reason for enforcement, also in view of the prioritization criteria applicable at the time, and that an investigation is only initiated in the event of many signals. According to the claimant, however, no relevant change in these circumstances has been demonstrated. 13.1. The court is of the opinion that the AP did not make any concrete and unambiguous commitments in the decision of 26 January 2017 regarding (not exercising) the authority to take enforcement action with regard to a (future) violation of the GDPR. It is important in this regard that the AP also considered in this decision that receiving many signals on the same subject could be a reason to (still) initiate an investigation. This explicitly leaves open the possibility that an investigation into the processing of personal data by the claimant will still be initiated in the future. In view of this, the appeal to the principle of trust cannot succeed. 13.2. The claimant's argument fails. Amount of the administrative fine 14. The claimant argues that, applying the Fine Policy Rules of the Dutch Data Protection Authority 2019 (the Fine Policy Rules), there is reason to reduce the amount of the administrative fine, because she has always cooperated with the AP's investigation by consulting about the blur screens and by proposing solutions such as making the images from the cameras more blurred.32 14.1. The court considers that the AP is authorised to impose an administrative fine for a violation of Article 6, paragraph 1, of the GDPR.33 Based on the Fine Policy Rules, a basic fine of €525,000 is imposed for a violation of Article 6, paragraph 1, of the GDPR.34 This basic fine is increased or reduced within the fine bandwidth of €300,000 and €750,000, depending on the extent to which the factors mentioned in the GDPR and the Fine Policy Rules have been met.35 In addition, an administrative fine can be further reduced if the offender has reduced or insufficient financial capacity.36 The AP has seen reason in the reduced financial capacity demonstrated by the claimant to set the administrative fine at a reduced amount of €500. 14.2. According to the case law of the Division, when exercising the power to impose a fine, an administrative body must adjust the amount of the fine to the seriousness of the violation and the extent to which it can be attributed to the offender.37 In doing so, the circumstances under which the violation was committed must be taken into account.38 The AP has established policy rules in which the fine amounts for the violations are laid down. Even if the court has not found the policy to be unreasonable, the AP must, when applying it in an individual case, assess whether that application is in accordance with the statutory requirements for the exercise of the power to impose fines referred to above. It must always be determined with regard to the fine, if necessary in addition to or in deviation from the policy, that it is proportionate. The court reviews the decision without reservation. 14.3. The court is of the opinion that the amount of the administrative fine imposed on the claimant is appropriate and necessary. The court does not follow the claimant's argument that application of the Fine Policy Rules should lead to a further reduction of the administrative fine, because the claimant cooperated with the AP. Third parties have repeatedly and consistently emphasized that the method proposed by the claimant to limit the infringement by applying the blur screen does not offer them a solution. Partly because the home only stands out more and the blurring results in more questions and (negative) comments. The extent to which the claimant cooperated with the AP has thus remained limited to the precondition that the claimant itself set, consisting of continuing to broadcast the live stream. In the court's opinion, a further reduction of the fine does not do justice to the impact of the infringement on those involved. 14.4. The claimant's argument fails. Duration of the procedure 15. The claimant takes the position that there has been an excess of the reasonable period as referred to in Article 6 of the ECHR, which should lead to a reduction of the administrative fine. In this regard, the claimant refers to the long duration of the procedure that commenced with the first request for enforcement in 2016 and the intention to proceed with enforcement of 28 August 2019. 15.1. The reasonable period commences at the moment that the administrative body concerned has performed an act with regard to the fined person from which the fined person could reasonably expect that a fine would be imposed on him. As a rule, an administrative body has only performed an act from which the fined person could reasonably expect that the administrative body would impose a fine on him with the fine notification. In the vast majority of cases, the day on which the administrative body makes this notification will therefore be considered the time at which the reasonable period commences.39 The court sees no reason to deviate from this principle in this appeal. This means that the reasonable period in these proceedings commenced on 28 August 2019, the day on which the intention to enforce was announced to the claimant. 15.2. The starting point for the settlement of a dispute about a punitive sanction in a single judicial body is that this will in principle take place within a reasonable period, if the entire procedure has not lasted more than two years. This procedure ended with this ruling. This means that the procedure has lasted four years and five months. The court is of the opinion that there are no circumstances that should lead to an extension of the reasonable period. This means that the reasonable period has been exceeded by two years and five months. Because the administrative fine is less than €1,000 and the reasonable term has been exceeded by more than twelve months, the court will act as it deems appropriate to reduce the fine in this case due to the exceeding of the reasonable term.40 15.3. The court considers it appropriate and necessary to reduce the administrative fine in this case by 25% due to the exceeding of the reasonable term. This results in a reduction of the administrative fine by €125. 15.4. The argument is successful. Conclusion and consequences 16. The claimant's appeal is well-founded due to the exceeding of the reasonable term for the trial. The court therefore annuls the contested decision insofar as the amount of the administrative fine is set at €500. The court leaves the contested decision in place for the rest, whereby it disregards the established lack of motivation in the contested decision, applying article 6:22 of the General Administrative Law Act. 16.1. The court now makes its own decision, applying article 8:72, third paragraph, opening sentence and under b, of the General Administrative Law Act (Awb), and determines that the administrative fine will be set at €375. 16.2. Because the court overlooks a defect in the contested decision, applying article 6:22 of the Awb, and because the reasonable period for trial has been exceeded, the AP must reimburse the plaintiff for the court fee and the plaintiff will receive compensation for her legal costs. The AP must pay this compensation. The compensation has been calculated as follows, applying the Administrative Law Costs Decree. The plaintiff receives a fixed amount per procedural act for legal assistance by an authorised representative. On appeal, the plaintiff has a value of €907 for each procedural act. The court sees no reason to use a light weighting factor (0.5), because the conviction for the legal costs was partly prompted by the overriding of a lack of motivation. The authorized representative has filed an appeal and three (additional) written statements of opinion and participated in the court hearing (3.5 points). The compensation then amounts to a total of € 3,174.50. Decision The court: - declares the appeal well-founded; - annuls the decision of 11 August 2022 insofar as it sets the amount of the administrative fine at € 500; - revokes the decision of 9 July 2021 insofar as it sets the amount of the administrative fine at € 500; - imposes an administrative fine of € 375 on the claimant and determines that this ruling replaces the annulled part of the decision; - determines that the AP must reimburse the claimant the court fee of € 365; - orders the AP to pay €3,174.50 in legal costs to the claimant. This ruling was made by Mr. S. Ketelaars-Mast, chairman, and Mr. N.M. van Waterschoot and Mr. D. Pool, members, in the presence of Mr. D.A. Bekking, registrar. The ruling was pronounced in public on 9 January 2025.