Tallinna Ringkonnakohus - 3-23-1025/19

Tallinna Ringkonnakohus - 3-23-1025/19
Court:	Tallinna Ringkonnakohus (Estonia)
Jurisdiction:	Estonia
Relevant Law:	Article 5(2) GDPR Article 6(1)(f) GDPR Article 58(2)(d) GDPR
Decided:	19.06.2025
Published:
Parties:	A natural person (the controller) AKI (Estonia)
National Case Number/Name:	3-23-1025/19
European Case Law Identifier:
Appeal from:	AKI (Estonia) 2.1.-1/23/2900-10
Appeal to:	Unknown
Original Language(s):	Estonian
Original Source:	State Gazzette (in Estonian)
Initial Contributor:	cci

The Court of appeal held that under Article 58(2)(d) GDPR the DPA can order controllers to present a written assessment of their legitimate interest.

English Summary

Facts

A natural person (the controller) installed CCTV cameras on his property. Aside from his own property, the cameras covered a part of the property of a neighbour (the data subject) as well as the public road.

The data subject filed a complaint with the DPA to challenge the recording of his property. The DPA held that the controller had no legal basis for recording the data subject’s property and the public road. On these grounds, it issued an injunction against the controller to stop the unlawful processing (by dismantling the cameras or restricting their field of view) or, as an alternative, to suspend the recording and later provide DPA with a written assessment of his legitimate interest to process personal data (Article 6(1)(f) GDPR).

The controller unsuccessfully challenged the decision with the Tallinn Administrative Court and later escalated the case to the Tallinn District Court.

Holding

The District Court of Tallinn dismissed the controller’s challenge.

On the household exemption and the relevance of Ryneš

The DPA and the lower court both held that the case at hand did not fall under the household exemption of Article 2(2)(c) GDPR. In this regard, the DPA and the lower court referred to Ryneš, a pre-GDPR era ruling of the CJEU. According to Ryneš, the household exemption (then found under Article 3(2) of the now-repealed Data Protection Directive) does not apply to CCTV surveillance when the cameras also cover public space.

On the other hand, the controller held that the household exemption applied to his case and that the Ryneš ruling was irrelevant because it applied Article 3(2) of the Data Protection Directive rather than 2(2)(c) GDPR.

The Tallinn District Court upheld the previous findings: the household exemption did not apply to the case for the reasons clarified in Ryneš, i.e. the cameras covered public ground. The Court also clarified that Ryneš was still relevant to the case at hand because Article 2(2)(c) GDPR does not differ in substance from Article 3(2) of the Data Protection Directive.

On the principle of accountability and the assessment of legitimate interest

In the controller's view, the assessment of legitimate interest was up to the DPA rather than the controller. By issuing an injunction for the controller to assess its legitimate interest, the DPA essentially delegated its task to the controller, contrary to the principle of legal clarity and "the general principles of administrative law".

The Court dismissed the argument. Under the principle of accountability (Articles 5(2) and 24(1) GDPR), the controller must both assess and demonstrate that the processing of personal data complies with the GDPR. Therefore, the DPA's injunction for the controller to assess its legitimate interest, simply enforced the principle of accountability and did not delegate the DPA's tasks.

On the powers of the DPA

The controller observed that the GDPR includes no explicit obligation to carry out a written analysis of legitimate interest. For this reason, the controller argued that the DPA's injunction to present such a written analysis, had no basis in the law.

The Court conceded that there is no general obligation in the GDPR to prepare a legitimate interest analysis as a written document. However, the Court still held that the DPA's injunction was legitimate.

The DPA observed that under Article 58(2)(d) GDPR, a DPA may “order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period”. The Court held that the DPA's injunction was functional to bringing the processing into compliance with the principle of accountability and that it was appropriate and not disproportionate to this purpose. Therefore, the DPA acted within its powers when it issued its injunction to provide a written assessment of legitimate interest.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Estonian original. Please refer to the Estonian original for more details.

Court Court composition K O H T U O T S U S IN THE NAME OF THE REPUBLIC OF ESTONIA Tallinn District Court Chair Virgo Saarmets, members Monika Laatsit and Kaire Pikamäe Time and place of decision making Administrative case number Administrative matter Contested court decision Participants in the proceedings Basis of proceedings in the district court Review of the matter RESOLUTION June 19, 2025, Tallinn 3-23-1025 LY's complaint to the Data Protection Inspectorate on February 2 2023 Precept-Warning No. 2.1.-1/23/2900-10 for cancellation and termination of the supervision procedure to oblige Tallinn Administrative Court decision of January 30, 2024 Complainant – LY, represented by attorney Heldur Otti Respondent – Data Protection Inspectorate, represented by Andres Kudryavtsev Third person – JQ LY appeal Written procedure 1. Dismiss LY's appeal and set aside the decision of the Tallinn Administrative Court of 30 January The 2024 decision in administrative case no. 3-23-1025 remains unchanged. 2. The parties to the proceedings shall bear their own costs at the appeal stage. 3. When publishing the decision, replace the names of the complainant and the third party with a symbol. APPEAL PROCEDURE An appeal against the decision may be filed with the Supreme Court no later than July 21, 2025. (Section 212(1) of the Code of Civil Procedure). In response to the cassation appeal filed by the other party to the proceedings and in joint A counter-appeal may be filed for review within 14 days of the cassation appeal. from the date of service on the party to the proceedings or during the remaining period for cassation, if it is longer than 14 days (Section 215(1) and (3) of the Civil Procedure Code). If the cassation applicant wishes the matter to be heard at a court hearing, this must be stated in the cassation appeal. to indicate, otherwise it will be assumed that he/she agrees to the resolution of the matter in written proceedings 3-23-1025 (Section 213(1)(5) of the Code of Civil Procedure). Regardless of the indication of a request for a hearing, the Supreme Court may review the cassation appeal in written proceedings if it does not consider it necessary to hold a hearing (Section 223(1) of the Code of Civil Procedure). If a party to the proceedings wishes to receive procedural assistance in order to file a cassation appeal, he or she must submit a corresponding application to the Supreme Court. Filing an application for procedural assistance does not suspend the running of the procedural time limit (Section 116(5) of the Code of Civil Procedure), and in order to comply with the cassation time limit, the applicant for procedural assistance must also perform the procedural act for which he or she is requesting procedural assistance, in particular, file a cassation appeal (Section 116(6) of the Code of Civil Procedure). CIRCUMSTANCES AND PROCEEDINGS 1. JQ, the owner of the Xxx property (cadastral number xxx) located in the city of Pärnu, submitted an intervention request to the Data Protection Inspectorate (AKI) on 16.12.2022 regarding the fact that LY, the owner of the Xxx property (cadastral number xxx), has installed a surveillance camera on the residence, which is directed at neighboring properties (including Xxx) and public space. JQ has repeatedly asked LY not to film his property, but to no avail. 2. On 02.02.2023, the Data Protection Inspectorate, with precept-warning no. 2.1.- 1/23/2900-10, obliged LY to stop filming with all cameras outside its premises by 17.02.2023 at the latest (either by dismantling the camera(s) or directing them so that only its premises would be visible) and to delete the existing recordings, based on § 56 (1) and (2) (8), § 58 (1) of the Personal Data Protection Act (IKS) and Article 58 (1) (d) and (2) (d) and (f) of the General Regulation on the Protection of Personal Data1 (IKÜM) and taking into account Articles 5 and 6 of the IKÜM. Alternatively, filming with the camera(s) filming the public area had to be suspended until a legitimate interest analysis and data protection conditions for the use of the camera(s) had been prepared, forwarded to the AKI and the compliance with the requirements of which had been confirmed by the AKI. The AKI warned that in case of failure to comply with the precept, a penalty payment of 800 euros would be applied for each point not complied with under Section 60 of the IKS. 4 cameras have been installed on the property of XXX, which partly also film neighbouring properties and the public area. LY explained that he installed the cameras to protect his property, property and family (e.g. his car has previously been backed into on a public road). AKI notes that the personal use exception applies to natural persons when using security cameras, which only applies to filming an area belonging to him (e.g. the courtyard of his private house) (see the judgment of the European Court of Justice of 11.12.2014 in case C-212/13, Ryneš). There is no legal basis for filming properties belonging to other persons that would allow their right to privacy to be violated, and neighbouring properties have the right to request the termination of the processing of personal data (Article 17(1)(d) of the Data Protection Act). In the case of a public space within the field of view of cameras, the legal basis for filming may be Article 6(1)(f) of the Privacy Act (legitimate interest), but in order to assess this, the controller must prove whether and what his or her legitimate interest is and that it outweighs the infringement of the rights of data subjects (including the field of view of the camera must be reviewed, the retention period of recordings must be minimal). The legitimate interest must be specific and relevant, not vague or speculative. The analysis of the legitimate interest must be documented and must be accessible to everyone at any time (Article 13(1)(d) of the Privacy Act). The analysis must be prepared separately for each camera filming the public space. Preparing a correct legitimate interest analysis and installing a sign informing about the camera also requires the preparation of data protection conditions (see Articles 12–14 of the GDPR) (see also the Article 29 Working Party Guidelines on Transparency, pp. 35–40). In the case of video surveillance, the most important thing should be 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/ EC (General Data Protection Regulation) 2(11) 3-23-1025 information should be provided on the information label: purpose of processing, legal basis, name and contact details of the controller and information on where to access the data protection conditions. According to the European Data Protection Board Guidelines No. 3/2019, a 72-hour retention period should generally be used for video recordings in situations where a longer retention period does not result from a special law. 3. On 12.04.2023, the Data Protection Inspectorate dismissed the challenge of LY 03.03.2023 to declare the injunction warning of AKI 02.02.2023 invalid by means of the objection decision No. 2.1.-3/2023-562-3, maintaining the positions set out in the injunction-warning. If the camera monitors, even partially, a road in public use and/or a neighbour's immovable property in addition to the territory of its own property, this is not data processing for personal purposes (Article 2(2)(c) of the Personal Data Protection Act). In the present case, it is not disputed that the field of view of the cameras used by LY partly includes both public space and neighboring properties. AKI has acted in accordance with the powers granted to it and the applicant has not been treated unequally. On-board cameras in vehicles (including Google's camera vehicles) are mobile by nature and their purpose is not to film permanently in one place, which is why the risk of profiling in the case of on-board cameras (unlike stationary cameras) is essentially non-existent. There was no need in the precept to separately analyze the gravity of the infringement of the opposing fundamental rights, because case law has reached a unanimous position that installing a camera on one's own property in such a way that it also monitors a public area and/or neighboring properties is not permissible without meeting the requirements of legitimate interest (including without setting up a notice board). 4. LY filed an appeal with the Tallinn Administrative Court on 10.05.2023 to annul the injunction-warning of the AKI on 02.02.2023 No. 2.1.-1/23/2900-10 and to oblige the AKI to terminate the supervision proceedings in the personal data protection case No. 2.1.-1/23/2900-10. According to Article 2(2)(c) of the IKÜM, the IKÜM does not apply to the activities of the complainant and the judgment of the European Court of Justice of 11.12.2014 in case C-212/13 referred to by the respondent is not relevant, because it concerned the interpretation of the second indent of Article 3(2) of the previous Directive 95/46/EC2, nor can the exception in question be applied narrowly according to it (see also the judgment of the European Court of Justice of 11.12.2019 in case C-708/18, p. 60). The applicant's legitimate interest in filming with a surveillance camera is defined clearly enough and is in accordance with the legislation. The applicant has no desire to profile the neighbor and his family members or harm them in any other way. The owner of the property Xxx or his family members are not clearly identifiable in the recordings due to the technological features of the applicant's surveillance camera and the distance and location of the properties (see the opinion of Arvo Heinrich Tepper, expert of Valvekaamera OÜ, 29.12.2023). In addition, this is a dispute between private neighbors, in which the state does not and cannot intervene with public legal remedies, but such disputes should be resolved through legal proceedings in a county court. The argument of the mobility of the on-board cameras referred to by the AKI is not relevant, because the vehicle can drive along the same street repeatedly. Since it is not known that the AKI has issued any injunctions to the owners of vehicles with on-board cameras driving on Xxx Street (nor to Google Inc., which filmed and photographed Xxx Street and the properties there, whose recordings are, among other things, freely available), the fundamental right to equality has been violated. The applicant does not publish any surveillance camera images to the public. The neighbour's right to privacy is not more important than the applicant's right to protect the life, health and property of his family with the help of security cameras. The owner of the Xxx property cannot expect privacy in the part of the property bordering the street. This is a part of public space within sight, where an individual has no privacy. If the owner of the Xxx property wishes to increase his privacy in an urban environment, he can build a garden of sufficient height on the border of the property, plant a hedge, etc. The AKI has not considered these circumstances at all. The IKÜM does not oblige the complainant to prepare a legitimate interest analysis and data protection conditions, but rather to comply with the provisions of the Administrative Procedure Act (HMS) 2 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to personal data processing and on the free movement of such data 3(11) 3-23-1025 According to Articles 4 and 6, the AKI itself had to determine whether the applicant has a legitimate interest in processing personal data using a surveillance camera, and to analyse the gravity of the infringements of the fundamental rights of the applicant and other persons. Directing the camera's field of view only to its own property deprives the applicant of the possibility of identifying and proving, if necessary, in the future, who enters the applicant's territory from the street for malicious purposes or who and how causes damage to his car. Article 13 of the IKÜM is not relevant, because the applicant has not collected any data from the data subjects. When issuing the injunction, it has not been taken into account that the applicant installed an information sign on the street-side fence of the Xxx property (see Article 14(5)(a) of the IKÜM). 5. The Data Protection Inspectorate requested in its response that the complaint be dismissed. Since the personal purpose exception in Directive 95/46/EC corresponds to the same exception in the IKÜM, the judgment of the European Court of Justice of 11.12.2024 in case C-212/13 is also relevant. Filming a property of a random nature using a car's on-board camera is not the same as filming a property with a stationary camera. Google photos also only reflect a specific moment in time, and the faces of the persons in them and the license plates of the cars are blurred. The complainant has no legal basis for filming a neighboring property. The expert opinion submitted by the complainant is one-sided and incomplete. There is no information whatsoever about the competence of AH Tepper, and his resolute statement that persons entering the camera's field of view cannot be identified further than 7.5 m from the camera lens does not correspond to the descriptions of distances given in the DORI standard. Based on the technical specifications of the Xxx camera, the camera's field of view, the DORI standard and the sample photo, it is obvious that it is possible to directly or indirectly identify persons on neighboring properties from the recordings. Not to mention persons on a public road, because the road starts about 3 m from the camera. If the complainant wishes to rely on Article 6(1)(f) of the GDPR when processing personal data, he is obliged to prepare (including document) a legitimate interest analysis and data protection conditions, and the respondent does not have to prepare them for him. Personal data is collected by means of cameras by observing the data subject, therefore notification must be based on Article 13 of the GDPR. 6. JQ did not submit a position on the complaint. 7. The Tallinn Administrative Court dismissed the appeal by its decision of 30.01.2024 , finding that the precept warning No. 2.1.-1/23/2900-10 of the AKI of 02.02.2023 complies with the requirements of Sections 54 and 56 of the HMS, and agreeing with the reasons presented in the precept-warning, the decision on the objection of 12.04.2023 and the AKI's response to the appeal (Section 165 (2) of the HMS). Since it is not disputed that the applicant's camera system monitors, among other things, public space, this is not processing personal data solely for personal or domestic purposes. Pursuant to Section 56(1) of the Personal Data Protection Act, the AKI exercises state supervision over compliance with the requirements established for the processing of personal data. In the case of the car dashcams and Google photo material referred to by the applicant, these are not groups comparable to the applicant. The precept issued to the applicant for failure to comply with the requirements of the law cannot be made unlawful by the fact that a similar precept has not been issued to other persons. In relation to the proportionality of the precept, the respondent has appropriately referred to the fact that, according to case law, installing a camera on one's own property, which monitors, among other things, a public area and/or a neighbouring property, is not permissible without meeting the requirements of a legitimate interest, including the installation of an information sign. Consequently, the neighbour's right to privacy outweighs the alleged infringement of the applicant's right to protection of property. The AKI gave the complainant the opportunity to either stop filming or prepare a legitimate interest analysis and data protection conditions. According to the complainant, the installed surveillance camera is only capable of identifying a specific person from a distance of up to 7.5 m measured from the camera lens, and since the Xxx property is considerably further away, the third party or their family members cannot be identified using the surveillance camera. The opinion of AH Tepper submitted by the applicant cannot be considered as an expert opinion, but 4(11) 3-23-1025 with the usual documentary evidence. Merely being a member of the board of a company providing services related to surveillance cameras does not make a person an expert in the field and the professional register does not show that he or she has been issued professional certificates. The opinion in question does not refute the positions of the AKI that with a camera installed on the Xxx building, it is possible to directly or indirectly identify persons on neighboring properties, not to mention persons on a public road. The applicant's claims to the contrary are unproven, because the evidence he or she has provided is incomplete and biased. Even if we proceed only from the fact that people are identifiable in any case up to a distance of 7.5 m, the injunction is still lawful, because the public road begins 3 m from the camera. The processing of personal data by the applicant violates the right to privacy of data subjects related to neighboring properties, and this violation can be stopped, in particular, by directing the camera's field of view in such a way that neighboring properties are not in the camera's field of view. Since the applicant can also protect his property in such a way that the third party's right to privacy is not violated, the third party's right to privacy in this case outweighs the applicant's interest in recording with the camera, among other things, what is happening in public space and neighboring properties. Even if the surveillance camera is directed only at the applicant's property, it is clearly possible to identify who is entering the applicant's territory. The applicant can also park his car on his own property, where the use of a surveillance camera is completely legal. The fact that the applicant parks the car on the street does not make the public space the property of the applicant and cannot create additional rights for him that are not provided for by law. If the applicant wishes to continue filming the public space, a correct analysis of legitimate interest and data protection conditions must be prepared. The respondent is not obliged to do this for the applicant. From the point of view of resolving the dispute, the information sign on the fence of Xxx is of no importance, because the court checks the legality of the administrative act as of its issuance (Section 158(2) of the Administrative Procedure Code). The complainant has not been issued a warning regarding the lack of a warning sign. POSITIONS OF THE PARTIES IN THE PROCEEDINGS IN THE DISTRICT COURT 8. LY requests in the appeal of 29.02.2024 (amended 29.05.2025) that the administrative court's decision be annulled and his complaint be satisfied with a new decision or, alternatively, that the matter be sent to the administrative court for a new decision. The court violated procedural rules by failing to accept and examine the evidence submitted by the applicant, including the photo of the information sign submitted on 05.01.2024. The court noted that the information sign is part of the analysis of legitimate interest, therefore the evidence had to be relevant. According to the AKI precept (p. 6), the information sign proves the obligation set out in Article 13 of the IKÜM, i.e. the fulfilment of the data protection conditions required by the contested administrative act. Section 158 (2) (2) of the Administrative Procedure Code does not preclude the establishment of circumstances as of the time of the judgment (see Section 158 (2) (1) of the Administrative Procedure Code). In doing so, neither the administrative court nor the AKI has taken into account that the information sign was already in place before the injunction was issued. The administrative court's position that the injunction was not issued due to the absence of the information sign is incorrect. Paragraph 2 of the resolution of the injunction obliged the applicant to submit data protection conditions, which are deemed to be met if the applicant installs an information sign with specific content on the fence surrounding his property. The administrative court's reasoning is also contradictory, because on the one hand, the information sign is seemingly of no importance at all and at the same time, it is part of the analysis of legitimate interest, which the applicant has been required to prepare by the injunction. The court's assessment that the information sign must be considered part of the analysis of legitimate interest is contrary to the AKI's injunction, according to which the information sign proves compliance with the data protection conditions. If the court had taken into account the explanations and evidence submitted by the applicant on 05.01.2024, the injunction should have been at least partially revoked, because it required the applicant, among other things, to comply with data protection requirements, i.e. to install an information sign on the fence of the property. The Administrative Court has erroneously found that there is no dispute over the analysis of legitimate interest. The applicant has repeatedly pointed out that the contested precept does not contain any reference to a specific legal provision, which would oblige the applicant to prepare a written analysis of the legitimate interest. 5(11) 3-23-1025 and submit it to the respondent for permission or consent to process personal data. The AKI has relied solely on Article 6(1)(f) and Article 13 of the Data Protection Act, which do not provide for this. The applicant has fulfilled the obligation to inform (i.e. by installing a notice). Consequently, the requirement set out in the injunction is not based on any valid legal provision and the administrative court could not fail to annul the injunction. In addition to the requirement of a legal basis, the obligation must be clear and unambiguous for the addressee (applicant), proportionate (appropriate, necessary, moderate) to his or her fundamental rights and realistically enforceable. Since neither the injunction nor the decision on the objection has addressed the applicant's objection that the IKÜM does not oblige the applicant to prepare a written analysis of legitimate interest and submit it to the AKI for approval, the administrative court could not rely on Section 165(2) of the HKMS in this regard, but had to explain why it did not agree with the applicant's interpretation of Section 6(1)(f) and Articles 13 and 14 of the IKÜM. The position stated in the AKI's response that the applicant was not required to prepare a written analysis of legitimate interest, but rather to provide evidence as to whether and what his legitimate interest is in filming a public area and that this outweighs the rights of data subjects, is surprising and contradicts Section 2 of the resolution of the contested injunction. The AKI's view that the applicant should have started to assess himself is not in accordance with the general principles of administrative law. The AKI cannot delegate its tasks to the applicant (see Sections 4 and 6 of the HMS). Therefore, paragraph 2 of the resolution of the precept does not comply with the principle of legal clarity and is not enforceable in the form presented. The parties argued in court, among other things, about whose translation and interpretation of the technical parameters of the applicant's surveillance camera, or DORI standards, is correct. The issue is not the numbers on the product page, but the meaning of the English terms indicated next to them. The administrative court unfoundedly agreed with the respondent that it is possible to directly or indirectly identify persons on neighboring properties from the field of view of the applicant's surveillance camera. The representative of AKI is not an English philologist, and the author of the bachelor's thesis from the Estonian University of Life Sciences he referred to was also not an English philologist. Since the court proceedings are conducted in Estonian, the administrative court should have required the submission of a translation of a foreign language document or organized its translation itself under Section 81(1) of the Act on the Protection of Human Rights and Fundamental Freedoms. By accepting an English document without a translation prepared by a sworn translator, the court significantly violated Section 81(1) of the Act on the Protection of Human Rights and Fundamental Freedoms. The court also incorrectly assessed the opinion of AH Tepper and drew incorrect conclusions from it. Any expert opinion prepared in written form can be considered documentary evidence within the meaning of § 229 (1) of the Code of Civil Procedure (including in administrative court proceedings – see § 56 (2) of the Code of Civil Procedure). An expert can be any person who has acquired the knowledge and experience necessary to give an opinion through long-term employment. AH Tepper has more than 10 years of experience in selling, installing and repairing surveillance cameras, including installing the applicant's surveillance camera and doing so expertly, as the camera is in working order. AH Tepper's opinion is not incomplete or biased and can only be refuted by the opinion of another expert in the same field, not by the views of the respondent's representative, whose translation or interpretation does not qualify as evidence. The court should have disregarded the unqualified objections of the AKI representative. Only the identification level (250 PPM) in accordance with the DORI standard allows the identification of a person beyond reasonable doubt. The camera installed on the XXX residence allows the identification of persons without reasonable doubt from a distance of up to 7.5 m from the lens of the surveillance camera. The XXX property is significantly further away. The administrative court has violated the principle of investigation (Section 2(4) of the Code of Civil Procedure) by failing to clarify why the applicant parks the car on a city street. The administrative court's reference that the applicant can park the car in his yard if he wishes is incorrect. Only one passenger car can be parked on the property belonging to the applicant. Since the applicant uses another car to do work, he must keep it on a city street. The applicant's spouse's car must also be parked on the street. The applicant does not consider the city street to be his property. Parking of cars is not prohibited on the publicly used Xxx street. In the case of sound/image recording in a public place, the data subject's consent is replaced by his 6(11) 3-23-1025 notification. The applicant has installed a clearly visible video surveillance notice on the property's fence. By doing so, he has met the data protection requirements for video surveillance of cars on a city street. The parking issue is important because it explains why the surveillance camera's field of view must extend to the street in front of the Xxx property. The applicant's car has been broken into before, and the culprit was caught thanks to the surveillance camera recording. 9. In its response of 05.03.2024, the Data Protection Inspectorate requests that the appellant's appeal be dismissed and the decision of the administrative court be left unchanged. The respondent maintains all previously submitted positions and does not repeat them, and also agrees with the reasons for the decision of the administrative court. The information sign installed on the fence of the property XXX is of no significance in the end. According to the injunction, the appellant had to stop filming in a public area until a legitimate interest analysis and data protection conditions for the use of the camera have been prepared and approved by the AKI. It is not disputed that the applicant has not prepared or submitted a legitimate interest analysis or data protection conditions to the AKI. The AKI precept explains that the applicant has the obligation to prove whether and what his legitimate interest is in filming a public area and that this outweighs the rights of the data subjects. The applicant has not proven this. The allegations regarding the translation of the technical data of the surveillance camera product sheet are unfounded. The data in question is well known to the applicant, and the fact that the applicant did not submit the surveillance camera product sheet as evidence, but an obviously incomplete expert opinion, gives the impression that the applicant's aim was to mislead the court. The mere fact that AH Tepper has installed a working surveillance camera for the applicant and is a member of the board of the company that installs surveillance cameras does not make him an expert in the field of surveillance cameras or data protection. From the point of view of resolving the matter, it is also irrelevant why the applicant parks his vehicle on a city street. Therefore, the administrative court did not have to find out. 10. JQ has not submitted a statement of position on the appeal. REASONS OF THE DISTRICT COURT 11. By the injunction-warning of the AKI of 02.02.2023 No. 2.1.-1/23/2900-10 (dtl 16–21; dtl 57–62), the complainant is obliged to stop filming with all cameras outside his property (resolution p 1) and delete the existing recordings (resolution p 2). Four cameras are installed on the walls of the Xxx residential building (dtl 49–54), but in the current case the main problem is the camera installed on the street-facing wall of the building. It is not disputed that the field of view of the surveillance camera in question includes, in addition to the street-facing part of the Xxx property, Xxx Street and the street-facing parts of the Xxx and Xxx properties located across the street (see photos dtl 48, 54). In the reasons for the injunction, the AKI has clearly stated that the applicant cannot have any legal basis for recording what is happening on the neighbouring properties, which is why the filming in this regard must in any case be stopped and the recordings deleted. The respondent is authorised to submit such claims by Section 56(1) of the IKS and Section 58(2)(f) and (g) of the IKÜM. Since the applicant argued in the administrative proceedings that it is necessary to monitor the public street in front of the property because the applicant and his wife park cars there, the AKI alternatively ordered the suspension of the filming of the public area until the applicant has prepared a legitimate interest analysis and data protection conditions and the AKI has approved them. Contrary to the applicant's claim, the injunction does not oblige him to necessarily submit a legitimate interest analysis and data protection conditions to the AKI, but is merely a requirement that the applicant must meet if he wishes to continue filming the public area in front of the property. If the applicant directs the cameras only to the territory of the Xxx property in the future or stops filming altogether (i.e. dismantles the cameras), then he has no obligation to prepare or submit a legitimate interest analysis or data protection conditions. 7(11) 3-23-1025 12. It can be understood from the applicant's positions that he continues to be interested in the street in front of the property remaining in the field of view of the camera. However, it is not disputed that the applicant has not prepared a legitimate interest analysis and data protection conditions or submitted them to the AKI for approval. In this situation, the information sign installed on the fence of the Xxx property is not relevant to the resolution of the matter, because the applicant has not met the substantive requirements for continuing to film the public area in any case. Contrary to the applicant's claim, it does not follow from the contested precept that the requirement to submit data protection conditions to the AKI is deemed to have been met by installing the information sign. Even if the information sign visible in the photograph submitted as an annex to the applicant's position of 05.01.2024 (dtl 142) were sufficient pursuant to Article 13 of the IKÜM, it would not affect the legality of the contested precept, which must be assessed pursuant to Section 158(2)(2) of the HKMS as of the time of issuing the administrative act, but it could only be related to the implementation of the precept. 13. Although the applicant has not separately addressed this issue in the appeal, the District Court nevertheless notes that the AKI has correctly emphasized that the applicant's activities outside the Xxx immovable property are not covered by the so-called personal purpose exception (see Article 2(2)(c) of the IKÜM) and the judgment of the European Court of 11.12.2014 in case C-212/13 (p. 33) referred to by the respondent remains relevant, because the exception set out in Article 2(2)(c) of the IKÜM does not differ in substance from the exception set out in the second indent of Article 3(2) of Directive 95/46/EC. In the judgment of the European Court of 11.12.2019 in case C-708/18 referred to by the applicant, the circumstances were significantly different from the present case, because in that case the field of view of the surveillance cameras was not directed (partly) to a public area, but to the parts of the apartment building that are jointly owned. Pursuant to Article 2(2)(c) of the Act on the Protection of Personal Data, the provisions therein do not apply to the applicant's activities on his own property, but he is obliged to comply with data protection requirements when using surveillance cameras insofar as the cameras film areas outside his property. The Circuit Court has also repeatedly explained (e.g. Tallinn Circuit Court of 14.12.2023 decision no. 3-22-265, p. 19) that the competence of the AKI in exercising state supervision is not limited in any way by the fact that the person submitting the so-called intervention application would be able to obtain legal protection in other ways, including implementing civil law legal remedies (e.g. applying to the county court under § 1055 of the Law of Obligations Act with a request to prohibit the activity causing damage). 14. If the applicant wishes to continue using surveillance cameras in such a way that the cameras' field of view includes, among other things, a publicly accessible area (including Xxx Street), then he, as the controller, has an obligation arising from Article 5(2) of the GDPR to demonstrably comply with all the principles for processing personal data set out in Article 5(1) of the GDPR. The processing of personal data must, among other things, be lawful, i.e. at least one of the conditions listed in the first paragraph of Article 6(1) of the GDPR must be met. As the applicant submits, the legal basis for processing camera image (video) data could be Article 6(1)(f) of the first paragraph of the GDPR, i.e. legitimate interest. On this basis, data processing can be lawful only if the legitimate interest of the controller or a third party outweighs the interests of the data subject or the infringement of his or her fundamental rights and freedoms. Although the GDPR does not impose an obligation to prepare a legitimate interest analysis in every case as a separate written document (the preparation of a data protection impact assessment pursuant to Article 35 of the GDPR is not required in this situation), the controller must, in accordance with Article 5(2) and Article 24(1) of the GDPR, be able to prove to both the data subject and the supervisory authority, if necessary, that he or she is processing personal data lawfully. The supervisory authority has the right, pursuant to Article 58(2)(d) of the GDPR, to order the controller to bring the processing of personal data into compliance with the provisions of the GDPR in a certain manner and within a certain period of time. The AKI has indeed required the complainant to prove the lawfulness of the processing of personal data (if the complainant wishes to continue the processing), obliging him or her to prepare a legitimate interest analysis and data protection conditions and submit them to the AKI for verification of compliance with the requirements. In the opinion of the District Court, this is an appropriate measure within the meaning of Article 58(2)(d) of the GDPR, which cannot in any way be disproportionate and is clearly enforceable. The complainant, as the controller, has an obligation to ensure that the personal data 8(11) 3-23-1025 the processing is lawful, and he must be able to prove it (see Article 5(2) and Article 24(1) of the GDPR). The complainant's position that the AKI should have analysed itself, pursuant to Sections 4 and 6 of the GDPR, whether the legitimate interest stated by the complainant outweighs the interests and rights of the data subjects, clearly disregards the controller's obligations under the GDPR. 15. The opinion of AH Tepper of 29.12.2023 submitted by the applicant (p. 119–120) states that the manufacturer of the camera installed in the Xxx residence has defined the DORI distances as follows:– “recognize” (i.e. the ability to recognize different objects based on their species characteristics, e.g. person, animal, vehicle) –14.9 m;– “recognize” (i.e. the ability to recognize different objects based on identification features, e.g. a specific person, animal, vehicle) –7.5 m. AH Tepper has noted in the conclusion of the opinion that a person in the field of view of the relevant surveillance camera can be monitored and recognized through the camera's recording device at maximum focus no further than 7.5 m measured from the camera lens. 16. AKI submitted, together with its position dated 04.01.2024, the English product sheet of the surveillance camera used by the complainant (dtl 123–125), which shows that the DORI distances are indicated as follows: “detect” – 74.7 m; “observe ” – 29.9 m; “recognise” – 14.9 m; “identify” – 7.5 m. In the respondent’s opinion, AH Tepper has translated the English terms incorrectly: “identify” does not mean “recognize”, but “identify” or “recognize”, and “recognize” does not mean “recognize”, but “recognize”. AKI has referred to Lars Riisalu's bachelor's thesis, defended at the Estonian University of Life Sciences in 2023. “Instructions for laboratory work in the subject “Low-voltage systems”, which provide explanations of the DORI standards in Estonian (p. 22). The applicant has complained that although the dispute in the matter is whose translation and interpretation of the DORI standards is correct, the administrative court did not require a translation of the foreign-language document by a sworn translator or arrange for the translation itself, but agreed with the respondent's submission. 17. The District Court does not share the applicant's position that the administrative court has significantly violated the requirements of Section 81(1) of the Act on the Protection of Personal Data by adopting the English product sheet of the surveillance camera. The technical data indicated on the product sheet of the camera, i.e. the DORI distances, which do not require translation as numerical indicators, are primarily important for resolving the dispute. The product sheet also only refers to the DORI standards, and does not determine how they should be interpreted. The applicant's expert has not stated in his opinion on the basis of which he interpreted the meanings of the DORI categories. The DORI3 standards defining the levels of detail of surveillance cameras are based on the international standards IEC 62676-4:2014 and EN 62676-4:2015, which are met by the Estonian standard EVS-EN 62676-4:2015 “Video surveillance systems for security applications. Part 4: Implementation guidelines”.4 Terms and definitions can be found in section 3.1 of the standard, and the DORI standards are defined therein as follows:– detection – allows the viewer to easily and reliably assess whether an object, such as a person, is within the camera's coverage area (section 3.1.12);– observe – allows you to simultaneously see details of the person being observed, such as their distinctive clothing, and the activities surrounding the incident (section 3.1.29);– recognize – allows the viewer to recognize a person (p 3.1.36); – identify – allows the viewer to identify a person without without a doubt (p 3.1.19). 3 4 An acronym for Detection, Observation, Recognition and Identification. https:// www.evs.ee/et/evs-en-62676-4-2015 9(11) 3-23-1025 The minimum sizes of objects on the screen that meet the above definitions are set out in standard ps 6.7 “Field of view – object size”. The minimum resolution required for recognition is at least 40 mm per pixel (i.e. 25 PPM or pixels per meter). For observation, the minimum required resolution is at least 16 mm per pixel (i.e. 62.5 PPM). For recognition, the minimum required resolution is at least 8 mm per pixel (i.e. 125 PPM). For identification, the minimum required resolution is at least 4 mm per pixel (i.e. 250 PPM). The above is illustrated by the sample photos submitted by AKI (dtl 126). 18. The Estonian translation of the relevant standard EVS-EN 62676-4:2015 clearly confirms that AH Tepper's opinion presents the DORI standards in a half-hearted manner and associates them with incorrect data. The expert's description of the category "detect" is correct in itself, but on the camera's product page the corresponding distance is 74.7 m, not the 14.9 m stated in the opinion. The expert has also described the category "recognise" correctly , but according to the camera's product page the corresponding distance is 14.9 m, not the 7.5 m stated in the opinion. The District Court agrees with the appellant that an expert may, among other things, be a person with long-term work experience in a certain field. Therefore, AH Tepper may also be an expert, and the administrative court has assessed his opinion as documentary evidence, and has not ignored it. The applicant, however, mistakenly believes that the expert's opinion can only be refuted by the opinion of another expert in the same field. According to Section 61(2) of the Code of Civil Procedure, no evidence has a predetermined force for the court and the court assesses all evidence in its entirety and in its mutual relationship. Among other things, in administrative court proceedings, even by agreement of the parties to the proceedings, evidence cannot be given a predetermined force (Section 61(3) of the Code of Civil Procedure), and even in civil court proceedings, the opinion of an expert appointed by agreement of the parties would not be binding on the court if the opinion is obviously incorrect (see Section 232(3)(4) of the Code of Civil Procedure). In the present case, it is clear that the expert has incorrectly reflected the data on the camera's product sheet, which is why the administrative court reasonably disregarded his opinion. 19. From the point of view of resolving the dispute, it is not decisive whether a person is considered sufficiently recognizable by the disputed camera (i.e. by means of additional data) from a distance of 29.9 m (which would also include part of the Xxx property – dtl 128) or only from a distance of up to 14.9 m (which would not reach the Xxx property, but would reach the Xxx property located directly across the street – dtl 127), because although the AKI initiated the supervision proceedings based on the application of the Xxx property owner, the injunction concerns the use of Xxx surveillance cameras in general. What is important is that as long as a person is directly or indirectly identifiable, it is personal data within the meaning of Article 4, paragraph 1 of the Personal Data Protection Act. It follows from recital 26 of the GDPR that when determining the identifiability of a natural person, account should be taken of all means that the controller or someone else may use to identify the natural person directly or indirectly with reasonable probability. 20. The applicant has unjustifiably accused the administrative court of, among other things, violating the principle of investigation, since the court has not established the reasons why the applicant parks the car on a city street. The applicant's reasoning in this regard could only be relevant in the analysis of legitimate interest, but not in resolving the current dispute. Since the applicant has not provided any evidence that he had assessed in any way before starting filming (surveillance) with a camera on a publicly used street (or later) whether the conditions set out in Article 6(1)(f) of the Personal Data Protection Act were met, it must be concluded that the applicant has not checked the lawfulness of the processing of personal data. 21. Based on the foregoing and on the basis of Section 200(1) of the Code of Civil Procedure, LY's appeal remains dismissed and the decision of the Tallinn Administrative Court of 30.01.2024 remains unchanged. 10(11) 3-23-1025 22. Pursuant to § 108(1) of the Civil Procedure Code, the costs of the proceedings shall be borne by the party against whom the decision was made. According to Section 109(1) of the Code of Civil Procedure, in order to award procedural costs, a list of procedural costs and cost documents must be submitted to the court, failing which procedural costs will not be awarded. LY has paid the state fee of 20 euros when filing the appeal, but has not submitted information on the payment of other costs in the district court proceedings. Since the appeal is dismissed, the applicant's procedural costs at the appeal level will be borne by him/herself pursuant to Section 108(1) of the Code of Civil Procedure. AKI and JQ have not submitted information on the payment of costs related to the district court proceedings, therefore the possible procedural costs of the respondent and the third party will also be borne by them pursuant to Section 109(1) of the Code of Civil Procedure. 23. Since the decision contains private information about the complainant and a third party, their names must be replaced with a symbol when publishing the decision (Section 175(3) of the Code of Civil Procedure). (digitally signed) 11(11)