Tietosuojavaltuutetun toimisto (Finland) - 1788/152/22
From GDPRhub
| Tietosuojavaltuutetun toimisto - 1788/152/22 | |
|---|---|
 | |
| Authority: | Tietosuojavaltuutetun toimisto (Finland) |
| Jurisdiction: | Finland |
| Relevant Law: | Article 15(3) GDPR Article 15(4) GDPR Article 58(2)(c) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 05.05.2022 |
| Published: | |
| Fine: | n/a |
| Parties: | Police University College |
| National Case Number/Name: | 1788/152/22 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Finnish |
| Original Source: | Finlex (in FI) |
| Initial Contributor: | Vadym Kublik |
The DPA ordered the Police University College to give the data subject a video recording featuring other students. The DPA held that the controller wrongfully denied the right of access under Article 15(4) GDPR without sufficiently demonstrating how giving the copy would adversely affect others.
English Summary
Facts
The data subject requested a video recording of their screening test from the Finnish Police University College (controller). However, the controller refused to provide a copy because the video showed other students participating in the exam. Furthermore, according to the controller, it was technologically not possible to make a copy of the video recording that would only show the data subject. So instead, the controller provided the data subject with a written explanation of the test results and invited them to view the video recording at the controller's facilities.
The controller justified its decision by Article 15(4) GDPR, according to which the right to obtain a copy shall not adversely affect the rights and freedoms of others. The controller also considered that Article 15(3) GDPR gives it a margin of discretion as to the form in which it can provide access to personal information.
After the data subject complained, the Finnish DPA evaluated whether the granting of video recording would adversely affect the rights and freedoms of other persons appearing in the recording within the meaning of Article 15(4) GDPR.
Holding
The DPA held first that giving a piece of written information about the screening test results does not release the controller from its obligation to provide a copy of the video recording. Further, the controller cannot use the protection of third parties as a mere excuse to prevent the data subject from having legal access to their data. Instead, the controller must sufficiently demonstrate that providing a copy of the video recording would, in fact, adversely affect others. Finally, if such a risk exists, the controller must balance conflicting interests considering the individual case circumstances and the risks' likelihood and severity. In particular, the controller should consider applying technical measures such as video anonymisation to preserve the privacy of other persons.
Consequently, the DPA ordered the controller to provide the data subject with a copy of the video recording because the controller did not sufficiently demonstrate how giving the recording would adversely affect the rights and freedoms of others under Article 15(4) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
The data subject's right to receive a video recording Keywords: Video recording Right of inspection Legal basis: Decision in accordance with the EU General Data Protection Regulation Diary number: 1788/152/22 Decision of the Assistant Supervisor Thing The data subject's right of access to the data Registrar Police University of Applied Sciences Applicant 's requirements The applicant requests that the Assistant Data Protection Officer instruct the controller to comply with the data subject's request for access to the data. The applicant has requested to obtain video recordings of a screening test which he has taken as part of a refresher training for a force trainer. The registrar has refused to provide video recordings. Decision of the controller On 7 February 2022, the controller issued a decision stating: In addition to the applicant, the video recording also shows other students participating in the screening test, two of whom have acted as a pair in the technical part of the screening test. With the technology used by the Police University of Applied Sciences, it is not possible to make a copy of the video recording that would only show the applicant. As the video recording contains personal data concerning the applicant, such as image and sound, the provision of Article 15 of the General Data Protection Regulation (EU) 2016/679 on the data subject's right of access must also be taken into account when deciding on the provision of information. According to Article 15 (4) of the General Data Protection Regulation, the right to a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. The Polytechnic considers that Article 15 (3) of the General Data Protection Regulation leaves the College a margin of discretion as to the form in which the copy referred to therein is issued. The Police University of Applied Sciences states that the Police University of Applied Sciences has provided the applicant in writing with information on the rejection of the screening test and the findings of the applicant's screening test. However, under Article 15 (4) of the General Data Protection Regulation, the applicant is not entitled to have access to the personal data of other students who have taken the screening tests without their express consent. With the technology used by the Police University of Applied Sciences, it is not possible to make a video copy of the video recording that would only show the applicant. Accordingly, the applicant is not entitled to a copy of the video recording, but the applicant or his or her representative has the right to have the video recording viewed at the Police University of Applied Sciences. Statement received from the controller On 21 March 2022, the registrar issued a statement stating the following: The applicant has taken part in a demonstration exam at the Police University of Applied Sciences as part of the refresher training for a force trainer. The teachers of the Police University of Applied Sciences who have received the screening tests have videotaped the screening tests of the students who took part in the screening tests with a mobile camera, which means that the number of people in the video varies constantly. Six video clips have been separated from the original video recordings, showing the applicant. Otherwise, the screen test recording has been destroyed. The number of people shown in the video clips varies between one and fifteen. The people shown in the video clips are school students, one video clip also shows one school teacher. Students are natural persons who wish to acquire or retain eligibility to serve as force trainers in the private security industry. The students are external to the Police University of Applied Sciences. The limitation of Article 15 (4) of the Data Protection Regulation is explained in the fifth and sixth sentences of recital 63 of the Data Protection Regulation as follows: However, taking these factors into account should not result in any information being provided to the data subject. " The other rights and freedoms mentioned in recital 63 of the Data Protection Regulation, which may conflict with the right under Article 15 (3) of the Data Protection Regulation, are examples. In principle, any right or freedom based on the law of the European Union or a Member State may be a right or freedom within the meaning of Article 15 (4) of the Data Protection Regulation. (European Data Protection Board Guideline 18.1.2022 (01/2022) "Guidelines on data subject rights - Right of access", paragraph 168) Giving a copy to an applicant would be to the detriment of other students, as it would be lost at the same time - the right of other students to the protection of personal data guaranteed by Article 8 of the Charter of Fundamental Rights of the European Union, including the right to control the processing of their own personal data - the right of other students to the confidentiality of confidential information (examination test) based on the legislation of a Member State. The Police University of Applied Sciences has sought to alleviate the inconvenience caused to the applicant by the application of Article 15 (4) of the Data Protection Regulation by providing him or her with written information on the deficiencies found in the screening tests shortly after the screening tests. Applicant 's reply Despite the opportunity reserved for him, the applicant has not submitted a reply to the controller's report. Legal question The legal question to be resolved is whether the granting of video recordings would adversely affect the rights and freedoms of other persons appearing in the recordings within the meaning of Article 15 (4) of the Data Protection Regulation. Decision and justification of the EDPS Pursuant to Article 58 (2) (c) of the Data Protection Regulation, the Data Protection Supervisor shall instruct the controller to exercise the data subject's right of access under Article 15 of the Data Protection Regulation. The registrar is ordered to provide the applicant with video recordings of the examinations included in the refresher training of a force training instructor at the Police University of Applied Sciences. The provision applies to video recordings insofar as the applicant appears in the recordings. Grounds for the decision 1. In accordance with Article 15 (3) of the Data Protection Regulation, the controller shall provide a copy of the personal data processed. The fact that the controller has provided the applicant in writing with information on the rejection of the screening test and the findings of the applicant's screening test does not exclude the obligation to provide a copy (video recording) to the data subject. 2. Under Article 15 (4) of the Data Protection Regulation, the right to a copy referred to in paragraph 3 must not adversely affect the rights and freedoms of others. 3. For the purposes of Article 15 (4), account should be taken of the second and fifth sentences of recital 63 of the Data Protection Regulation, according to which this right should not adversely affect the rights and freedoms of others, such as business secrets or intellectual property, in particular software copyright. However, taking these factors into account should not result in any information being provided to the data subject. 4. It should be noted that the rights and freedoms explicitly mentioned in paragraph 3 are only examples. It is not a question of an exhaustive list of rights and freedoms. Therefore, in principle, all rights and freedoms under Union or national law should be taken into account in the assessment. Thus, the protection of personal data provided for in Article 8 of the Charter of Fundamental Rights of the European Union can also be considered as a right within the meaning of Article 15 (4) of the Data Protection Regulation (Guidelines 01/2022 on data subject rights - Right of access. Adopted version for public consultation on 18 January 2022). 5. Paragraph 93 of the DPA Guideline 3/2019 on the processing of personal data by video equipment (of 29 January 2020) states that the right of access may be subject to a number of restrictions, in some cases adversely affecting the rights of others under Article 15 (4) of the Data Protection Regulation. 6. Paragraph 94 of the above-mentioned guideline states that since no matter how many data subjects can be filmed in the same video surveillance period, screening would lead to further processing of other data subjects' personal data. If the data subject wishes to obtain a copy of the dossier (Article 15 (3)), this may adversely affect the rights and freedoms of the other data subjects in the dossier. To prevent this, the controller should therefore take into account that due to the intrusive nature of the video, the controller should not, in certain cases, release the video if other data subjects can be identified. However, the protection of third parties should not be used as an excuse to prevent individuals from having legal access to their data. In such cases, the controller should put in place technical measures to comply with the request for access to the data (for example, image editing such as camouflage or encryption). However, controllers shall not be obliged to take such technical measures if they are otherwise able to ensure that they are able to respond to the request under Article 15 within the time limit set out in Article 12 (3). 7. According to the data controller's report, it is not possible to make a video copy of the video recording from the data controller in which only the applicant would be visible. In this respect, the controller has not put in place the technical measures referred to in point 6 above to comply with the request for access. This does not mean that the data subject's request could not be complied with altogether, but that the controller must assess the request in accordance with Article 15 (4) of the Data Protection Regulation. 8. In assessing the harm to the rights and freedoms of others, the controller has found that the transfer of the video recording would harm other students, as it would deprive other students of the right to protection of personal data guaranteed by Article 8 of the Charter, including the right to control the processing of their own data. the confidentiality of confidential information (screening). 9. The data subject's right of access may not be denied pursuant to Article 15 (4) of the Data Protection Regulation as referred to in paragraph 8 without specific case-by-case grounds. The controller cannot rely on Article 15 (4) of the Data Protection Regulation simply by mentioning the provisions or general conditions under which the harm could exist. 10. In assessing the matter, it must be borne in mind that the applicant has himself taken part in the screening test and has already seen other persons taking part in the test and appearing in the video recordings. It has not been presented in the case, nor can it be concluded on the basis of the received information, that the video recordings are intrusive in nature or that the information about participating in the Police University of Applied Sciences' screening test itself could cause harm to other persons in the video recordings. Nor can it be concluded from the report that the provision of a video recording would be detrimental to the controller. 11. The data subject's right of access under the Data Protection Regulation will be decided on a case-by-case basis on the basis of the information available. If it had been shown that the exercise of the registered right would in fact adversely affect the rights and freedoms of others, a balancing of interests would have been required. This weighing should have taken into account the circumstances of the case in question, and in particular the likelihood and severity of the risks involved in providing the information. 12. In the light of the above, the controller has not put forward any arguments as to how the granting of video recordings to the data subject would adversely affect the rights and freedoms of others within the meaning of Article 15 (4) of the Data Protection Regulation. Applicable provisions Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Appeal An appeal against this decision may be lodged with the Administrative Court in accordance with the provisions of the Administrative Procedure Act (808/2019). Service The decision shall be served by post in accordance with section 60 of the Administrative Procedure Act (434/2003) against an acknowledgment of receipt.
