The Belgian DPA imposed a fine of 1,500 EUR for unlawful processing of personal data made via a video surveillance system. The positioning of the cameras of this video system also constituted an infringement of the data protection by design principle, the DPA concluded.
The facts
Two complainants had filed a complaint with the Belgian DPA with regard to the video surveillance system of their two neighbours, as well as the further use of the images made by the system. The complainants demanded that the video surveillance system would be taken down.
The two defendants had installed a video surveillance system with five surveillance cameras (filming 24/7) on their private property. Two cameras that were mentioned in the complaint were positioned in such a way that those cameras filmed the public road or the private property of the complainants and had filmed at least one of the complainants while driving on the public road or entering private property of their own.
The images were used by the defendants in a dispute procedure between the defendants and the complainants regarding environmental planning.
In the same dispute procedure, a photograph with the image of one of the complainants was used. The complainants thought this was a still image originally made by the video surveillance system, but the photograph turned out to be made by one of the defendants with a smartphone.
Role of national law concerning video surveillance cameras
A law of 21 March 2007 regulates the positioning and use of video surveillance cameras. Although the Belgian DPA is technically competent to take into account the provisions of the law, as it did in its decision to specify certain viewpoints, the primacy of the GDPR as EU law resulted in the decision that a priori analysed potential breaches of the GDPR.
Decision of the Litigation Chamber
The litigation chamber of the Belgian DPA upheld that:
– the images with personal data made by two of the five surveillance cameras were not processed in a lawful way under article 6.1.f. GDPR, as there were legitimate interests for the defendants to protect their own private property, but the filming of large parts of the public road, as well as the filming of the private property of the complainants, was not deemed necessary to safeguard those legitimate interests. Moreover, the Belgian DPA found the interests of the defendants to process personal data through the two surveillance cameras to be overridden by the interests, fundamental rights and freedoms of the complainants;
– the transfer of images made by the two surveillance cameras containing personal data in the context of the dispute procedure, constituted a breach of article 6.1. GDPR, as the images were unlawfully made in the first place, thus constituting unlawful processing impacting the further processing;
– the making of a photograph of one of the complainants by one of the defendants, and the further processing thereof, was lawful under article 6.1. GDPR, as the processing was necessary for the defendants to safeguard a legitimate interest, and the latter interest was not overridden by the interests, fundamental rights and freedoms of the data subject;
– as the two surveillance cameras were wrongfully positioned, resulting in the unlawful processing of images containing personal data, the defendants infringed article 25.1. GDPR .
The Litigation Chamber of the BE DPA therefore imposed a fine of 1,500 EUR for the infringements of article 6 GDPR. In addition, the Litigation Chamber issued a reprimand to the defendants for not respecting article 25.1. GDPR while placing their video surveillance system.
To read the original press release in French, click here. For Dutch, click here
To read the full decision (currently only available in Dutch), click here
Fur further information, please contact the Belgian DPA: contact@apd-gba.be
