Use of camera surveillance: unlawful filming of public domain and private property
The Belgian Data Protection Authority (‘BDPA’) recently issued a decision regarding camera surveillance by a natural person. It concerned the unlawful filming of the public domain and private property with security cameras. The Belgian DPA decided that the defendants violated the provisions of the GDPR, resulting in a fine of 1.500 EUR.
The Belgian DPA received a complaint from two data subjects regarding the unlawful filming of the public domain and their private property with security cameras. In this case, the defendants had a video surveillance system installed on their premises consisting of five cameras. The neighbors of the defendants filed a complaint with the BDPA as certain cameras filmed part of the public domain and the private property of the plaintiffs -which the plaintiffs were informed of by a third party (independent expert) in the course of an ongoing environmental lawsuit between the plaintiffs and the defendants.
Those images provided in the court case by the independent expert were -according to the plaintiffs -not only the evidence of unlawful recording of the public domain and their private property, but also of the unlawful transmission of the recordings of those images to unauthorized third parties (i.e. the independent expert).
In its decision, the BDPA emphasized that the European Court of Justice has previously confirmed that the recording of images of persons with surveillance cameras falls under the concept of 'personal data' within the meaning of the EU data protection standards. The surveillance by means of video recordings of individuals, which are stored, is an automated processing of personal data within the meaning of Article 2(1) of the GDPR. The processing of personal data in this context must therefore also benefit from the same level of protection as provided for by the GDPR.
Regarding the filming, the defendants invoked their legitimate interest (“maximize the protection of their property”) as legal basis. The BDPA decided that the conditions for the use of this legal bases for processing were not fulfilled.
Firstly, the processing of the personal data was not necessary for the purposes of the legitimate interests as less intrusive measures were possible, e.g. by the adjustment of the position of the surveillance cameras.
Secondly, the BDPA stated in its decision that such interests cannot override the fundamental rights and freedoms of the data subject. The fact that the surveillance cameras had been set up in a manner of continuous monitoring, i.e. 24 hours a day, 7 days a week, of the public domain and the plaintiffs private property, constituted a serious infringement according to the BDPA.
In addition, the BDPA indicated that, the filming did not only interfere with the (fundamental) rights of the plaintiffs. Other people, such as the children of the plaintiffs and drivers passing by on the road in front of the defendants' house, were also being recorded and therefore their (fundamental) rights were also violated.
Regarding the transmission of the recordings, which is a processing activity in the meaning the GDPR, the BDPA decided that no legal ground existed for the transfer of the recordings to the independent expert and thus violated the provisions of the GDPR.
For both infringements, the Belgian DPA issued a reprimand and imposed a fine of EUR 1,500.