A court in Germany rendered a decision on 24 September 2020, re-affirming the position of supervisory authorities and courts in Europe that processing of data by CCTV in a public area is generally prohibited. The decision should be noted because it provides a detailed analysis of the conditions under which the use of CCTV is allowed. The Mainz Administrative Court instructed the CCTV operator to switch off the security cameras during certain hours and to limit the reach of the cameras.
Another interesting take from the case is that, even where the CCTV operator collects special categories of data, Article 9 of the GDPR, which regulates the processing of special categories of personal data, does not apply. The reason for non-application, as the court explained, is that it is not the intention of the CCTV operator to process special categories of data.
Facts of the case and the procedural history
The plaintiff is the owner of a property located along the highway (“Plaintiff“). A shopping centre, a parking lot and a two-sided billboard are located on the property. To protect his billboard, the Plaintiff installed four static video cameras to monitor the billboard or its surroundings. Cameras no. 3 and no. 4 essentially capture the billboard, but also monitor a part of the street, parking lot, and nearby building. Camera no. 2 monitors the parking lot and the shopping centre. Camera no. 1 records the area where a street joins the highway. All four cameras are in operation non-stop and have a resolution that can capture a vehicle registration number and features of a person. The recordings are kept for 48 hours and then automatically deleted. Only the Plaintiff has access to the locked recording device and the recordings. There is a pictogram on the parking lot, indicating video surveillance.
The supervisory authority (“SA”) of the German State Rhineland-Palatinate warned the Plaintiff that the operation of the CCTV system violated GDRPR, and after the Plaintiff did not abide by the warning the SA ordered measures against the Plaintiff. The SA requested the Plaintiff to dismantle the camera no. 1 and to switch off the camera no. 2 during the opening hours of the shopping centre. As for the cameras capturing the billboard (the cameras no. 3 and no. 4), the SA decided that the Plaintiff should not use them to monitor the street, parking lot, and nearby building. The Plaintiff refused to abide and brought an action before against the SA before the administrative court.
Legal framework for the court’s analysis
Plaintiff claimed that the video monitoring of his billboard was lawful because he had a legitimate interest to protect his property and to prevent, or at least be able to collect evidence of, criminal offenses against his property. He argued that in the past criminal acts were committed on the site, such as burglaries, graffiti and hit-and-run offences. Also, some people disposed used oil on the property. It was to be expected that criminal acts would be committed also in the future, because the area of a shopping centre is especially vulnerable to criminal activities. Plaintiff also argued that the monitoring of billboards was successful because the system had not yet been attacked or damaged. He argued that the monitoring was necessary because the security-related purpose of video surveillance could only be achieved by such a measure, and that the area of the street and the highway had to be monitored to identify the perpetrators by the vehicle registration number.
The SA claimed that the monitoring of public traffic areas and prosecution of crime are state tasks and could not be performed by the Plaintiff. Such monitoring affects the rights of road users to a considerable extent and is unlawful if there was no prior criminal behaviour. The rights of the affected data subjects prevail, because many passers-by are monitored although they act lawfully. Regarding the camera no. 2 (recording the parking lot and the shopping centre), the recording must be limited to the period outside the opening times of shopping centre, because large number of people, including children, are in the parking lot during opening hours and their fundamental rights and freedoms outweigh the interests of the Plaintiff. Cameras no. 3 and no. 4 must capture the billboard only, because it is not necessary to monitor parts of the public traffic area to fulfil the purpose of the cameras’ use.
The court found that there was no proper legal basis under Article 6 GDPR for the processing as carried out by the Plaintiff up to that point. There was no consent of the data subjects, and the legitimate interest requirements were not met. It is not necessary to use video surveillance to the extent the Plaintiff used them for the purpose of preventing and collecting evidence of criminal offences. Also, even if it were necessary to use the cameras, a balancing test showed that the interests of data subjects would override the Plaintiff’s interest for the use of cameras to such extent. The court concluded that the camera no. 1, recording the area where a street joins the highway, should not record at all, that camera no. 2 should record only outside of the opening hours of the shopping centre, and that cameras no. 3 and 4 should only record the billboard.
No (or limited) necessity
Regarding camera no. 1, recording the juncture of the street and the highway, the court reasoned that the monitoring with the aim to prevent and collect evidence of criminal offenses is only necessary if there is a risk that goes beyond the general risks in life. Such higher risk can only result from actual events, and subjective fears or a feeling of insecurity are not sufficient. The court established that the fact that the billboard had not been damaged did not prove that the CCTV system was effective and necessary. Shopping centre was monitored by camera no. 2 and other cameras at the shopping centre, but that had not deterred burglars. Therefore, unrestricted monitoring was not necessary and, as such, was impermissible.
However, criminal offences had been committed in the shopping centre area. Plaintiff also explained in a credible and comprehensible manner that he was a well-known entrepreneur and that the committed crimes were partly an attack on his personality. Because of this, the court concluded that there was indeed a risk for the billboard that justifies the recording by the camera no. 2, monitoring the parking lot and the shopping centre. The court put a caveat, however: the monitoring was necessary only outside the opening hours of the shopping centre when not many people are in the vicinity of the billboard. It was possible that the camera would record a crime and that the perpetrator could be identified and criminally prosecuted with the help of the recordings.
Since the Plaintiff confirmed that the aim of the cameras no. 3 and 4 is to record the billboard solely, the cameras should not record anything else.
Balancing test
The court then examined whether, if it was necessary to use the cameras, the interests of data subjects overrode the Plaintiff’s interest and thus made the processing unlawful. The court concluded that the Plaintiff’s interest to protect his property by non-stop monitoring of public areas (street, highway, parking lot, shopping centre, and the nearby building) did not override the interest of data subjects’ fundamental rights, except for the monitoring of the parking lot and the shopping centre outside of the opening hours of the shopping centre, due to previous criminal offences.
According to the court, the following criteria must be taken into account when applying the balancing test: the type and scope of the collected data, the group of people affected, the existence of alternative options, and the type and scope of the processing of the collected data.
In the present case, it was in favour of the Plaintiff that the cameras recorded statically and did not have a zoom option, and, in the case of the camera no. 1, the data subjects generally did not linger for a long time in the traffic areas monitored. Although the court did not state that explicitly, these factors arguably concerned the criteria concerning the scope of the processing and the scope of collected data.
Also, the court appreciated that only the Plaintiff viewed the video recordings in the event of an incident and the recordings are automatically deleted after 48 hours. This conclusion arguably concerned the criterion concerning the scope of the processing.
The court examined other means which could achieve the same purpose, and concluded with regard to cameras nos. 2, 3 and 4 that there were no less intrusive means available. The Plaintiff stated that the insurance of the advertising system at issue would cost € 10,000 annually, which would be economically unreasonable, as would be the hiring of security personnel to guard the billboard. Fencing the area would not guarantee sufficient protection, because objects could be thrown onto the billboard from outside the fence. Physical protection, such as a plexiglass pane in front of the billboard, is also ruled out, because according to the information provided by the Plaintiff, the display would heat up during operation and the heat would have to be eliminated. In addition, reflections from the sun could blind drivers, and disrupt the display of advertisements.
However, according to the court, these arguments were not strong enough to justify the targeted, secret monitoring, based on the use of the camera no. 1, of individuals in public areas. It is the state’s task to prosecute administrative, and criminal offenses. Many persons who have no intention to damage the property of the Plaintiff were affected by the monitoring. Besides, passers-by could not see the pictogram that indicates the video surveillance.
Regarding the camera no. 2 (monitoring the parking lot and the shopping centre), commission of a crime is unlikely during the centre’s opening hours and therefore the monitoring was justifiable only outside of opening hours.
Plaintiff himself confirmed that the aim of the cameras no. 3 and 4 was to record only the billboard, and that they were recording the parking lot and the nearby building only for technical reasons.
No processing of special categories of data
The camera resolution made it possible to collect special categories of personal data. External appearance of the monitored data subjects may reveal their racial and ethnic origin, political opinion, religious or ideological convictions, health data or sexual orientation. However, according to the court, the Plaintiff was not concerned with recording these special categories of personal data. The Plaintiff intended to use video surveillance to prevent crime and collect evidence of criminal offences for use in court proceedings. With the CCTV, he received a mixed data set of particularly sensitive and non-sensitive data, with no intention of processing the sensitive data. In the absence of an intention to process sensitive data, there were no particular risks for the concerned data subjects, so Article 9 paragraph 1 GDPR was not applicable.
Key takeaways
- Existence of a security risk, which purportedly justifies the use of a security camera, is to be determined in an objective manner: subjective fears or a feeling of insecurity are not sufficient.
- Security reasons do not justify indiscriminate use of video surveillance. Such reasons may provide a basis for lawful use of one camera, or for the use of a camera in one mode, but not for the other.
- Use of a camera may be permissible, or not, depending on how much the camera records, both in terms of space and time. Security camera should not “collaterally” record areas and individuals of no relevance for ensuring the security of objects or persons and should only be employed during the hours when a security risk genuinely exists.
- Cameras by its nature capture individual’s features that amount to special categories of data; that, however, does not trigger application of strict rules concerning the processing of special categories of data, so long as the user of the camera does not seek to process such data.
[Note: Serbian Data Protection Act and the current draft of Montenegrin Data Protection Act mirror the provisions of GDPR. The decisions of supervisory authorities and courts in EU member states may therefore serve as an instructive guidance for compliance with local regulations.]
