The case law across Europe on the use of video surveillance is possibly richer than case law on any other data protection issue – but there is always some new aspect for a decision-making body to examine and for lawyers to learn about. Most recently, the Swedish data protection authority (Datainspektionen) helped polish our understanding of when the use of video surveillance is unlawful. A housing company, the data controller in the case, took major steps towards compliance, only to find in the end that the Datainspektionen considered the processing unlawful and issued a fine equaling EUR 30,000.
The housing company, Uppsalahem AB, used for nearly three months a video camera in one of its apartment buildings, to prevent or detect the disturbances and harassment which had been going on in the stairwell for a long time. The complainant in the case before the Datainspektionen was, in fact, the person responsible for the disruptive behavior of which other tenants complained. The shooting area of the camera included the hallway at the ground floor and the two apartment doors: that of the complainant and that of his neighbor, a victim of the complainant’s disturbances and harassment. The cameras could also record parts of the apartments’ interior when the doors opened. After the company installed the camera, the disorderly behavior immediately ended.
The issue for the Datainspektionen to decide was whether the use of the video surveillance was lawful on the basis of the company’s and tenants’ “legitimate interests”, within the meaning of Article 6(1)(f) of the GDPR.
Legitimate interest analysis
Working against the housing company was the fact that, when the complainant or the neighbor opened the apartment doors, the camera could film parts of the halls of the apartments. The Datainspektionen stated that the company could have implemented technical measures to make the recording less intrusive, e.g. by masking parts of the camera’s recording area, especially the apartment doors, and by adjusting the camera’s shooting range. Another factor which proved to weigh heavily against the company was that the camera recorded the building’s ground floor as the common area, so that all residents in the building were subject to surveillance on the way to and from their homes.
Working in favor of the housing company were numerous other elements:
- The company pursued legitimate interests of the company and the residents.
- The purpose was to remedy the disturbances that had occurred in the property for a long time and escalated in 2019. A landlord is in fact obliged under Swedish law to take action to end any disturbances in the rental property, and tenants have the right to compensation if the landlord does not take such measures. For its part, the Court of Justice of the EU has ruled (case C-708/183, TK v. Asociaţia de Proprietari bloc M5A-ScaraA, judgment of 11 December 2019) that association of co-owners of a building had a legitimate interest to protect the property, health and life of the tenants, and Datainspektionen agreed that a landlord also has that legitimate interest.
- Although the Datainspektionen did not make an explicit use of that phrase, clearly the legitimate interests were “present and effective” as at the date of the data processing (rather than speculative), which is a requirement articulated by the Court of Justice in TK v. Asociaţia de Proprietari bloc M5A-ScaraA (para. 44).
- Surveillance was necessary to safeguard the legitimate interests of the company and the residents. The housing company had taken alternative and less privacy-sensitive measures before the camera was installed, however those measures had not produced the intended effect. After the camera was installed, the disturbances in the stairwell ended immediately.
- The company used the video surveillance in a way that limited the invasion of privacy, insomuch as:
- no one was watching the footage or listening to the recording real-time;
- the recording was stored only locally, in the camera;
- access to the material was restricted to five executives with specific roles in handling potential disturbance cases. In fact, no one accessed the recorded material during the entire period of the camera’s use; and
- the company did not share the material with any external actor.
Balance of interests – in favor of the complainant
In the balancing of the interests of the company and residents on the one hand, and the complainant’s “interest in privacy” (the phrase used by the Datainspektionen throughout the decision), on the other hand, the data protection authority concluded that the complainant’s interest prevailed.
In the key part of the decision, the Datainspektionen pointed to the fact that, due to the positioning of the camera at the ground floor, all residents in the apartment building were subject to surveillance on the way to and from their homes. In particular, the privacy of the complainant and his immediate neighbor were heavily affected, as the camera’s recording range included the entrances of the two apartments.
To the facts as described above, the Datainspektionen applied a legal standard working against the housing company. Under that standard, a data subject should not reasonably expect to be subject to surveillance in living areas. EDPB’s Guidelines 3/2019 on processing of personal data through video devices, of 30 January 2020, state so, in para. 37. Consistent with that approach, the Datainspektionen‘s own case law holds that, as a rule, the monitoring of common spaces in apartment buildings is impermissible.
Intriguing questions the decision did not address
Even on a relatively simple issue such as the use of video surveillance in an apartment building, the act of balancing legitimate interests of the data controller and third parties against the interests and rights of the data subject appears unpredictable. While in the present case the housing company could have easily identified a few additional measures (masking, adjusting the shooting range) which would have tipped the balance further in the company’s favor, one cannot be sure whether it would have sufficed. What remains less than clear after reading the decision is what measures – if any – would have sufficed for the controller to conduct the data processing in accordance with the GDPR and avoid a fine.
The Datainspektionen seems to have taken it for granted that the hall on the ground floor is a living area, but that conclusion is not obvious. After all, people spend on average no more than a few seconds there.
Leaving aside the issue of whether the hall is a living area, one may still conceive a set of changed circumstances, easily within the housing company’s reach, and wonder what the Datainspektionen would conclude in that case. The company could have obtained consents from the complainant’s neighbor and from a preponderant majority of the residents, all annoyed by the complainant’s disruptive behavior. Would, in that case, with the masking and the adjusting of the shooting range, the legitimate interests of the complainant and possibly one or two non-consenting tenants, not to be monitored, still outweigh the legitimate interest of the company and the consenting neighbors to use video surveillance at the ground floor? While the Datainspektionen was not obliged to examine such alternative scenario, a few additional hints in the decision would have helped to orient the data protection practitioners struggling to locate the point at which the balancing act works in favor of one or the other party.
[Note: Serbian Data Protection Act and the current draft of Montenegrin Data Protection Act mirror the provisions of GDPR. The decisions of supervisory authorities and courts in EU member states may therefore serve as an instructive guidance for compliance with local regulations.]
Photo by Bernard Hermant on Unsplash
