Legal Updates - Free movement of personal data

Data Protection – Data Protection – Data Processing for Personal Use – Free movement of personal data

In the recent case of Rynes v Urad pro ochranu osobnich udaju [2014] all ER (D) 174 (Dec), the Court of Justice of the European Union (“CJEU”) ruled that the operation of a camera system, installed by an individual on his family home for the purposes of protecting the property, health and life of the home owners, but which also monitored a public space, did not amount to the processing of data in the course of a purely personal or household activity.

Background

• The applicant installed a camera system under the eaves of his family home to protect the property, health and life of his family and himself because the applicant and his family had been subjected to attacks by unidentified persons.
• The camera was in a fixed position and could not move.
• During the period from 5 October 2007 and 11 April 2008, the camera recorded the entrance to his home, the public footpath and the entrance to the house opposite.
• On 6-7 October 2007, the window of the applicant’s home was smashed from a shot from a catapult and the video surveillance identified two suspects.
• The video recording from the night of the attack was given to the police and was subsequently relied upon in criminal proceedings.
• On 4 August 2008, a request was made on behalf of one of the suspects for confirmation that the surveillance system was lawful.
• Upon investigation, it was found that the applicant had infringed Czech law, specifically that:

as a data controller, he had used a camera system to collect, without their consent, the personal data of persons moving along the street or entering the house opposite; - he had not informed those persons of the processing of that personal data, the extent and purpose of that processing, by whom and by what means the personal data would be processed, or who would have access to the personal data; and - as a data controller, the applicant had not fulfilled the obligation to report that processing to the Office. The second indent of art 3(2) of Directive (EC) 95/46 of the European Parliament and of the Council (on the protection of individuals with regard to the processing of personal data and on the free movement of such data) (the Directive) provided, inter alia, that the Directive should not apply to the processing of personal data; '- by a natural person in the course of a purely personal or household activity'.

• After the challenge by the applicant was dismissed by the Prague City court, the applicant appealed to the Supreme Administrative Court, which decided to stay proceedings and refer the question to the CJEU.
• The question that was referred was: on a proper construction of the second indent of art 3(2) of the Directive, the operation of a camera system, as a result of which a video recording of people was stored on a continuous recording device such as a hard disk drive, installed by an individual on his family home for the purposes of protecting the property, health and life of the home owners, but which also monitored a public space, amounted to the processing of data in the course of a purely personal or household activity, for the purposes of that provision.

Article 3Directive 95/94/EC

Scope

1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.

2. This Directive shall not apply to the processing of personal data:

in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law;

by a natural person in the course of a purely personal or household activity

Decision

• The CJEU ruled that:

It was clear from art 1 of the Directive and recital 10 thereto, that the Directive was intended to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data.

In that connection, according to settled case-law, the protection of the fundamental right to private life guaranteed under art 7 of the Charter required that derogations and limitations in relation to the protection of personal data should apply only in so far as was strictly necessary

• The above meant that the second indent of art 3(2) of the Directive had to be construed narrowly.
• The CJEU further ruled that:

The second indent of art 3(2) of the Directive should be interpreted as meaning that the operation of a camera system, as a result of which a video recording of people was stored on a continuous recording device such as a hard disk drive, installed by an individual on his family home for the purposes of protecting the property, health and life of the home owners, but which also monitored a public space, did not amount to the processing of data in the course of a purely personal or household activity, for the purposes of that provision

How can we help?

RT Coopers can assist you in meeting your obligations under the Data Protection Act. We conduct audits on businesses’ operations in order to determine specific weaknesses to be considered by data controllers. Once these are identified, we would advise you on the remedial measures you should put in place.