Bringing Information Protection Home? The Cjeu Rules On Information Protection Police Too Domicile Cctv

 

Lorna Woods, Professor of Law, University of Essex

 

Does European Union information protection law apply to dwelling CCTV cameras? The CJEU addressed that number yesterday inwards the judgment inwards Case C-212/13 Ryneš v. Úřad pro ochranuosobníchúdajů. In its judgment, the Fourth Chamber of the Court agrees amongst the Advocate-General's  opinion (discussed here), although it avoids roughly of the hard questions hinted at inwards that opinion.

This judgment is pregnant inwards ii ways. First, it has potentially broader application than only to fixed surveillance devices too could signal the agency information recording devices are used inwards populace spaces fifty-fifty past times private individuals.  Second, it forms purpose of a develop of judgments highlighting the significance of information protection for individuals. This significance is perhaps reflected inwards the fact that viii fellow member U.S. made submissions earlier the court.

 

Facts

Mr Ryneš too his seat unit of measurement had for several years been subjected to attacks past times persons whom it had non been possible to seat too the windows of the seat unit of measurement dwelling had been broken on several occasions.  As a result, he installed CCTV cameras nether the eaves of his house.  The photographic tv camera was installed inwards a fixed seat too could non turn; it recorded the entrance to his home, the populace footpath too the entrance to the theatre opposite.  The images were recorded to hard drive, too afterward over-written past times novel recordings.  A farther assail took seat but it was possible to seat the suspects because of the CCTV.  The recording was handed over to the law too relied on inwards the course of teaching of the subsequent criminal proceedings.  One of the suspects challenged the utilization of CCTV inwards this way: arguing that Mr Ryneš had non complied amongst the Czech rules implementing the European Union Data Protection Directive (DPD). Mr Ryneš essentially argued that the affair did non come upwards inside the DPD because of the application of the ‘household exception’ inwards Article 3(2) DPD. It was the ambit of that provision that was referred to the CJEU past times the national court.

 

Judgment

The Court began past times confirming that CCTV surveillance inwards regulation constitutes the processing of personal information so far equally it makes it possible to seat the individual concerned [paras 22-25].  The Court too then turned its attending to the interrogation of whether the province of affairs escaped the application of the DPD inwards so far equally it is carried out ‘in the course of teaching of a purely personal or household activity’ for the purposes of the minute indent of Article 3(2) DPD.

The Court emphasised that the purpose of the DPD is to ensure a high degree of protection for personal information – seen equally purpose of an individual’s privacy too inwards so doing referred to Google Kingdom of Spain and Google (C‑131/12), too that, next IPI (C‑473/12, para 39) too Digital Rights Republic of Ireland and Others(C‑293/12 too C‑594/12, para 52) restrictions on information protection must apply on so far equally strictly necessary [para 28].  Further, the DPD must live on construed inwards the low-cal of the Charter. These factors meant that Article 3(2) DPD should live on construed narrowly [para 29]. In the Court’s catch this approach followed also from the wording of Article 3(2) inwards whatever event: the utilization of the give-and-take ‘purely’ indicates a narrow make of circumstances. Following the reasoning of the Advocate General, the Court held that:

‘To the extent that video surveillance such equally that at number inwards the principal proceedings covers, fifty-fifty partially, a populace infinite too is accordingly directed outwards from the private setting of the individual processing the information inwards that manner, it cannot live on regarded equally an activity which is a purely ‘personal or household’ activity for the purposes of the minute indent of Article 3(2) of Directive 95/46.’ [para 33]

While the DPD applies, the Court noted the possibility of the information controller’s legitimate interests too other possible exceptions inwards the Directive existence taken into work organization human relationship [para 34] although the Court did non elaborate farther on such balancing inwards this instance.

 

Comment

This instance is non the initiative of all instance that has considered the ambit of the ‘household exception’: Lindqvist (C-101/01) was the first, which held that the ‘household exception’ did non apply to the posting of information on a spider web site. According to the Court then, the exception clearly did non apply because the making available of information to an indefinite number of people was non an activity carried out inwards the course of teaching of the private or seat unit of measurement life of an individual.  The reasoning hither is non clear, too is replete amongst assumptions (what is the seat of an on-line personal diary, for example?). It is perhaps because of the lack of clarity that the Court hither did non get upwards Lindqvist – a rather noticeable omission otherwise.  Rather it, similar the Advocate-General earlier it, went dorsum to initiative of all principles near the value too condition of information protection. This is the get-go of a flow of information protection cases – arising inwards real different circumstances – inwards which the Court has repeatedly ascribed a high value to information protection too the protection of privacy. These cases too then should live on seen non equally isolated, but equally purpose of consistent trunk of rulings on this point.  What was clearer from the Opinion inwards this instance was the fact that this high value ascribed to the protection of personal information applies equally betwixt individuals, equally good equally constraining the activities of the State.

 

While it mightiness live on measure exercise to catch exceptions equally to live on construed narrowly, the Court does non give us much information equally to how to define this inwards practice. What nosotros receive got instead is the assertion that something that impinges on a populace infinite cannot live on ‘purely’ private. Balancing of interests takes seat equally a resultant inside the framework of the DPD, essentially past times virtue of Article 7(f)DPD, which allows information processing to receive got seat inwards the legitimate interests of the information controller (in this case, the homeowner interested inwards protecting his security), balanced against the interests of the information patch of report (the criminal suspects inwards this case), rather than past times determining whether the DPD applies or not.  This approach in all likelihood allows for a to a greater extent than subtle approach to the interrogation of respective interests, although equally Article 29 Working Party (the advisory trunk made upwards of national information protection supervisors) receive got noted at that spot is non much consistency across the Member U.S. on how to translate Article 7(f) DPD (Opinion 06/2014).  There has been concern that, given the openness of its wording, Article 7(f) could live on used to undermine the effectiveness of information protection.  Here, presumably protection of private belongings would weigh heavily (the Article 29 Working Party give safety equally an representative of a ‘legitimate interest’), though the balancing of interests mightiness live on different inwards the context of someone passing inwards the street too someone visiting the theatre opposite.

 

This too then leads us to the interrogation of when else the principles inwards Ryneš mightiness apply.  The obvious representative is devices capable of recording personal information inwards populace spaces. In add-on to CCTV, drones too trunk worn video used past times local government too the law inwards the law enforcement context, nosotros should recall hither near mobile phones amongst cameras too devices such equally Google glass, which receive got already been flagged upwards equally potentially problematic inwards regulatory terms. While Google may receive got taken steps to meliorate privacy past times blueprint inwards this device, this does non absolve users from responsibleness nether the information protection regime if it applies to them.  If nosotros receive got the approach that fifty-fifty partial populace utilization of a fixed CCTV organization cannot do goodness from the household exception, nonetheless less would a portable, mayhap inconspicuous device the purpose of which is uncertain.  The reasoning seems stronger nonetheless if nosotros consider the possible onward utilization of such information – via a website for representative (though banker's complaint the Article 29 Working Party’s catch on social networking sites inwards Opinion 5/2009)– taking into work organization human relationship the catch inwards Lindqvist.  Here it is less clear to encounter that the legitimate interests of the information controller (ie the individual using the device to tape too store personal data),assuming the processing were to live on deemed ‘necessary’ to pursue that interest, would weigh heavily against a high degree of protection for information protection fifty-fifty equally betwixt individuals (see views of Article 29 Working Party on liberty of facial expression arguments inwards this context).

 

How mightiness this judgment apply to specific cases? H5N1 rear would receive got a legitimate involvement inwards photographing or filming his or her children or friends, although at that spot mightiness live on constraints (taking work organization human relationship of the Peck v UK judgment of the European Court of Human Rights, where Article 8 ECHR was breached after CCTV footage of an attempted suicide was shown on national television) on how much such footage mightiness live on shared inwards future. Indeed, wide sharing of those images (for representative uploading to a website without privacy protection equally inwards Lindqvist) could found an human activeness of processing exterior the household exception, which should hence comply amongst DPD requirements too.  Photographs taken inside the context of private too seat unit of measurement life but too then used past times journalists presumably also autumn inside the ambit of the Directive, although inwards that instance the relevant provision would live on the rather full general clause which provides for balancing the correct to privacy too the liberty of expression.

 

CCTV cameras which fully confront populace streets too areas opened upwards to the populace similar shopping malls are evidently covered past times the Directive, so processing must comply amongst the requirements of Article six of the Directive unless whatever other exceptions are applicable. CCTV used inwards workplaces would evidently non autumn inside the ambit of the household exception, so the requirements of the DPD regarding processing would apply. Depending on the nature of the footage at that spot would live on farther limits on sharing that footage (images of infirmary patients, for instance, would discover sensitive information near their health). Finally, at that spot mightiness live on hybrid locations which are both populace too private (for instance, a tending dwelling is both a residence too a workplace). Given that the Court has emphasised the household exception arises alone when the processing tin live on tied ‘purely’ to private too seat unit of measurement life hybrid locations are unlikely to live on considered inside the household exception.  In the representative of the tending home, this is peculiarly probable to live on truthful given that the information controller is probable to live on the operator of the tending dwelling using CCTV for operational reasons, rather than private ones. Of course, it would nonetheless live on possible to justify the utilization of CCTV inwards such cases inwards accordance amongst the Directive.

 

Barnard & Peers: chapter 9

 

Share this post