PL SA responds to the issue of surveillance cameras collecting data from neighbors' properties

The President of the Personal Data Protection Office, Mirosław Wróblewski, ordered the cessation—within seven days of delivery of the decision—of the processing of personal data by means of video surveillance, which covered a public road and neighboring properties.

The complainants pointed out that there are several cameras. They record both video and audio 24 hours a day. In their complaint to the President of the Personal Data Protection Office, the neighbors argued that the collected data is processed without their consent. The residents feel harassed and have a sense that their privacy is being violated, which negatively affects their daily lives. One of the cameras was allegedly directed directly at the toilet window in the neighboring building.

The President of the Personal Data Protection Office requested the owner of the monitoring system to provide explanations, but the owner failed to respond to the correspondence on two occasions. However, the lack of response cannot block the actions of the supervisory authority. Therefore, the President of the Personal Data Protection Office assessed the facts on the basis of the materials collected in the case from the complainants and on the basis of his own findings. He considered the complainants' allegations to be proven. Evidence in administrative proceedings may include, for example, witness testimony or visual inspection.

In the opinion of the President of the Personal Data Protection Office, the provisions of the GDPR do not apply to the processing of personal data by means of video surveillance by a natural person only if the scope of surveillance from which the recordings originate covers that person's property.

The so-called household or personal exception referred to in Article 2(2)(c) of the GDPR does not apply in this case. This provision stipulates that the provisions of the GDPR do not apply to the processing of personal data by a natural person in the course of a purely personal or household activity. According to the judgment of the Court of Justice of the European Union (CJEU) of December 11, 2014, in case C-212/13 František Ryneš v Úřad pro ochranu osobních údajů Ryneš, "(...) the processing of personal data is covered by the derogation provided for in the second indent of Article 3(2) of Directive 95/46 only if it is carried out in the course of a purely personal or household activity of the person who carries out the processing. (...) In so far as video surveillance, such as that at issue in the main proceedings, extends even partially to the public sphere and thus extends beyond the private sphere of the person carrying out the processing, it cannot be regarded as an activity of a purely ‘personal or household’ nature (...). The use of a camera system that stores images of persons on recording equipment, such as a hard disk, installed by a natural person in their family home for the purpose of protecting the property, health, and life of the owners of the home, which system also monitors public space, does not constitute data processing in the course of activities of a purely personal or household nature. Thus, the CJEU opted for a narrow interpretation of this exception, covering only activities that fall within the scope of an individual's private or family life.

Pursuant to Article 58(2)(c) of the GDPR, the President of the Personal Data Protection Office ordered the cessation of the processing of the complainants' personal data by means of video surveillance covering their image and voice, covering the public road and the complainants' property, in the absence of a legal basis for such processing. In the opinion of the President of the Personal Data Protection Office, clear evidence of non-processing of data by means of video surveillance will be the dismantling of such devices or their permanent removal from the disputed surveillance area, i.e., exclusively to the complainant's property.

In its decision, the supervisory authority also referred to the fact that the property owner used CCTV surveillance, among other things, to initiate proceedings in cases of misdemeanors. The President of the Personal Data Protection Office emphasised that ensuring public order is not the responsibility of private entities and that this task cannot be performed by means of private video surveillance. The defendant is not authorised to replace state authorities in this matter.