A recent judgment of the Court of Justice of the European Union allows the possibility for a national law to permit the installation of a video surveillance system in the communal areas of a building even without the consent of one of the interested parties, based upon legitimate interest, in accordance with the requirements established in the now repealed Directive 95/46/EC.
Article 7.f) of the aforementioned directive establishes that legitimate interest must be evaluated by weighing up the interests or fundamental rights and freedoms of the interested party against the legitimate interest of the party responsible for data processing. In this case, the party responsible was the resident’s association, as an entity formed by the owners of the property as a whole.
The case resolved by the ECJ originates in Romania, where a resident’s association passed, in the general meeting, the decision for the installation of a video surveillance system in the building, wherein only one of the owners opposed the decision, deeming that it breached the right to a private life. Consequently, this owner did not give consent for the processing of personal data in the form of video surveillance recordings of the communal areas of the building where the owner lived.
The national regulations established that the processing of data of a personal nature may only be carried out with the express and unequivocal consent of the interested party. However, one of the exceptions to the general rule allows data processing for the purpose of protecting the life, physical integrity or health of the subject of the data processing or of another person under threat.
Thus, the ECJ undertakes an evaluation of the interests of both parties in the conflict, assessing in part the severity of the violation of the rights of the interested party who opposed the data processing, and differentiating between personal data being stored in sources of information accessible to the public or sources of information not accessible to the public.
This evaluation puts the interests of the affected party, taking into account that their data would be stored in sources of information not accessible to the public, in contrast with the importance of legitimate interest to the rest of the owners, upon which the decision to install a video surveillance system is based, i.e. to guarantee the security and peace of mind of the inhabitants of the building (protection of the property, health and life).
Finally, the ECJ resolves that the national Romanian law referring to legitimate interest did not conflict with the data protection laws in force at the time (Directive 95/46/EC), now transferred and updated into the provisions of the GRPD, leaving the evaluation to the court of first instance as to whether the satisfaction of the legitimate interest pursued by the residents’ association (safeguarding security and the protection of persons and property) should prevail over the interests of the affected property owner in particular.
Currently, the assessment of the legitimate interests of the parties for the processing of personal data without the consent of the interested party is regulated in article 6.1.f) of the GRPD. Likewise, in order to arrive at the point of making this assessment, previously the principles established in article 5 of the GRPD regarding adequacy, relevance and limitation of the data to those who are strictly necessary for obtaining the desired results must be complied with.
Andreas Terán
Vilá Abogados
For more information, please contact:
17th January 2020
