C‑708/18 - Asociaţia de Proprietari bloc M5A-ScaraA

Facts — The data subject owns and lives in a flat. The building in which the flat is situated belongs to the controller (a co-owner association). After a request of co-owners of the building the controller decided to install video cameras on the premises. The data subject objected to the video cameras being installed and he claimed it constituted an infringement of the right to respect for private life. The data subject sued the controller requesting the court ordering the controller to remove the cameras. The data subject argued that the video surveillance system installed by the controller infringed his right to respect for private life both under EU and national law. The controller stated that the video cameras were installed in order to monitor who is entering the building because there had been vandalism, thefts and burglaries, and that other measures previously taken had not been effective.

The Romanian court stayed the proceedings and referred the following questions to the CJEU: (1) Are Article 8 CFR and Article 52 CFR and Article 7(f) Directive 95/46/EC to be interpreted as precluding provisions of national law such as those at issue in the main proceedings, namely Article 5(2) of [Law No 677/2001], and Article 6 of [Decision No 52/2012 of the ANSPDCP], in accordance with which video surveillance may be used to ensure the safety and protection of individuals, property and valuables and for the pursuit of legitimate interests, without the data subject’s consent? (2) Are Article 8 CFR and Article 52 CFR to be interpreted as meaning that the limitation of rights and freedoms which results from video surveillance is in accordance with the principle of proportionality, satisfies the requirement of being ‘necessary’ and ‘meets objectives of general interest or the need to protect the rights and freedoms of others’, where the controller is able to take other measures to protect the legitimate interest in question?

(3) Is Article 7(f) Directive 95/46/EC to be interpreted as meaning that the ‘legitimate interests’ of the controller must be proven, present and effective at the time of the data processing? (4) Is Article 6(1)(e) Directive 95/46/EC to be interpreted as meaning that data processing (video surveillance) is excessive or inappropriate where the controller is able to take other measures to protect the legitimate interest in question? Holding — The court held that the operation of a video surveillance camera amounted to processing of personal data and therefore it needs to rely on one of the legal basis laid down in Article 7 Directive 95/46/EC. The relevant national law that enacts Directive 95/46/EC bases video surveillance on Article 7(f) Directive 95/46/EC (legitimate interest). The court held further that this provision lays down three cumulative conditions in order for the processing to be lawful: (a) the pursuit of a legitimate interest by the controller or by the third party to whom the data are disclosed; (b) the need to process personal data for the purposes of the legitimate interests pursued; (c) the fundamental rights of the data subject do not take precedence over the legitimate interest pursued.

Additionally, the court held that that a consent of the data subject was not needed. Protecting the property, health, and life of the co-owners of the building is a legitimate interest. This interest must be present and effective during the data processing and must not be hypothetical. The court further held that to match the condition (b) from above there must be no other means that could have been used to achieve the given goal that as effective but less privacy-invasive. Furthermore, the second condition has to be assessed in conjunction with Article 6(1)(c) Directive 95/46/EC (data minimisation principle). This criterion was met due to the fact that previously taken measures did not have the intended effect. To assess the third point (c) from above, a balancing test needs to be done between the legitimate interest on the one hand and the rights and freedoms of the data subject on the other hand, in this case, the rights arising from Article 7 CFR and Article 8 CFR.

The court concluded that member states cannot anticipate the result of this balancing test for certain categories of personal data or certain cases (such as video surveillance) in their national law without leaving room to the possibility of a different result due to the individual circumstances in a certain case. The court held that in the particular case the referring court has to balance the interests against each other to determine which interest prevails. Answering the preliminary question, it held that EU law does not preclude national provisions that allow for the installation of video surveillance systems installed in the common parts of a residential building in order to protect individuals and property as long as the criteria laid down in Article 7(f) Directive 95/46/EC are met. Holding — The court held that the operation of a video surveillance camera amounted to processing of personal data and therefore it needs to rely on one of the legal basis laid down in Article 7 Directive 95/46/EC.

The relevant national law that enacts Directive 95/46/EC bases video surveillance on Article 7(f) Directive 95/46/EC (legitimate interest). The court held further that this provision lays down three cumulative conditions in order for the processing to be lawful: (a) the pursuit of a legitimate interest by the controller or by the third party to whom the data are disclosed; (b) the need to process personal data for the purposes of the legitimate interests pursued; (c) the fundamental rights of the data subject do not take precedence over the legitimate interest pursued. Additionally, the court held that that a consent of the data subject was not needed. Protecting the property, health, and life of the co-owners of the building is a legitimate interest. This interest must be present and effective during the data processing and must not be hypothetical. The court further held that to match the condition (b) from above there must be no other means that could have been used to achieve the given goal that as effective but less privacy-invasive.

Furthermore, the second condition has to be assessed in conjunction with Article 6(1)(c) Directive 95/46/EC (data minimisation principle). This criterion was met due to the fact that previously taken measures did not have the intended effect. To assess the third point (c) from above, a balancing test needs to be done between the legitimate interest on the one hand and the rights and freedoms of the data subject on the other hand, in this case, the rights arising from Article 7 CFR and Article 8 CFR. The court concluded that member states cannot anticipate the result of this balancing test for certain categories of personal data or certain cases (such as video surveillance) in their national law without leaving room to the possibility of a different result due to the individual circumstances in a certain case. The court held that in the particular case the referring court has to balance the interests against each other to determine which interest prevails.

Answering the preliminary question, it held that EU law does not preclude national provisions that allow for the installation of video surveillance systems installed in the common parts of a residential building in order to protect individuals and property as long as the criteria laid down in Article 7(f) Directive 95/46/EC are met. Comment — Share your comments here!