For the first time, a GDPR fine has been handed out to private individuals in the Benelux. A Belgian couple was fined 1500 euros for having installed security cameras at home that film the neighbors. The regulator hopes that the fine is a signal.
The Data Protection Authority has imposed a fine of 1500 euros to a couple. The pair had installed five security cameras around their house, two of which filmed the public road and their neighbors. After a complaint from the neighbors, the Disputes Chamber of the GBA decided to issue a fine.
The pair had the cameras installed by a company. According to the fine decision they also referred to that company; that should have told them that the cameras should not be aimed at public roads, they say. At least a third of the image from one of the cameras filmed the public road. Part of the neighbor’s facade was filmed with another camera.
The privacy watchdog blames the duo even more for not only making the images themselves, but also sharing them with others. This is how the neighbors found out that the cameras were on their house. The camera images were forwarded to an expert from the Environment Department, as part of an investigation into traffic nuisance in the area.
According to the GBA, the couple violated Article 6 of the GDPR, by incorrectly collecting the data and forwarding it to a third party. They also violated article 25, which states that ‘data processors’ must engage in data minimization and data protection. By collecting more images than was necessary, they failed to comply.
First private fine
It is the first time that a GDPR fine has been handed out to private individuals in Belgium. This has not yet happened in the Netherlands either. Supervisors are cautious about this, because they do not want to forfeit the goodwill of citizens. Due to the growing numbers of reports and complaints, regulators in almost all European countries are unable to meet what citizens hope of them. In Belgium, the regulator is now starting to focus more on citizens instead of just companies.
The rules on camera surveillance in the GDPR are clear about what is and what is not allowed. Cameras may only be aimed at public roads if there is an interest in doing so. For companies this may be the case, for example, if there is a risk of burglary. In a lawsuit from 2018 an entrepreneur successfully invoked this. It is a lot more difficult for private individuals to demonstrate such an interest. The Dutch Data Protection Authority is therefore certain: citizens are only allowed to hang a camera if they do not film their neighbors, their belongings or the public road. The privacy supervisor does state that ‘some overlap is sometimes inevitable’.
This sometimes creates friction, because usually homeowners film their own front door. That makes it difficult not to film the road. In fact, in the Netherlands the police have run a program whereby it actively calls on citizens to register private security cameras in a database. In the event of an incident in the street, the police can quickly find cameras that may have filmed it. In some cases, the police even actively encourage citizens to hang up a camera in this way. Last year research by Tweakers showed that various Dutch municipalities collaborated with the police to distribute free or cheap digital doorbells to citizens. Its purpose was to get more cameras on the street.
‘Shake up burger’
In Belgium, therefore, private individuals are viewed more strictly. A spokesperson for the regulator also confirms this. “We hope this will shake up citizens.” According to her, the fine should remind citizens that the GDPR does not only apply to companies but also to individual citizens.
The decision is not entirely unexpected, because camera surveillance is important to the GBA. It is one of the social themes that the privacy supervisor wants to devote more attention to in its ‘strategic plan 2020-2025’. ‘Photos and cameras’ is the most important watchdog category alongside online data protection and ‘sensitive data’. On the other hand, the GBA does not write anywhere about the prosecution of citizens against companies. In fact, according to that plan, the ‘priority sectors’ are the government, the telecom industry, education, direct marketing and small companies or SMEs.