The European Court of Justice (ECJ) has ruled that video surveillance of common areas in a residential building may be permissible under data protection law, and this even without the consent of the persons concerned. However, this presupposes that video surveillance is necessary to protect legitimate interests. According to the ECJ, such interests may in particular include the protection of persons and property. Furthermore, video surveillance must be the mildest means of safeguarding interests and a case-by-case approach must establish that the conflicting interests of the persons concerned by the surveillance do not prevail. The ruling points out that these requirements are relatively high and associated with many uncertainties.

1. The case

In its ruling dated 11 December 2019 (C-708/18, Asociaţia de Proprietari bloc M5A-ScaraA), the ECJ made a decision on the EU Data Protection Directive (Directive 95/46/EC). As is well known, the EU General Data Protection Regulation (GDPR) replaced this directive with effect on 25 May 2018. Because the case took place before this date, the provisions of the GDPR did not yet apply. However, the provisions of the Data Protection Directive that are relevant for the assessment of the present case are largely identical to those of the GDPR. In this respect, it is not surprising that the guidelines set by the ECJ in the present judgment are essentially the same as those recently laid down by the European Data Protection Board in its Guidelines 3/2019 on processing of personal data through video devices adopted on 10 July 2019.

In this respect, the processing of personal data within the framework of EU data protection law is generally inadmissible, except in the case of an authorisation (e.g. the consent of the data subject) (cf. Art. 7 of the Data Protection Directive and Art. 6 of the GDPR). As the central element of authorisation in video surveillance, the “safeguarding of a legitimate interest” was also central to the present ruling.

2. The three prerequisites of video surveillance without consent

In its introduction, the ECJ emphasised that video surveillance can also be permissible under data protection law without the consent of the persons concerned, provided that the conditions of another type of permission are fulfilled. The “safeguarding of legitimate interests” came into question here.  In that regard, the processing of personal data based on this permission is to be lawful when the following three conditions are met:

• the person responsible for the data processing has a legitimate interest;
• the processing of personal data is necessary for the purposes of the legitimate interests;
• the fundamental rights and freedoms of the data subject do not take precedence over the legitimate interest pursued (balancing of interests).

In the present case, the ECJ considered the objective of protecting the property, health and life of the co-owners of the residential complex as a legitimate interest in the sense of the Directive. However, the ECJ did not require that incidents which have affected the security of property and persons must already have occurred.

The second condition of necessity requires the court to examine whether the legitimate interest cannot be “reasonably be as effectively achieved by other means less restrictive”. According to the ECJ, this condition must also be examined in conjunction with the “data minimisation” principle enshrined in the Directive.

Balancing the interests of the data subjects with those of the controller is the third condition. The opposing rights and interests concerned must be weighed against each other based the individual circumstances of the particular case in question. In doing so, the fundamental right of right to respect for privacy must be taken into account.

3. Conclusion

The Regional Court of Bucharest must now carry out the balancing of interests and rule in the present case whether the prerequisites of a legitimate interest can ultimately be affirmed. However, the ECJ has indicated, at least with regard to the first two conditions, that in its opinion they are met.

In a more general manner, the ECJ’s ruling illustrates once again that the data protection requirements for video surveillance systems are relatively high. However, numerous questions remain unanswered. For example, it is regrettable that the ruling does not specify in more a detailed manner when a specific legitimate interest may exist. Especially, if the aim is not to prevent the recurrence of damage to property after it has already occurred, but if the aim is to prevent such damage from happening in the first place, if no incidents such as theft or damage to property have yet occurred.

4. Relevance for Switzerland

The ECJ’s ruling and the further development of practice in EU law are also relevant from a Swiss perspective. On one hand, it cannot be ruled out that video surveillance by Swiss companies that target their offers (also) to customers in the EU may be subject to the GDPR. In any case, the fact that surveillance takes place in Switzerland is not decisive for this question. On the other hand, comparable criteria are relevant both in the still valid Swiss Federal Act on Data Protection (FADP) (see also the judgment of the Swiss Federal Tribunal BGE 142 III 263) and in the draft for its total revision. When implementing video surveillance systems, Swiss companies should therefore also take into account the practice of EU’s data protection law.

Find the ECJ ruling here: http://curia.europa.eu/juris/document/document.jsf;jsessionid=0E1A4D6EAD015E1AEA646EFFAA754986?text=&docid=221465&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=6944995