DPA case 31/20 – Dismissed (Greece, 2020)

The Complainant was working in one of the merchant's stores where a CCTV system was installed and active. The employer repeatedly had assured the employees that not only was that the field of view of the cameras the cash registers, but also that the CCTV did not capture any sound at all. The Complainant began to believe that more cameras had been installed in the store and that they were recording sound as well. Therefore, she submitted the following complaint to the Greek DPA. She also brought a court action with which she claimed damages for the unlawful processing. She claimed that some of the cameras were scoped to the WC room and the changing rooms. During the hearing, the employer declined any allegation regarding the sound recording. He also submitted a detailed list of all the cameras with recording samples for each one and clarified all the ways he used to inform visitors and staff of the existence of that CCTV system, including notices, signs and brochures, as well as the entire Company's policy of the personal data protection in written form. The Greek DPA deals with certain requirements of lawfulness of CCTV systems. The Greek Data Protection Officer argued four points: First, under Article 4(1), the Greek DPA Office confirms that visual and sound data may be considered personal data when identifiable information relating to natural persons is included. Second, indoor and outdoor video surveillance in areas which persons are invited to visit fulfils the definition of processing as per Article 4(2) of the GDPR. Third, the Greek DPA concludes that a genuine adoption of the concept of proportionality in such circumstance shall also examine (a) the lawfulness, fairness, and transparency of the processing without underestimating aspects as (b) how much further the process goes in a manner that is incompatible with announced, specified, explicit and legitimate purposes or (c) minimising the amount of data to what is absolutely necessary within those pur