DPA case Decision 04-07-2022 – Complaint Upheld (Croatia, 2022)

The tenants (the controller) of a residential building in Zagreb installed surveillance cameras that captured the co-owned space as well as the public surface. A data subject complained about this fact to the Croatian DPA which in turn started an investigation and asked the controller for submissions. The controller argued that the CCTV system had been bought online, installed and maintained by the controller. The owner also added that only two persons had access to the cameras and no video recording or storage had ever taken place. During the investigation, the DPA determined that the cameras indeed partially monitored the public space of the city of Zagreb. The Croatian DPA noted that video surveillance constitutes processing of personal data and, as such, requires a legal basis under Article 6(1) GDPR. In this case, the controller had no legal basis to monitor the public space next to the residential building. This was confirmed by [https://azop.hr/national-legislation/ Article 26 of the Croatian Act on the Implemendation of the General Data Protection Regulation] which only allows video surveillance for a purpose that is necessary and justified for the protection of persons and property. It further noted that [https://azop.hr/national-legislation/ Article 32(1) of the Act on the Implemendation of the General Data Protection Regulation] prohibits private parties from monitoring public space. The DPA found a violation of Article 6(1) GDPR and ordered the controller, pursuant to Article 58(2)(d) GDPR, to adjust the location of the cameras within 15 days so that they do not monitor public space and to provide footage confirming that the infringement was rectified.