DPA case NAIH/4410-1/2023 – €125 Fine (Hungary, 2023)

A solarium studio in Hungary, the controller, had installed a CCTV system within its premises. Although the decision is not clear in this regard, an individual, the data subject, whose image had been recorded by such system, objected to the processing under Article 21 GDPR. Following a notification, the DPA initiated an ex officio investigation with regard to the solarium studio’s video surveillance system. The controller argued that it had a legal basis under Article 6(1)(f) GDPR for carrying out the camera surveillance on the premises in order to, inter alia, protect the property. However, despite the DPA’s multiple requests, the controller did not provide any balancing of interests test, nor did it make any statement to the authority of having such document. Furthermore, in light of Article 13(1)(2) GDPR, the controller claimed that there were printed privacy notices available at the front desk of studio. With regard to its employees, the controller claimed that it had provided information on the processing operations orally and within the job descriptions. However, the controller did not provide evidence to support its statements. The DPA emphasised that a controller is required to make a prior balancing test under Article 6(1)(f) GDPR. However, the controller did not provide such assessment and the DPA concluded that the controller could not rely on a legitimate interest as a legal basis required under Article 6(1) GDPR. Furthermore, the DPA noted that even if a balancing of interests had been carried out, the processing at stake could have not have been justified by legitimate interests. In particular, the controller did not demonstrate the suitability of the cameras in question to the announced processing purpose (presumably, the protection of property), nor their proportionality. The DPA viewed that, in order to protect the property, other available solutions (e.g. lock, padlock, window bars, safe, alarm, motion detector, security guard, etc.) may in so