DPA case DSB-D213.1759 – Violation Found (Austria, 2023)

The controller, a housing association, installed 38 (active) video cameras and three dummy cameras at a residential complex after an increased number of break-ins in the basement. The cameras monitored the general areas, including entrance areas and bicycle/trash rooms. The apartment entrance doors and residents’ personal spaces were excluded from the cameras’ scope and/or rendered unrecognisable. The data subjects, the residents, were informed about this in a newsletter and on the notice board at the complex. On 03 November 2022, the Austrian DPA (‘Datenschutzbehörde’) was anonymously informed about the video surveillance system. The DPA then conducted a data protection review in accordance with Article 57(1)(h) GDPR. The controller argued that the video surveillance system was in the interest of protecting property against theft, damage, and other disruptions (in accordance with Austrian national law, Section 28 WEG) and preserving evidence thereof.  The recordings were stored for a maximum of 72 hours. The controller further argued that although the data subjects had not given their consent, it was not necessary because the legitimate interest of the controller overrode the interests of the data subjects. The proper fulfilment of a contract was also present because the data subjects reported break-ins at the complex. The controller had an obligation to take preventative measures in order to avoid damage. The DPA explained that under Article 6(1)(f) GDPR, and as reiterated by the CJEU, video surveillance operated to protect property is considered a legitimate interest. However, any data processing must comply with the principles for processing set out in Article 5(1) GDPR, particularly the principle of confidentiality under Article 5(1)(f) GDPR. As the controller argued, the controller was also fulfilling their contractual obligations in accordance with Article 6(1)(b) GDPR. However, the DPA held that the data processing must, nevertheless, comply with the cond