DPA case 3R-741 – €2,000 Fine (Lithuania, 2024)

The data subject is a child attending a school managed by the controller. The controller installed a video surveillance system in the classroom. This system was active also during school hours, therefore recording the images of both teachers and pupils. The parent of a data subject filed a complaint with the DPA. The controller argued that this processing activity was based on Article 6(1)(f) GDPR, since it had the legitimate interest of ensuring the safety of its property, employees and visitors. Moreover, it pointed out that it needed to use a CCTV system because pupils sometimes stole school equipment or damaged the controller’s property. First, the DPA noted that, before relying on the legal basis provided for by Article 6(1)(f) GDPR, a controller must carry out a legitimate interest balancing test, assessing if the interests of the data subject override the interest of the controller. On this point, the DPA referred to the [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf WP29 “Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC”]. According to the latter, the impact of processing on the interests or fundamental rights and freedoms of the data subject is the decisive criterion in assessing the balance. Both positive effects and negative effects should be taken into account when assessing the impact of processing. The DPA held that, in the case at hand, the controller had not taken into account the negative impact and effects on minors of a continuous video surveillance during school hours. The DPA pointed out that the controller had considered other risks such as cyberattacks or accidental deletion of data, but still did not assess the impact of video surveillance on minors. In addition, the DPA found that the fact that the controller experienced some property damage is not a reason to apply the extreme measure of video surveillance during the cl