Dragefossen AS – €13,050 Fine (Norway, 2021)

In December 2019, the Norwegian DPA (Datatilsynet) was contacted by the National Criminal Investigation Service regarding a tip they had received about a webcam livestreame from a town's city centre, and consequently launched an investigation. The company (Dragefossen AS, the controller) had installed a camera on the roof of the building they were located in. The camera rotated 360 degrees in the span of two minutes, but due to the setup, only about 270 degrees was in practice captured. A public road, the parking lot and entrance to several shops, a liquor store, bank, the town hall and several other buildings were recorded. Footage was then livestreamed to their YouTube channel, which had 1090 subscribers on 26 May 2020 and 1530 subscribers on 1 October 2020. The DPA noted that they did not know how many in total had viewed the livestream, which had started on 19 August 2019, but that a prior livestream sent on 28 January 2019 had received 13,000 views during 140 days. Recordings were saved on a dedicated server for 14 days before deleted, and had been shared with the police on several occasions in relation to events in the city centre. The controller had informed about the webcam on their Facebook page and claimed that it was setup as a service to the town's inhabitants. They claimed that due to the low quality and distance of the recording, number plates or faces would not be recognisable. = The DPA agreed with the controller's claim that it was unlikely that number plates or faces of people would be recognisable due to the distance and the quality of the recording. The DPA highlighted, however, that it would be possible to recognise the type of car someone was driving, what type of clothes people were wearing, the colour of their hair and rough hair style. The DPA highlighted that prior knowledge about someones schedule, shopping patterns, their car or their look could identify the person being recorded, for example by friends, significant others, fami