Datatilsynet – Violation Found (Norway, 2020)

The Norwegian DPA (Datatilsynet) had issued a reprimand to a local missionary organization for what the DPA said was unlawful use of private camera surveillance footage (i.e. lacking legal grounds for processing under Article (6)(1)(f)). The Norwegian Privacy Appeals Board (Personvernrådet) overturned this decision, as they concluded that the missionary organization had indeed legal grounds as per Article (6)(1)(f) to process the personal data in question. The case revolved around neighbours A and B, who had a conflict. B had installed camera surveillance on her property and some footage revealed A's seemingly harassing behaviour towards B. B shared this footage with C, a deputy member of the board of a local missionary organization, where A was a board member. C further involved D, the chairman of the organization. Based on the footage they'd viewed, C and D questioned if A was suited to be a member of the board. They presented the footage to A and her husband (whom A had requested to be there), and following some discussions, A withdrew from the board. A then submitted a complaint to the DPA, for what she felt was unjust and unlawful processing of her personal data in the surveillance footage. The question here was consequently: did the missionary organization have legal grounds to process the footage, based on Article (6)(1)(f)? The DPA held that they didn't, after their review of the three necessary elements of legitimate interest: 1) First, the DPA concluded the missionary organization had a legitimate interest to process the personal data. 2) Second, the DPA held, however, that the processing was *not* necessary to achieve this interest, and therefore, 3) the balancing test should go in favor of the data subject (in this case "A"). Thus, the DPA concluded that the conditions for relying on Article (6)(1)(f) was not fulfilled. On the contrary, the Norwegian Privacy Appeals Board considered that the second condition of legitimate interest was indeed fulfilled,