T.P. – Dismissed (Bulgaria, 2023)

A data subject filed a compliant within the Bulgarian DPA (CPDP), claiming his brother unlawfully processed personal data of him and his family via video surveillance installed on a property co-owned by data subject and his brother. The property consisted of a three-level building and a yard. Data subject's brother owned the first and second floor of the building and 2/3 of the yard. The mother of brothers had a right to use the second floor and lived there. The third floor belonged to the data subject but it was his daughter who mostly lived there that time. Three cameras were installed on property, covering only the image of the property, i.e.: * access to the entrance of the house from inside, * a staircase leading to the first floor, * the entrance the apartment of data subject's brother, * a part of the yard and patio, * a corridor which gave access to three rooms in the basement. No camera covered the second and third floor of the building. The cameras were connected with a recorder and a router. The recorded videos were stored locally for a period of 2-3 days and were automatically deleted after that period. Data subject's brother and his wife were using a mobile app to monitor the area and preview recordings. Within the property, there were signs (stickers) warning about the CCTV. During CPDP inspection, another camera located on the outer fence was discovered. According to data subject's brother it was installed by data subject. It was confirmed that camera was not working, since it was disconnected from electricity. The proceedings confirmed data subject and his brother were in a private conflict. Data subject's brother explained he installed the video surveillance because of aggressive behaviour and committed acts of vandalism by data subject and his ex-wife. Hence, the data processing was based on Article 6(1)(f) GDPR. The CPDP rejected the compliant. First, the CPDP confirmed CCTV video footage was a personal data within the meaning of Article 4