Court case 1 K 584/19.MZ – Court Ruling (Germany, 2020)

The plaintiff owns a LED billboard on his private property next to a shopping mall. The billboard is monitored by four CCTV cameras to protect it against vandalism. The DPA (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz) ordered to remove camera 1 that filmed a public street and to shut down camera 2 during opening hours of the shopping mall because it filmed the parking lot. Cameras 3 and 4 had to be repositioned so they do not capture the public street, the parking lot and adjacent residential building. The correct defendant is the DPA itself according to § 20(5)(2) and § 20(4) BDSG. The Court held that even if it is possible that a camera records personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership the requirements of Art. 9 GDPR do not apply because the plaintiff did not seek to process that kind of data. The legality is thus determined by Art. 6 GDPR. In the absence of consent under Art. 6(1)(a) GDPR, a balance of interests according to Art. 6(1)(f) GDPR is required. The legitimate interests pursued by the plaintiff (protection of his property) are overridden by the fundamental rights and freedoms of the data subjects who are filmed by camera 1 on a public street. The DPA was allowed to issue a reprimand, Art. 58(2)(b) GDPR. On the basis of Art. 58(2)(f) GDPR, the DPA was not entitled to order the removal of camera 1 but only the shutdown. According to Art. 58(2)(d) GDPR the DPA was entitled to order the shutdown camera 2 during the opening hours of the shopping mall and to reposition cameras 3 and 4.