de korpschef van politie, de politie – Court Ruling (Netherlands, 2024)

Court Ruling
Autoriteit Persoonsgegevens8 October 2024Netherlands
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

The Dutch police deployed Mobile Camera Cars (MCAs) in Rotterdam during the COVID-19 pandemic to enforce public health measures, such as social distancing and ban on gatherings. The MCAs captured 360-degree video footage of public spaces, including streets, parks, and residential areas, where individuals (including children) were identifiable. The footage was transmitted to a central monitoring room and could be forwarded to other police units. The police failed to conduct a Data Protection Impact Assessment (DPIA) before deploying the MCAs, despite the high-risk nature of the data processing. A DPIA was only conducted after the processing had already begun. The Dutch DPA imposed a fine of €50,000 on the police for violating Article 4c(1) of the Dutch Police Data Act, which requires a DPIA for high-risk processing activities. The police then apealled the decision. The District Court of The Hague ruled that the police violated Article 4c(1) of the Dutch Police Data Act by failing to conduct a DPIA before processing personal data. However, the court found that the violation was limited to one day (May 20, 2020), as the DPIA was completed before further processing occurred. The court also considered the exceptional circumstances of the COVID-19 pandemic and reduced the fine from €50,000 to €30,000, deeming the original fine disproportionate given the limited duration of the violation and the low likelihood of recurrence. The use of the MCAs has been discontinued. The Court found that an image of a person captured by a camera falls under the concept of personal data, as the person concerned can be identified through it. The fact that the people were not actually identified by the police does not alter this. The personal data were collected and forwarded to the control room in the performance of police duties, so that this constitutes processing of police data. The film images are stored chronologically and therefore have a structure in time. It is not necessary tha

National Law Articles

Article 4 of the Dutch Police Data Act
Decision AuthorityRb. Den Haag
Reviewed AuthorityAP (The Netherlands)
Full Legal Summary

The Dutch police deployed Mobile Camera Cars (MCAs) in Rotterdam during the COVID-19 pandemic to enforce public health measures, such as social distancing and ban on gatherings. The MCAs captured 360-degree video footage of public spaces, including streets, parks, and residential areas, where individuals (including children) were identifiable. The footage was transmitted to a central monitoring room and could be forwarded to other police units. The police failed to conduct a Data Protection Impact Assessment (DPIA) before deploying the MCAs, despite the high-risk nature of the data processing. A DPIA was only conducted after the processing had already begun. The Dutch DPA imposed a fine of €50,000 on the police for violating Article 4c(1) of the Dutch Police Data Act, which requires a DPIA for high-risk processing activities. The police then apealled the decision. The District Court of The Hague ruled that the police violated Article 4c(1) of the Dutch Police Data Act by failing to conduct a DPIA before processing personal data. However, the court found that the violation was limited to one day (May 20, 2020), as the DPIA was completed before further processing occurred. The court also considered the exceptional circumstances of the COVID-19 pandemic and reduced the fine from €50,000 to €30,000, deeming the original fine disproportionate given the limited duration of the violation and the low likelihood of recurrence. The use of the MCAs has been discontinued. The Court found that an image of a person captured by a camera falls under the concept of personal data, as the person concerned can be identified through it. The fact that the people were not actually identified by the police does not alter this. The personal data were collected and forwarded to the control room in the performance of police duties, so that this constitutes processing of police data. The film images are stored chronologically and therefore have a structure in time. It is not necessary tha

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for de korpschef van politie, de politie in NL

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

8 October 2024

Authority

Autoriteit Persoonsgegevens

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. de korpschef van politie, de politie - Netherlands (2024). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: