de korpschef van politie, de politie – Court Ruling (Netherlands, 2024)

The Dutch police deployed Mobile Camera Cars (MCAs) in Rotterdam during the COVID-19 pandemic to enforce public health measures, such as social distancing and ban on gatherings. The MCAs captured 360-degree video footage of public spaces, including streets, parks, and residential areas, where individuals (including children) were identifiable. The footage was transmitted to a central monitoring room and could be forwarded to other police units. The police failed to conduct a Data Protection Impact Assessment (DPIA) before deploying the MCAs, despite the high-risk nature of the data processing. A DPIA was only conducted after the processing had already begun. The Dutch DPA imposed a fine of €50,000 on the police for violating Article 4c(1) of the Dutch Police Data Act, which requires a DPIA for high-risk processing activities. The police then apealled the decision. The District Court of The Hague ruled that the police violated Article 4c(1) of the Dutch Police Data Act by failing to conduct a DPIA before processing personal data. However, the court found that the violation was limited to one day (May 20, 2020), as the DPIA was completed before further processing occurred. The court also considered the exceptional circumstances of the COVID-19 pandemic and reduced the fine from €50,000 to €30,000, deeming the original fine disproportionate given the limited duration of the violation and the low likelihood of recurrence. The use of the MCAs has been discontinued. The Court found that an image of a person captured by a camera falls under the concept of personal data, as the person concerned can be identified through it. The fact that the people were not actually identified by the police does not alter this. The personal data were collected and forwarded to the control room in the performance of police duties, so that this constitutes processing of police data. The film images are stored chronologically and therefore have a structure in time. It is not necessary that images are searchable for characteristics of the filmed persons. The Court clarified that processing based on the Dutch Police Data Act does not automatically pose a high risk. However, in this case the processing of the camera images using the MCAs probably resulted in a high risk to the rights and freedoms of individuals. Although 360-degree camera images are not new in itself, the use of such cameras on (fast) moving cars is. Unlike the use of 360-degree cameras in fixed camera surveillance or on a mobile mast, the use of such cameras on a moving car makes it possible, for example, to follow people and make camera images of them. Moreover, personal data is collected in publicly accessible spaces from both adults and children, while they may not know that data is being collected or how it is being used. Furthermore, it may be impossible for people to prevent themselves from being subjected to such processing. The police had to take into account the possibility that camera images would also be made of large groups of people and that this could go beyond the nature of incidental monitoring. Furthermore, the purpose for which the camera images were made contributed to an increased risk to the rights and freedoms of individuals. The aim was to identify people and a violation of the emergency ordinance could lead to the imposition of a fine. In addition to being viewed live, the images could also be forwarded and saved. The Court found that there was no force majeure situation that justified the police not drawing up a DPIA before processing personal data. The police had sufficient time to carry out a DPIA.