A natural person (the controller) – Court Ruling (Estonia, 2025)

A natural person (the controller) installed CCTV cameras on his property. Aside from his own property, the cameras covered a part of the property of a neighbour (the data subject) as well as the public road. The data subject filed a complaint with the DPA to challenge the recording of his property. The DPA held that the controller had no legal basis for recording the data subject’s property and the public road. On these grounds, it issued an injunction against the controller to stop the unlawful processing (by dismantling the cameras or restricting their field of view) or, as an alternative, to suspend the recording and later provide DPA with a written assessment of his legitimate interest to process personal data (Article 6(1)(f) GDPR). The controller unsuccessfully challenged the decision with the Tallinn Administrative Court and later escalated the case to the Tallinn District Court. The District Court of Tallinn dismissed the controller’s challenge. = The DPA and the lower court both held that the case at hand did not fall under the household exemption of Article 2(2)(c) GDPR. In this regard, the DPA and the lower court referred to Ryneš, a pre-GDPR era ruling of the CJEU. According to Ryneš, the household exemption (then found under Article 3(2) of the now-repealed Data Protection DirectiveDirective 95/46/EC (available [https://eur-lex.europa.eu/eli/dir/1995/46/oj/eng here]).) does not apply to CCTV surveillance when the cameras also cover public space. On the other hand, the controller held that the household exemption applied to his case and that the Ryneš ruling was irrelevant because it applied Article 3(2) of the Data Protection Directive rather than 2(2)(c) GDPR. The Tallinn District Court upheld the previous findings: the household exemption did not apply to the case for the reasons clarified in Ryneš, i.e. the cameras covered public ground. The Court also clarified that Ryneš was still relevant to the case at hand because Article 2(2)(c) GDPR does no