A natural person (the controller) – Court Ruling (Estonia, 2025)

A natural person (the controller) installed CCTV cameras on his property. Aside from his own property, the cameras covered a part of the property of a neighbour (the data subject) as well as the public road. The data subject filed a complaint with the DPA to challenge the recording of his property. The DPA held that the controller had no legal basis for recording the data subject’s property and the public road. On these grounds, it issued an injunction against the controller to stop the unlawful processing (by dismantling the cameras or restricting their field of view) or, as an alternative, to suspend the recording and later provide DPA with a written assessment of his legitimate interest to process personal data (Article 6(1)(f) GDPR). The controller unsuccessfully challenged the decision with the Tallinn Administrative Court and later escalated the case to the Tallinn District Court. The District Court of Tallinn dismissed the controller’s challenge. = The DPA and the lower court both held that the case at hand did not fall under the household exemption of Article 2(2)(c) GDPR. In this regard, the DPA and the lower court referred to Ryneš, a pre-GDPR era ruling of the CJEU. According to Ryneš, the household exemption (then found under Article 3(2) of the now-repealed Data Protection DirectiveDirective 95/46/EC (available [https://eur-lex.europa.eu/eli/dir/1995/46/oj/eng here]).) does not apply to CCTV surveillance when the cameras also cover public space. On the other hand, the controller held that the household exemption applied to his case and that the Ryneš ruling was irrelevant because it applied Article 3(2) of the Data Protection Directive rather than 2(2)(c) GDPR. The Tallinn District Court upheld the previous findings: the household exemption did not apply to the case for the reasons clarified in Ryneš, i.e. the cameras covered public ground. The Court also clarified that Ryneš was still relevant to the case at hand because Article 2(2)(c) GDPR does not differ in substance from Article 3(2) of the Data Protection Directive. = In the controller's view, the assessment of legitimate interest was up to the DPA rather than the controller. By issuing an injunction for the controller to assess its legitimate interest, the DPA essentially delegated its task to the controller, contrary to the principle of legal clarity and "the general principles of administrative law". The Court dismissed the argument. Under the principle of accountability (Articles 5(2) and 24(1) GDPR), the controller must both assess and demonstrate that the processing of personal data complies with the GDPR. Therefore, the DPA's injunction for the controller to assess its legitimate interest, simply enforced the principle of accountability and did not delegate the DPA's tasks. = The controller observed that the GDPR includes no explicit obligation to carry out a written analysis of legitimate interest. For this reason, the controller argued that the DPA's injunction to present such a written analysis, had no basis in the law. The Court conceded that there is no general obligation in the GDPR to prepare a legitimate interest analysis as a written document. However, the Court still held that the DPA's injunction was legitimate. The DPA observed that under Article 58(2)(d) GDPR, a DPA may “order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period”. The Court held that the DPA's injunction was functional to bringing the processing into compliance with the principle of accountability and that it was appropriate and not disproportionate to this purpose. Therefore, the DPA acted within its powers when it issued its injunction to provide a written assessment of legitimate interest.