Granit Bostad Beritsholm – €17,600 Fine (Sweden, 2024)

€17,600Integritetsskyddsmyndigheten12 November 2024Sweden
final
Fine

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

After a complaint by some tenants of apartments in a building, the data subjects, concerning unauthorized camera surveillance in apartment building in Malmo and impairment of data subjects´ right of information, the Swedish DPA started an investigation. The investigation revealed eighteen cameras in all entrances to the buildings, garage, shared wet rooms, with some pointing towards some apartment doors. The data subjects unsuccessfully requested information about the data processed to the controller, as the information on the controller´s website was not exhaustive. When the DPA requested the same information, the controller replied that they took over the camera system from the previous owner of the building and that, given that the neighborhood had precedents with bicycle thefts, attempted burglaries, storage break-ins, car break-ins and vandalism, the cameras were installed for safety reasons. It was specified that the recording activated through motion detection and that no real time surveillance or audio recording took place. Moreover, the data was stored for 14 days and only three people had access to the footage. The DPA considered two main issues: the legal basis for the presence of the eighteen cameras under Article 6(1)(f) GDPR, and the possible violations of the right of information under Article 13 GDPR. Violation of Article 6(1)(f) GDPR First, the DPA considered that interest required was legitimate, as protecting property, health and life falls within the scope of Article 6(1)(f) GDPR. Second, the DPA conceded that alternative and less invasive measures were taken previously and that these measures did not have the same efficacy as camera surveillance. Third, the DPA considered that CCTV surveillance in residential environments is, as a starting point, very sensitive from a privacy point of view. However, this privacy interest varies on the basis of the specific areas of surveillance. The DPA considered each of the surveilled areas and found: -

GDPR Articles Cited

Art. 6(1)(f) GDPR
Art. 13(1) GDPR
Art. 13(2) GDPR
Full Legal Summary

After a complaint by some tenants of apartments in a building, the data subjects, concerning unauthorized camera surveillance in apartment building in Malmo and impairment of data subjects´ right of information, the Swedish DPA started an investigation. The investigation revealed eighteen cameras in all entrances to the buildings, garage, shared wet rooms, with some pointing towards some apartment doors. The data subjects unsuccessfully requested information about the data processed to the controller, as the information on the controller´s website was not exhaustive. When the DPA requested the same information, the controller replied that they took over the camera system from the previous owner of the building and that, given that the neighborhood had precedents with bicycle thefts, attempted burglaries, storage break-ins, car break-ins and vandalism, the cameras were installed for safety reasons. It was specified that the recording activated through motion detection and that no real time surveillance or audio recording took place. Moreover, the data was stored for 14 days and only three people had access to the footage. The DPA considered two main issues: the legal basis for the presence of the eighteen cameras under Article 6(1)(f) GDPR, and the possible violations of the right of information under Article 13 GDPR. Violation of Article 6(1)(f) GDPR First, the DPA considered that interest required was legitimate, as protecting property, health and life falls within the scope of Article 6(1)(f) GDPR. Second, the DPA conceded that alternative and less invasive measures were taken previously and that these measures did not have the same efficacy as camera surveillance. Third, the DPA considered that CCTV surveillance in residential environments is, as a starting point, very sensitive from a privacy point of view. However, this privacy interest varies on the basis of the specific areas of surveillance. The DPA considered each of the surveilled areas and found: -

Related Enforcement Actions (0)

No other enforcement actions found for Granit Bostad Beritsholm in SE

This is the only recorded action for this entity in this jurisdiction.

Details

Fine Date

12 November 2024

Authority

Integritetsskyddsmyndigheten

Fine Amount

€17,600

200,000 SEK

GDPRhub ID

gdprhub-8667

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. Granit Bostad Beritsholm - Sweden (2024). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: