Granit Bostad Beritsholm – €17,600 Fine (Sweden, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
After a complaint by some tenants of apartments in a building, the data subjects, concerning unauthorized camera surveillance in apartment building in Malmo and impairment of data subjects´ right of information, the Swedish DPA started an investigation. The investigation revealed eighteen cameras in all entrances to the buildings, garage, shared wet rooms, with some pointing towards some apartment doors. The data subjects unsuccessfully requested information about the data processed to the controller, as the information on the controller´s website was not exhaustive. When the DPA requested the same information, the controller replied that they took over the camera system from the previous owner of the building and that, given that the neighborhood had precedents with bicycle thefts, attempted burglaries, storage break-ins, car break-ins and vandalism, the cameras were installed for safety reasons. It was specified that the recording activated through motion detection and that no real time surveillance or audio recording took place. Moreover, the data was stored for 14 days and only three people had access to the footage. The DPA considered two main issues: the legal basis for the presence of the eighteen cameras under Article 6(1)(f) GDPR, and the possible violations of the right of information under Article 13 GDPR. Violation of Article 6(1)(f) GDPR First, the DPA considered that interest required was legitimate, as protecting property, health and life falls within the scope of Article 6(1)(f) GDPR. Second, the DPA conceded that alternative and less invasive measures were taken previously and that these measures did not have the same efficacy as camera surveillance. Third, the DPA considered that CCTV surveillance in residential environments is, as a starting point, very sensitive from a privacy point of view. However, this privacy interest varies on the basis of the specific areas of surveillance. The DPA considered each of the surveilled areas and found: -
GDPR Articles Cited
After a complaint by some tenants of apartments in a building, the data subjects, concerning unauthorized camera surveillance in apartment building in Malmo and impairment of data subjects´ right of information, the Swedish DPA started an investigation. The investigation revealed eighteen cameras in all entrances to the buildings, garage, shared wet rooms, with some pointing towards some apartment doors. The data subjects unsuccessfully requested information about the data processed to the controller, as the information on the controller´s website was not exhaustive. When the DPA requested the same information, the controller replied that they took over the camera system from the previous owner of the building and that, given that the neighborhood had precedents with bicycle thefts, attempted burglaries, storage break-ins, car break-ins and vandalism, the cameras were installed for safety reasons. It was specified that the recording activated through motion detection and that no real time surveillance or audio recording took place. Moreover, the data was stored for 14 days and only three people had access to the footage. The DPA considered two main issues: the legal basis for the presence of the eighteen cameras under Article 6(1)(f) GDPR, and the possible violations of the right of information under Article 13 GDPR. Violation of Article 6(1)(f) GDPR First, the DPA considered that interest required was legitimate, as protecting property, health and life falls within the scope of Article 6(1)(f) GDPR. Second, the DPA conceded that alternative and less invasive measures were taken previously and that these measures did not have the same efficacy as camera surveillance. Third, the DPA considered that CCTV surveillance in residential environments is, as a starting point, very sensitive from a privacy point of view. However, this privacy interest varies on the basis of the specific areas of surveillance. The DPA considered each of the surveilled areas and found: -
Related Enforcement Actions (0)
No other enforcement actions found for Granit Bostad Beritsholm in SE
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
12 November 2024
Authority
Integritetsskyddsmyndigheten
Fine Amount
€17,600
200,000 SEK
GDPRhub ID
gdprhub-8667About this data
Cite as: Cookie Fines. Granit Bostad Beritsholm - Sweden (2024). Retrieved from cookiefines.eu
Last updated: