On 11 December 2014, the Court of Justice of the European Union (the "ECJ") handed down a judgment on a reference for a preliminary ruling from the Supreme Administrative Court of the Czech Republic in the case of František Ryneš v. Úřad pro ochranu osobních údajů (Case C-212/13). The ECJ refused to exempt surveillance cameras in a private home from data protection rules.
The facts of the case are as follows. Mr Ryneš and his family had for several years been subjected to attacks by unknown persons. To protect his home and identify the perpetrators, Mr Ryneš installed a camera system which covered the entrance to his home, the public footpath and the entrance to the neighbours' house. One night, one of the windows of the family home was broken by a shot from a catapult. The attack was recorded by the surveillance cameras and the recordings were handed over to the police. The police identified the perpetrators and recordings were used in the course of the ensuing criminal proceedings.
However, one of the suspects filed a complaint with the Czech Office for the Protection of Personal Data. It was established that Mr Ryneš had infringed the personal data protection rules, because the suspect had been recorded without his consent while he was on the public footpath in front of Mr Ryneš' house.
The Czech Supreme Administrative Court referred the case to the ECJ to interpret Article 3(2) of Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Data Protection Directive"). This provision exempts processing of personal data by a natural person in the course of a purely personal or household activity from the scope of the Data Protection Directive. In particular, the referring court sought to know whether the operation of a camera system installed in a family home for the purposes of the protection of the property, health and life of the owners of the home would fall within the exception of Article 3(2) of the Data Protection Directive, even though such a system also monitors a public space.
The ECJ first ruled that surveillance in the form of a video recording of persons which is stored on a continuous recording device constitutes the processing of personal data as defined under Article 2(a) and (b) of the Data Protection Directive.
Second, the ECJ found that the exception provided for in the second indent of Article 3(2) of the Data Protection Directive, i.e., data processing carried out by a natural person in the course of purely personal or household activities, should be narrowly construed. Therefore, video surveillance which covers a public space and which is accordingly directed outwards from the private setting of the person processing the data cannot be regarded as a ‘purely' personal or household activity. The Data Protection Directive thus applies to data processing such as the video recordings in the case in question.
However, the ECJ pointed out that the processing may nevertheless be permitted under the Data Protection Directive. The ECJ advised the national court to take into account the legitimate interests pursued by the person who has engaged in the processing of personal data, such as the protection of the property, health and life of his family and himself. In particular, the ECJ brought the following provisions of the Data Protection Directive to the attention of the national court:
- Article 7(f), which allows processing of personal data without the consent of the data subject where it is necessary for the purposes of the legitimate interests by the controller;
- Article 11(2), which provides that the data subject should not be informed about the processing of his data where the provision of such information proves impossible or would involve a disproportionate effort; and
- Articles 13(1)(d) and (g), which allow Member States to restrict the scope of the obligations and rights provided for under the Data Protection Directive if such a restriction is necessary to safeguard the prevention, investigation, detection and prosecution of criminal offences, or the protection of the rights and freedoms of others.
This judgment shows that personal data is omnipresent in today's society, and as a result, so is the Data Protection Directive. By applying a strict interpretation of the exception for household use, the ECJ further extends the scope of application of the Data Protection Directive. The national court will assess the permissibility of the processing of personal data under national data protection rules.
