FEDERAL ADMINISTRATIVE COURT
ON BEHALF OF THE PEOPLE
JUDGMENT
BVerwG 6 C 2.18
OVG 12 B 7.16
Announced on March 27, 2019
In the administrative dispute
the 6th Senate of the Federal Administrative Court at the hearing on March 27, 2019
by the presiding judge at the Federal Administrative Court Prof. Dr. Kraft and the judges at the Federal Administrative Court Dr. Heitz, Dr. Möller, Hahn and Dr. Tegethoff
found to be right:
Tenor:
The plaintiff’s appeal against the judgment of the Higher Administrative Court of Berlin-Brandenburg of April 6, 2017 is dismissed.
Orders the applicant to pay the costs of the appeal proceedings.
Reasons:
I.
The plaintiff, a dentist, is challenging a data protection order for video surveillance in her practice. Her practice is located in a building that houses several doctors’ surgeries and a day clinic for psychiatry. The front door of the practice is not locked during opening hours; the reception desk is not manned. Above the counter there is a digital camera that takes pictures in real time. The images can be viewed on monitors that the plaintiff has set up in the treatment rooms (so-called camera-monitor system). The plaintiff has stated that she does not use the option of saving the images. The camera monitors the area behind the reception desk as well as those areas in which visitors remain after entering the practice without hindrance (area in front of the reception desk, corridor between the entrance door and the desk and part of the waiting area leading off the corridor). On the outside of the entrance door and at the counter, the plaintiff has affixed a sign with the inscription “Video-secured”.
In 2012, the defendant state data protection officer ordered the plaintiff, among other orders, to align the camera in such a way that the areas open to visitors are no longer recorded during the practice’s opening hours. With regard to this order, the action for annulment, which the plaintiff brought in January 2013 following the rejection of its objection, was unsuccessful in the lower courts.
In the appeal judgment, the High Administrative Court essentially stated: The use of the camera monitor system objected to by the defendant constituted unlawful video surveillance. Such a measure is only permitted to private individuals if the persons concerned consent to it or if the legal requirements for permissibility are met. This was not the case here. The signs did not justify the assumption that the visitors to the practice consented to being observed with the help of a digital camera. It is not clear from the plaintiff’s submission that video surveillance is necessary to protect legitimate interests. There are no indications that the practice is exposed to an increased risk of becoming the scene of criminal acts. The plaintiff could prevent theft by ensuring that no valuables were left in the reception area and that patients took their valuables into the treatment room. The plaintiff did not substantiate in any way the argument that without video surveillance, the costs of operating the practice would be considerably higher. It was reasonable for her to staff the reception desk with an employee already working in the practice. This employee could also take care of “injected” patients in the waiting area. In view of the above, the interests of the visitors in not being observed by a digital camera outweighed the opposing interests of the plaintiff.
With the appeal allowed by the Higher Administrative Court, the plaintiff continues to pursue its legal protection objective of obtaining the revocation of the defendant’s order on the orientation of the digital camera in order to be able to continue the video surveillance according to its ideas. It maintains that the measure is necessary for security and cost reasons. In contrast, the adverse effects on visitors were not overly significant.
The defendant defends the appeal judgment. The plaintiff could also avoid surveillance by keeping the front door of her practice locked and opening it when the doorbell rings.
II.
The plaintiff’s admissible appeal is not justified. The contested judgment does not violate federal law (Section 137 (1) no. 1 VwGO). The Higher Administrative Court correctly assumed that the defendant’s independently contestable order to exclude the area of the dental practice accessible to visitors from observation by a camera-monitor system by aligning the digital camera accordingly is not covered by § 38 para. 5 sentence 1 in conjunction with § Section 6b para. 1 of the Federal Data Protection Act in the version published on January 14, 2003 (Federal Law Gazette I p. 66), applicable here in the version of Art. 1 No. 15 of the Act amending data protection regulations dated August 14, 2009 (Federal Law Gazette I p. 2814) – BDSG old version -.
The relevant point in time for assessing the lawfulness of this order is the time at which the notice of objection was issued; the decision on the appeal therefore depends on the data protection law applicable at that time (1.). The observation of the area of the dental practice accessible to visitors constitutes video surveillance within the meaning of § 6b para. 1 BDSG old version (2.). According to this provision, the observation is inadmissible because it is not necessary to protect the legitimate interests of the plaintiff. Based on this, the defendant instructed the plaintiff to direct the camera in a different direction without making an error of judgment (3.). Due to the time of assessment, the disputed order is not to be measured against Regulation (EU) No. 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119 p. 1) – GDPR – which came into force during the appeal proceedings (4.). Irrespective of this, video surveillance would also be inadmissible under this regulation (5.).
1.a) The defendant based the disputed order on Section 38 para. 5 sentence 1 BDSG old version; this law was in force until May 24, 2018 (Art. 8 para. 1 sentence 2 of the Act on the Adaptation of Data Protection Law to Regulation 2016/679 and on the Implementation of Directive 2016/680 of June 30, 2017 ). According to Section 38 para. 5 sentence 1 BDSG (old version), the supervisory authority was able to order measures to remedy identified breaches in the collection, processing or use of personal data to ensure compliance with this law and other data protection regulations. The provision enabled the supervisory authority to put an end to any unlawful handling of personal data. To this end, it empowered the supervisory authority to take action against any conduct or situation in which the provisions of data protection law for the protection of personal data were not observed. According to the definition of § 3 para. 1 BDSG (old version), these were individual details about the personal or factual circumstances of an identified or identifiable natural person (data subject). It had to be possible to determine their identity from the information.
According to Section 38 para. 5 sentence 1 BDSG (old version), the supervisory authority had to decide at its own discretion which measures it would take to ensure the protection of personal data as required by data protection law. To this end, it was able to grant the person or body responsible pursuant to Section 3 para. 7 BDSG (old version) for the unlawful collection, processing or use of such data. The procedure had to be based on how data protection concerns could best be taken into account in the future (BT-Drs. 16/12011 p. 44). The supervisory authority also had to observe the principle of proportionality when determining the specific content of a measure. For example, it could refrain from imposing a specific obligation on the controller to take action to remedy the breach if it appeared promising to leave the manner of remedy to the controller (Plath, in: Plath, BDSG/DSGVO, 2nd ed. 2016, Section 38 BDSG para. 62; von Lewinski, in: Auernhammer, DSGVO/BDSG, 5th ed. 2017, Section 38 BDSG para. 75).
b) Irrespective of the fact that the requirements for action such as the change in the orientation of the digital camera imposed on the plaintiff are constantly updated because they are accompanied by the obligation to maintain the newly created condition in the long term, such measures are to be assessed in accordance with Section 38 para. 5 sentence 1 BDSG old version, such measures must be assessed in accordance with the law applicable at the time of the last decision by the authorities. This follows from the fact that this provision provides the supervisory authority with discretionary powers for the action to be taken in the event of a breach of data protection law. The judicial review of an official discretionary decision relates to the time at which the discretion was exercised if nothing to the contrary arises from the substantive law (cf. on such an exception: BVerwG, judgment of November 15, 2007 – 1 C 45.06 – BVerwGE 130, 20 para. 14 et seq.). A discretionary decision is characterized by the fact that the authority can choose between several legally permissible alternative courses of action because they are covered by the scope of the discretionary powers. The administrative courts only review these selection decisions to a limited extent in accordance with Section 114 sentence 1 VwGO. In particular, they are prevented from substituting their own selection considerations for those of the authority. Dies schließt es grundsätzlich aus, Ermessensentscheidungen anhand von tatsächlichen und rechtlichen Erkenntnissen nachzuprüfen, die die Behörde nicht in ihre Erwägungen einbeziehen konnte, weil sie zum Zeitpunkt der Ermessensausübung noch nicht vorlagen (BVerwG, Urteile vom 20. May 1980 – 1 C 82.76 – BVerwGE 60, 133 and April 6, 1989 – 1 C 70.86 – BVerwGE 81, 356 ; BFH, judgment of March 26, 1991 – VII R 66/90 – BFHE 164, 7 ).
According to the regulatory content of Section 38 para. 5 sentence 1 BDSG old version, no other time of assessment is required. Rather, the exercise of discretion to determine the obligations to act or refrain from acting to be imposed on the controller as a remedial measure must be based on the nature of the breach of data protection law. Whether an infringement has occurred must in turn be assessed according to the law applicable at the time of the last decision by the authorities.
Accordingly, the legality of the disputed order depends on the legal situation that applied at the time of the defendant’s objection decision in January 2013. This is because the defendant, as the opposition authority pursuant to Section 68 para. 1 sentence 1 VwGO to review the legality and expediency of its order, i.e. to make its own discretionary decision again. This means that any subsequent changes in the law are irrelevant for the decision on the action for annulment and thus on the appeal. The plaintiff is entitled to have the order set aside pursuant to Section 113 para. 1 sentence 1 VwGO if this was unlawful when the notice of objection was issued.
2. the observation of the area of the dental practice accessible to visitors by a camera-monitor system is to be measured against the admissibility requirements of Section 6b para. 1 BDSG, old version, because it is video surveillance. The provision contained two conclusive regulations: Firstly, it defined the term video surveillance. For this purpose, publicly accessible rooms must be monitored with optical-electronic equipment. Secondly, Section 6b para. 1 BDSG old version defined the requirements for their permissibility. Video surveillance that is not covered by Section 6b para. 1 BDSG old version were prohibited.
a) According to the legal definition, video surveillance can only take place in publicly accessible rooms. The authorized party, i.e. the holder of the domiciliary right, must have opened the room to an indefinite number of persons. Dedication may be limited to allowing access to the room for a specific purpose only. The decisive factor is that the authorized person has made it possible for persons unknown to him to enter the room unhindered, in particular without prior admission control, and to stay there. This is typically the case for business premises open to the public (Onstein, in: Auernhammer, DSGVO/BDSG, 5th ed. 2017, Section 6b BDSG para. 12 ff.; Becker, in: Plath, BDSG/DSGVO, 2nd ed. 2016, Section 6b BDSG para. 9 f.). Accordingly, the visitor area of the plaintiff’s practice, i.e. the area in front of the reception desk, the corridor between the entrance door and the reception desk and the waiting area leading off the corridor, is publicly accessible. The plaintiff has decided that anyone can enter this area of her practice unhindered during actual visiting hours by opening the unlocked entrance door.
b) Video surveillance also requires that the publicly accessible space is observed with an optical-electronic device. The controller must use technical means that are intended to produce moving images and make them perceptible (Onstein, in: Auernhammer, DSGVO/BDSG, 5th ed. 2017, Section 6b BDSG para. 17; Becker, in: Plath, BDSG/DSGVO, 2nd ed. 2016, Section 6b BDSG para. 12). A camera monitor system is such a device. Observation within the meaning of Section 6b para. 1 BDSG (old version) means any intentional perception of external events over a period of time. The images captured by the camera do not have to be recorded. It is sufficient that the moving images can be viewed in real time on a screen. However, the person responsible must collect personal data through the observation, i.e. obtain it (see Section 3 (1) and (3) BDSG old version). For this purpose, persons must be recognizable in the images in such a way that they can be identified. This is the case with the images provided by the plaintiff’s camera-monitor system because the faces of the persons observed are recognizable.
The fact that observation does not require the image recordings to be recorded follows on the one hand from the fact that the permissibility of processing or using the data obtained through observation is regulated separately in Section 6b para. 3 BDSG old version is regulated separately. On the other hand, the regulatory content of Section 6b para. 1 BDSG old version, which ultimately makes the permissibility of surveillance dependent on the result of a weighing of the interests of the controller and the data subject, but also the legislative history of the provision, show that the federal legislator regarded the use of an optical-electronic device as an impairment of the data subject’s right to informational self-determination even without recording the image material (BT-Drs. 14/4329 p. 38; BR-Drs. 461/00 p. 92).
In doing so, the federal legislature has taken into account the potentially behavior-directing effects of video technology for those affected (cf. BVerfG, Chamber decision of February 23, 2007 – 1 BvR 2368/06 – BVerfGK 10, 330 ). Experience has shown that these effects occur even if the images are not recorded, especially as the data subjects often do not know whether they are being recorded (Onstein, in: Auernhammer, DSGVO/BDSG, 5th ed. 2017, Section 6b BDSG para. 19; Becker, in: Plath, BDSG/DSGVO, 2nd ed. 2016, Section 6b BDSG para. 13). The Court of Justice of the European Union (CJEU) also emphasizes that Directive 95/46/EC, the provisions of which the federal legislator implemented in the Federal Data Protection Act in force until 24 May 2018, must be interpreted in such a way that a high level of protection is guaranteed for the benefit of the data subjects due to the specific intrusive nature of the collection and processing of personal data (CJEU, judgments of 11 December 2014 – C-212/13 [ECLI:EU:C:2014: 2428] – para. 27 f. and of June 5, 2018 – C-210/16 [ECLI:EU:C:2018:388] – para. 26).
c) The admissibility requirements of Section 6b para. 1 BDSG old version apply to video surveillance by non-public bodies within the meaning of § 2 para. 4 BDSG old version, i.e. by private individuals such as the plaintiff, even if they do not use a data processing system within the meaning of § 1 para. 2 No. 3 BDSG old version. According to this provision, such use was a prerequisite for the Federal Data Protection Act to apply to the collection, processing and use of personal data by these bodies. However, the Higher Administrative Court correctly assumed that this restriction for video surveillance was not applicable due to the special provision of Section 6b para. 1 BDSG old version did not apply. It follows from the purpose and system of this provision that the federal legislator recognized a general need for protection of the data subjects with regard to video surveillance. In order to also guarantee this protection vis-à-vis private controllers, it defined the term “video surveillance” in Section 6b para. 1 BDSG old version and thereby excluded the applicability of § 1 para. 2 No. 3 BDSG old version (report and resolution recommendation, BT-Drs. 14/5793 p. 61 f.). Accordingly, the admissibility requirement of safeguarding legitimate interests for specifically defined purposes pursuant to Section 6b para. 1 no. 3 BDSG (old version) concerns video surveillance for private purposes (see under 3.b)). Video surveillance in the public interest, namely for the fulfillment of the tasks of public bodies within the meaning of Section 2 para. 1 to 3 BDSG old version (no. 1) are already covered by § 6b para. 1 no. 1 BDSG old version.
Irrespective of this, a camera monitor system is a data processing system within the meaning of Section 1 para. 2 No. 3 BDSG old version. This includes technical devices of all kinds if they record or use data in an automated process. This is regularly the case in particular when digital camera technology is used for observation (BT-Drs. 14/5793 p. 62).
d) According to all of the above, video surveillance is not exempt from the application of Section 6b BDSG old version even if it is exclusively for personal or family activities within the meaning of Section 1 para. 2 No. 3 BDSG old version. Moreover, such monitoring generally goes beyond the personal or family sphere of the controller because it necessarily takes place in publicly accessible areas.
3. the video surveillance of the area of the plaintiff’s dental practice accessible to visitors constitutes a violation of data protection regulations in the collection of personal data within the meaning of § 38 para. 5 sentence 1 BDSG old version, because the data subjects have not consented and the admissibility requirements of § 6b para. 1 BDSG old version are not met (Section 4 (1) BDSG old version).
a) Legally valid consent must be based on a free decision. The data subjects must be informed of the intended purpose of the measure. Consent must be given in writing, unless another form is appropriate due to special circumstances (Section 4a (1) sentences 1 to 3 BDSG old version).
Accordingly, it is obvious that even clearly visible notices about the surveillance do not justify the conclusion that persons are expressing their legally valid consent to the surveillance by entering the monitored area (cf. BVerfG, Chamber decision of February 23, 2007 – 1 BvR 2368/06 – BVerfGK 10, 330 ; BVerwG, judgment of January 25, 2012 – 6 C 9.11 – BVerwGE 141, 329 para. 25). The signs on the outside of the entrance door and on the counter of the plaintiff’s practice with the inscription “Video secured” are irrelevant to the permissibility of the video surveillance.
b) According to § 6b para. 1 BDSG old version, private individuals such as the plaintiff are entitled to carry out video surveillance on their premises to which they grant public access under two conditions: Firstly, the measure must be necessary for the exercise of domestic authority (no. 2) or to safeguard legitimate interests for specifically defined purposes (no. 3) must be necessary. If this is the case, the legitimate interests of the controller must outweigh the interests of the data subjects to be spared from observation. Video surveillance that is not necessary is always inadmissible. There is no need to weigh up the interests because the controller cannot put forward any reasons that justify restricting the data subject’s right to informational self-determination.
The justification grounds “domiciliary right” and “legitimate interests” cannot be strictly distinguished, but overlap in terms of content. The domiciliary right is the means that enables the person entitled to a room to determine whether and for what purpose other persons may enter the room and stay there (OVG Münster, judgment of 8 May 2009 – 16 A 3375/07 – juris para. 44; OVG Saarlouis, judgment of December 14, 2017 – 2 A 662/17 – CR 2018, 505 ; Onstein, in: Auernhammer, DSGVO/BDSG, 5th ed. 2017, Section 6b BDSG para. 28; Becker, in: Plath, BDSG/DSGVO, 2nd ed. 2016, Section 6b BDSG para. 16; Scholz, in: Simitis, BDSG, 8th ed. 2014, Section 6b para. 73). It is true that the authorized party can use its domiciliary rights as an opportunity to “show visitors the door”. However, the regulatory system of Section 6b para. 1 BDSG (old version) shows that he cannot invoke his domiciliary rights at will in order to carry out video surveillance. Rather, he must be able to rely on a legitimate interest, i.e. a “good reason”. This can be any subjective interest if it is fundamentally worthy of protection and objectively justifiable (see BTDrs. 14/5793 p. 61).
It is up to the authorized party to explain the reasons why they consider video surveillance of their premises to be appropriate. Based on the information provided, it must be assessed whether and to what extent the measure is necessary within the meaning of Section 6 para. 1 BDSG old version. As part of their duty to clarify the facts, authorities and courts must work towards ensuring that the authorized party explains or supplements the reasons given. According to the generally accepted understanding of the term, necessity is to be assumed if a reason, such as a risk situation, is sufficiently substantiated by facts or general life experience and cannot be taken into account just as well by another equally effective but less intrusive measure. In particular, measures that do not affect the right to informational self-determination of visitors to publicly accessible areas are less intrusive than video surveillance.
According to this standard, the Higher Administrative Court, on the basis of the binding facts established by it pursuant to Section 137 para. 2 VwGO, the Higher Administrative Court rightly assumed that the reasons cited by the plaintiff could not justify the necessity of video surveillance of the visitor area of her dental practice during opening hours. It can therefore be left open whether the video surveillance also proves to be unnecessary because the plaintiff can be instructed to keep the entrance door to her practice locked, i.e. to remove the dedication of the visitor area as publicly accessible. The information provided by the plaintiff is to be assessed as follows:
The plaintiff has argued that unhindered access to her practice could be exploited in order to commit crimes there undetected. The aspects of preventing and investigating criminal offenses generally constitute legitimate interests within the meaning of Section 6b para. 1 no. 3 BDSG old version. However, they can only justify video surveillance as objectively justifiable if there is a risk situation that goes beyond the general risk of life. Such a risk can only arise from actual findings; subjective fears or a feeling of insecurity are not sufficient (cf. OVG Saarlouis, judgment of December 14, 2017 – 2 A 662/17 – CR 2018, 505 ; Scholz, in: Simitis, BDSG, 8th ed. 2014, Section 6b para. 78 and 79).
The High Administrative Court did not establish any facts that support the assumption that the plaintiff’s dental practice poses an increased risk that goes beyond the general risk of life. Accordingly, there is no factual evidence to suggest that the practice could become the scene of burglaries, assaults and acts of violence during opening hours. The building in which the practice is located is not in an area with an increased risk potential. The plaintiff has not claimed that a criminal offense has occurred in her own or another doctor’s practice located in the same building. The patients of the day clinic for psychiatry have behaved inconspicuously.
The fact that narcotics and valuables such as dental gold are stored in the practice is not in itself suitable to justify a particular risk of theft during opening hours. The theft of narcotics and valuables, which according to the plaintiff’s submission are located in the area of the unoccupied reception desk, can be prevented by the plaintiff by ensuring that they are stored in lockable cabinets or containers, preferably in other areas of the practice. The plaintiff can counter the risk of patients’ valuables being stolen from the waiting area during treatment by encouraging patients to take their valuables into the treatment room. She can also provide containers that can be locked after inserting a coin or chip.
Finally, the waiting area of the practice does not need to be monitored in order to be able to quickly help patients sitting there, especially after treatment. For example, these patients can be given a push button that they can press in an emergency to summon help. This is also preferable because, according to the findings of the Higher Administrative Court, video surveillance only covers part of the waiting area.
The plaintiff has not even begun to demonstrate that it is dependent on video surveillance in order to reduce the operating costs of its practice. The desire to save costs is, in principle, a legitimate interest within the meaning of Section 6b para. 1 No. 3 BDSG (old version). This applies to the interest in avoiding personnel costs incurred by hiring employees. However, the controller must demonstrate that these costs cannot be avoided or kept to an acceptable level by taking other precautions, in particular by making organizational changes instead of video surveillance. The cost savings can only justify the necessity of video surveillance if the costs that would otherwise be incurred are significant in relation to the scope of the business activity or would even call its profitability into question (AG Berlin-Mitte, judgment of December 18, 2003 – 16 C 427/02 – NJW-RR 2004, 531 ; Becker, in: Plath, BDSG/DSGVO, 2nd ed. 2016, Section 6b BDSG para. 21).
These considerations do not need to be further specified in the present case. The plaintiff cannot invoke cost savings through video surveillance because it did not provide any verifiable information in this regard until the conclusion of the appeal proceedings. According to the findings of the Higher Administrative Court, her submission was limited to the general assertion that she would incur “many times higher costs” without the video surveillance. There is no indication as to what costs and in what order of magnitude she can save through video surveillance. The plaintiff should at least have stated what additional costs would be incurred if she were to staff the reception desk with an employee who was already employed and who would carry out administrative work (accounting, etc.).
c) The authority did not err in law in exercising the discretion granted to it by Section 38 para. 5 sentence 1 BDSG (old version) in order to determine a specific measure to remedy the violation of § 6b para. 1 BDSG old version (§ 114 sentence 1 VwGO). The duty to act imposed on the plaintiff was suitable and necessary to end the observation of the practice premises, insofar as it was a violation of Section 6b para. 1 BDSG old version.
The order to align the digital camera installed in the area of the reception desk in a certain way only affects the area of the practice that is publicly accessible during opening hours. At the same time, the plaintiff was legally obliged to permanently maintain the condition created by the changed orientation, i.e. not to return the camera to its previous position. This action by the defendant was proportionate, in particular suitable and necessary. The obligation to permanently realign the camera was the milder means compared to covering or dismantling the camera. This enabled the plaintiff to continue to use the camera for legally permissible observation of the area behind the reception desk. There are no indications of disproportionality in the narrower sense (unreasonableness) from the plaintiff’s submission (cf. on the aspect of cost expenditure under 3.b)).
4 Since May 25, 2018, the General Data Protection Regulation has been directly applicable in all member states of the European Union (Art.
99 para.
2 GDPR; Art. 288 para.
2 sentences 1 and 2 of the Treaty on the Functioning of the European Union in the version that entered into force on December 1, 2009
This change in the law has no effect on the assessment of the legality of the disputed order and thus on the decision on the appeal. The application of the General Data Protection Regulation does not follow from national data protection law because this determines the issuance of the defendant’s objection notice in January 2013 as the relevant time of assessment (see under 1.b)). Nor can it be inferred from the General Data Protection Regulation that its provisions claim validity for matters that the authorities of the Member States regulated in a binding manner before May 25, 2018 on the basis of the national law applicable at that time. The Regulation is a new set of rules aimed at harmonizing data protection law within the European Union. This means that the regulatory concepts of the Regulation may differ fundamentally from the previous data protection provisions of the Member States. This is illustrated by a comparison of the provisions of Art. 58 para. 1 and 2 GDPR on the investigative and remedial powers of the supervisory authorities with the superseded national data protection law:
National law left it largely to the discretion of the supervisory authorities as to which clarification measures they took in order to identify breaches of data protection law. In contrast, Art. 58 para. 1 GDPR contains an exhaustive list of measures. Measures taken by the authorities to clarify the facts must fall within the scope of Art. 58 para. 1 GDPR can be assigned. With the exception of access to business premises pursuant to Art. 58 para. 1 letter f GDPR (see recital 129 to the General Data Protection Regulation; Boehm, in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed. 2018, Art. 58 GDPR para. 9; Kugelmann/Buchmann, in: Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 2018, Art. 58 GDPR para. 27).
The same applies to the powers of the supervisory authorities to rectify identified violations of the law. While the general data protection clause of Section 38 para. 5 sentence 1 BDSG (old version) did not provide the supervisory authorities with any specific remedial measures, but rather gave them leeway to determine the specific content, Art. 58 para. 2 GDPR also contains a graduated catalog of measures in this respect. The action taken by the supervisory authorities against breaches of data protection law must be covered by a remedy under Art. 58 para. 2 GDPR must be covered.
Due to such differences, clear indications would have been required in the General Data Protection Regulation for the assumption that the European Union legislator not only created a uniform data protection law under Union law for the future, but also determined that data protection decisions made by the supervisory authorities under national data protection law are to be measured retroactively against the other structures of the General Data Protection Regulation. Neither the text of the General Data Protection Regulation nor the
Recitals. Rather, Art. 96 GDPR stipulates the continued validity of agreements concluded by Member States with third countries and international organizations on the transfer of personal data before 24 May 2016.
5 Notwithstanding this, the disputed order would find its basis in EU law in Art. 58 para. 2 letter d in conjunction with Art. Art. 6 para. 1 subpara. 1 letter f GDPR. The defendant therefore has no reason to comply with the
§§ 49 ff. VwVfG to examine whether it will uphold the order for the future.
a) The order to direct the digital camera in such a way that it does not cover the publicly accessible area of the plaintiff’s dental practice can be assigned to the power to remedy under Art. 58 para. 2 letter d GDPR can be assigned. This allows the supervisory authority to instruct the controller to bring processing operations into compliance with the Regulation in a specific manner and within a specific period of time. As a catch-all provision, this power is intended to cover any breach of the General Data Protection Regulation, i.e. any processing of personal data in breach of EU law (Weichert, in: Däubler/Wedde/Weichert/Sommer, EU-DatenschutzGrundverordnung und BDSGneu, 2018, GDPR Art. 58 para. 33 f.; Kugelmann/Buchmann, in: Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 2018, Art. 58 GDPR para. 91).
The images produced by the camera-monitor system used by the plaintiff contain personal data within the meaning of Art. 4 No. 1 GDPR due to the recognizability of the persons depicted (see under 2.b)). The image recordings constitute processing of this data. According to Art. 4 No. 2 GDPR, this means any operation which is carried out with or without the aid of automated procedures in connection with personal data. The obviously comprehensive list of operations in Art. 4 No. 2 GDPR that follows this definition shows that the term “processing” covers any handling of personal data.
b) The admissibility requirements for processing are conclusively regulated in Art. 6 para. 1 GDPR, whereby paragraphs 2 and 3 contain limited opening clauses in favor of the Member States. If, as in the present case, the data subjects have not given their legally valid consent to the processing of their personal data (Art. 6 para. 1 subpara. 1 lit. a in conjunction with Art. 4 no. 11 GDPR), processing operations are only lawful if they can be based on at least one of the permissions in Art. 6 para. 1 GDPR can be relied upon.
Data processing by private individuals such as the video surveillance of the plaintiff cannot be based from the outset on Art. 6 para. 1 subpara. 1 letter e GDPR from the outset. According to this provision, data processing must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. No additional consideration of the interests of the data subjects is provided for. In view of the importance of the data subject’s right to informational self-determination, this can only be justified if the scope of application of the provision is limited to official or state-initiated processing operations in accordance with its wording. The processing of personal data falls within the scope of protection of the fundamental rights to privacy under Art. 7 and to the protection of personal data under Art. 8 of the Charter of Fundamental Rights of the European Union (ECJ, judgment of December 11, 2014 – C-212/13 – para. 28).
Accordingly, Art. 6 para. 1 subpara. 1 letter e GDPR covers data processing by public authorities in the performance of their duties. Private individuals can only invoke this if they are authorized to access personal data in the public interest or in the exercise of official authority. They must act in place of a public authority. This presupposes an act of transfer by the state, however it is structured. A private individual cannot declare themselves to be the custodian of the public interest. In particular, they are not appointed to protect public safety alongside or even instead of the regulatory authorities. When protecting individual legal interests, whether their own or those of third parties, they do not pursue public interests, but private interests (Buchner/Petri, in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed. 2018, Art. 6 DS-GVO para. 111 ff.; Kramer, in: Auernhammer, DSGVO/BDSG, 5th ed. 2017, Art. 6 para. 24 f.; Pabst, in: Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 2018, Art. 6 DS-GVO para. 95; Wedde, in: Däubler/Wedde/ Weichert/Sommer, EU-Datenschutz-Grundverordnung und BDSGneu, 2018, DSGVO Art. 6 para. 87 and 89). It therefore remains to be seen whether Art. 6 para. 1 subpara. 1(e) GDPR is an independent permission or whether the provision must be filled in by EU or national provisions on official data processing in the public interest (see Schulz, in: Gola, DS-GVO, 2nd ed. 2018, Art. 6 para. 48 and 197).
It follows that the opening clauses of Art. 6 para. 2 and 3 GDPR for processing operations pursuant to Art. 6 para. 1 subpara. 1 letter e GDPR do not cover video surveillance by private controllers. As a result, there is no scope for a future application of Section 4 para. 1 sentence 1 of the Federal Data Protection Act in force since May 25, 2018 in the version of Art. 1 of the Act of June 30, 2017 (Federal Law Gazette I p. 2097) – BDSG new version – as the identical successor provision to Section 6b para. 1 BDSG old version to video surveillance by private controllers. These are bound by Art. 6 para. 1 subpara. 1 letter f GDPR. According to this, processing must be necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The two-stage review program of this provision corresponds to that of Section 6b para. 1 BDSG (old version). Processing is necessary if the controller relies on it to safeguard legitimate, i.e. protectable and objectively justifiable interests. Processing that is necessary according to this standard is permissible if the assessment in the individual case shows that the legitimate interests of the controller outweigh the data subject’s right to informational self-determination. According to Recital 47 of the General Data Protection Regulation, it is important in this regard whether the data processing is absolutely necessary for the prevention of criminal offenses, whether it is foreseeable, i.e. customary in the industry, or whether the data subjects must reasonably expect their data to be processed in the specific situation.
Accordingly, the video surveillance of the publicly accessible area of the plaintiff’s dental practice would also be permissible under Art. 6 para. 1 subpara. 1 letter f GDPR because it is not necessary to protect the legitimate interests of the plaintiff. In this respect, reference can be made to the statements on necessity pursuant to Section 6b para. 1 BDSG old version under 3.b) can be referred to.
The decision on costs follows from section 154 para. 2 VwGO.
Resolution
The amount in dispute for the appeal proceedings is set at € 5,000 (Section 47 (1) sentence 1, Section 52 (2) GKG).