It is good to know that the CJEU is always watching. Or at least, it is broadly content with those who are in its recent decision of Case C-708/18 TK v Asociatia de Proprietari bloc M5A-ScaraA .
TK was a reference about the installation of CCTV cameras in the common parts of his apartment building, in order to improve security. The focus of the question referred by the Romanian court was, in the view of the CJEU, on whether the inevitable automatic processing carried out by the cameras was “necessary” within the meaning of the first data protection principle, and proportionate under the legitimate interests processing condition.
The CJEU noted that on the facts there had been a history of burglary and vandalism in the apartment building, which had not been deterred by the prior installation of an entry control system. However, importantly, the CJEU also held at [44] that while the legitimate interests pursued by the processing must be present and effective, and not hypothetical, at the date of the processing that did not mean it was required that “the safety of property and individuals was previously compromised”. In other words, preventative measures which involve processing are permissible if properly justified.
The CJEU re-emphasised that the legitimate interests condition requires processing to apply only so far as strictly necessary, which means it should not be able to be achieved as reasonably effectively by less restrictive measures. The principle of data minimisation also forms part of that balance: at [46]-[48]. That balance cannot be determined by Member States, but must allow for individual cases: at [53].
As to that, the CJEU noted that other security measures had been unsuccessfully tried, but also commented that the controller must examine whether it was necessary to run the CCTV constantly (or could do so only at night or outside working hours), and whether it could block or obscure images from areas where surveillance is unnecessary: at [51]. This is phrased only as something the controller must consider, not must achieve, but does risk a certain air of unreality. Crime does not usually confine itself only to the hours of darkness, unless the apartment block was being terrorised by some delinquent badgers.
The fact specific balancing must take account of factors such as the nature of the data, particularly if potentially sensitive in nature, the nature and methods of processing involved, and especially the number of persons having access to the data and the methods for doing so, along with the reasonable expectations of the data subject, as well as the undisputed legitimacy of the interest of the block owners in protecting the property, and the health and lives of its inhabitants: at [57]-[59].
How that balanced played out was left to the referring court, with (unusually) very little by way of hint as to the correct answer. Hopefully some keen Romanian data protection court watchers will let us know in due course. In the meantime, the balancing continues.
This post was first published on the Panopticon blog and is reproduced with permission.
