Lorna Woods, Professor of Law, University of Essex
A recent decision by the Court of Justice of the European Union (CJEU) in the case of Ryneš v. Úřad pro ochranuosobníchúdajů addressed whether EU data protection law applies to home CCTV cameras. The CJEU agreed with the Advocate-General’s earlier opinion on the matter, though it avoided addressing some of the more complex issues.
This judgment is significant for two reasons. Firstly, its implications extend beyond stationary surveillance systems and could impact how recording devices are used in public areas, even by private citizens. Secondly, it contributes to a series of judgments emphasizing the importance of data protection for individuals, a concern reflected in the participation of eight member states in the proceedings.
Facts
Mr. Ryneš, having experienced multiple instances of vandalism and harassment from unidentified individuals, installed CCTV cameras on his property. The cameras, fixed in place, recorded his home’s entrance, a public walkway, and a neighbor’s entrance. Footage was stored on a hard drive, with older recordings overwritten as needed. Following another incident, the CCTV footage, which successfully identified the perpetrators, was provided to the police and used in the ensuing legal proceedings. One of the suspects contested the use of the footage, alleging that Mr. Ryneš had not adhered to Czech regulations implementing the EU Data Protection Directive (DPD). Mr. Ryneš argued that the DPD did not apply due to the “household exception” outlined in Article 3(2) DPD. The national court then referred the question of this provision’s scope to the CJEU.
Judgment
The CJEU stated that CCTV surveillance, in principle, constitutes personal data processing when it allows for individual identification. The Court then addressed whether the “household exception” in Article 3(2) DPD, which exempts “purely personal or household activity,” applied in this situation.
Highlighting the DPD’s aim to ensure robust personal data protection as part of individual privacy, the Court referenced the Google Spain (C‑131/12) case and, citing IPI (C‑473/12) and Digital Rights Ireland (C‑293/12 and C‑594/12), stressed that restrictions on data protection must be strictly necessary. Additionally, the Court emphasized interpreting the DPD in light of the Charter of Fundamental Rights of the European Union. These factors necessitated a narrow interpretation of Article 3(2) DPD, a view supported by the word “purely” within the article itself. Echoing the Advocate General’s reasoning, the Court concluded:
‘To the extent that video surveillance such as that at issue in the main proceedings covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity for the purposes of the second indent of Article 3(2) of Directive 95/46.’
While acknowledging the DPD’s applicability, the Court noted the potential consideration of the data controller’s legitimate interests and other exceptions within the Directive. However, the Court did not elaborate on the balancing of these interests in this specific case.
Comment
This is not the first case examining the “household exception.” In the Lindqvist (C-101/01) case, the Court determined that posting information online did not fall under the exception, as making information accessible to an undefined public went beyond private or family life. However, the reasoning lacked clarity and relied on assumptions. This lack of clarity might explain why Lindqvist wasn’t cited in the present case. Instead, the Court, like the Advocate-General, revisited the fundamental values and status of data protection. This case marks the beginning of a series of data protection cases with diverse circumstances where the Court consistently emphasizes the significance of data protection and privacy. These cases should be viewed as a cohesive body of rulings rather than isolated incidents. What’s clear from the Opinion is the high value placed on personal data protection, not just against state actions but also between individuals.
The Court doesn’t provide specific guidelines for defining the narrow interpretation of exceptions. Instead, it asserts that actions impacting public spaces cannot be “purely” private. Consequently, the balancing of interests occurs within the DPD framework, primarily under Article 7(f), which allows data processing in the data controller’s legitimate interests (e.g., the homeowner’s security) balanced against the data subject’s interests (e.g., the suspects). This approach might allow for a more nuanced consideration of respective interests, though the interpretation of Article 7(f) DPD lacks consistency across member states, as noted by the Article 29 Working Party. Concerns exist that the broad language of Article 7(f) could be used to weaken data protection. In this case, protecting private property would likely carry significant weight (with the Article 29 Working Party citing security as a “legitimate interest”), but the balance might shift when considering passersby versus individuals visiting the house opposite.
This raises the question of other situations where the Ryneš principles might apply, such as devices recording personal data in public spaces: CCTV, drones, body cameras used by law enforcement, camera-equipped mobile phones, and devices like Google Glass, which have already raised regulatory concerns. While Google has taken steps to enhance privacy by design, it doesn’t exempt users from data protection regulations if applicable. If even partial public use of fixed CCTV can’t benefit from the household exception, portable, potentially inconspicuous devices with uncertain purposes are even less likely to qualify. This reasoning strengthens when considering the potential sharing of such data online (though note the Article 29 Working Party’s stance on social networking sites in Opinion 5/2009), especially given the Lindqvist ruling. In such cases, it’s less evident that the data controller’s legitimate interests (e.g., the individual recording and storing personal data), assuming the processing is deemed “necessary,” would outweigh the need for a high level of data protection, even between individuals (see Article 29 Working Party’s views on freedom of expression arguments in this context).
How would this judgment apply to specific situations? A parent would have a legitimate interest in photographing or filming their children or friends, though limitations might exist on sharing this footage (considering the Peck v UK judgment, where Article 8 of the European Convention on Human Rights was violated when CCTV footage of a suicide attempt was broadcasted). Sharing such images widely (e.g., uploading to an unprotected website as in Lindqvist) could constitute processing outside the household exception, requiring DPD compliance. Photos taken in a private and family context but used by journalists likely fall under the Directive, with the balancing act between privacy and freedom of expression coming into play.
CCTV cameras fully facing public streets and areas like shopping malls are undeniably covered by the Directive, requiring processing to comply with Article 6 unless other exceptions apply. Workplace CCTV wouldn’t fall under the household exception, necessitating compliance with DPD processing requirements. Sharing footage might face further restrictions depending on its nature (e.g., footage of hospital patients revealing sensitive health data). Lastly, hybrid locations, both public and private (e.g., care homes as residences and workplaces), likely fall outside the “household exception” given the Court’s emphasis on activities tied “purely” to private and family life. This holds particularly true in the care home example, where the data controller is likely the operator using CCTV for operational, not private, purposes. However, justifying CCTV use in such cases according to the Directive remains possible.
Barnard & Peers: chapter 9