Help us make the FRA website better for you!

Take part in a one-to-one session and help us improve the FRA website. It will take about 30 minutes of your time.

YES, I AM INTERESTED NO, I AM NOT INTERESTED

Germany/ Federal Administrative Court/ 6 C 2/18

Unknown dentist v. Commissioner for Data Protection and the Right of Access to Documents of the State of Brandenburg
Deciding body type
National Court/Tribunal
Deciding body
Federal Administrative Court
Decision date
27/03/2019
ECLI (European case law identifier)
ECLI:DE:BVerwG:2019:270319U6C2.18.0

Carta drepturilor fundamentale a Uniunii Europene

Title II: Freedoms

Article 7 - Respect for private and family life

Title II: Freedoms

Article 8 - Protection of personal data

VIEW FULL CASE
  • Germany/ Federal Administrative Court/ 6 C 2/18

    Key facts of the case:

    The plaintiff is a dentist. Her medical practice could be entered unhindered by opening the entrance door; the reception desk was not occupied by staff. Therefore the plaintiff had installed a video camera above this counter, and the images transferred from the camera could be viewed in real time on monitors the plaintiff had set up in her treatment rooms (so-called camera-monitor system). In 2012, the plaintiff was ordered by the Brandenburg Data Protection Commissioner to align the video camera in such a way that the area in front of the reception desk, the corridor between the counter and the entrance door and the waiting room accessible to patients and other visitors were no longer covered. The dentist legally challenged the Data Protection Commissioner’s order but was not successful in the lower courts.

    Key legal question:

    In its decision, the Federal Administrative Court examined the question which data protection law (German Federal Data Protection Act or EU General Data Protection Regulation) was applicable to assess the legality of the State Data Protection Commissioner’s order. Furthermore, it had to clarify whether the camera-monitor-system to surveille the areas of the medical practice that were accessible to visitors fell under the scope of Section 6b of the Federal Data Protection Act (old version) and whether this provision permitted surveillance for the purpose of protecting the premise of the plaintiff.

    Outcome of the case:

    The Federal Administrative Court decided that the General Data Protection Regulation, which is directly applicable in all EU member states since 25 May 2018, does not apply to data protection orders issued – as in the present case – before this date. Decisions taken before this date are not to be measured against new EU legislation subsequently. Before 25 May 2018, the federal legislator had conclusively regulated the admissibility of private surveillance of publicly accessible areas by optical-electronic equipment (video surveillance) through Section 6b of the Federal Data Protection Act (old version). According to paragraph 1 of this provision, mere monitoring through a camera-monitor system, even without storing the images, requires that it is necessary to safeguard the legitimate interests of the private individual and that the interests of the persons concerned worthy of protection do not predominate. According to the binding factual findings of a lower instance, the plaintiff had so far not shown that she is dependent on video surveillance for the operation of her practice. There were no factual indications justifying her fear that persons might enter her practice in order to commit crimes there. Moreover, video surveillance was not found being necessary to provide emergency care to patients who, for medical reasons, remain in the waiting room for some time after treatment. Lastly, the plaintiff's claim that she would have to bear considerably higher costs without video surveillance remained unsubstantiated. The court, however, discussed in a remark “said in passing” (obiter dictum) the admissibility of private video surveillance under the GDPR.

  • Paragraphs referring to EU Charter

    “The conditions of admissibility for data processing are conclusively regulated in Article 6 para. 1 of the General Data Protection Regulation, with paragraphs 2 and 3 containing limited opening clauses in favour of the Member States. If, as in the present case, the data subjects have not given their legally effective consent to the processing of their personal data (Article 6 para. 1 subpara. 1 lit. a read in conjunction with Article 4 no. 11 of the General Data Protection Regulation), data processing operations are only lawful if they can be based on at least one of the grounds for authorization as listed in Article 6 para. 1 of the General Data Protection Regulation. Data processing by private individuals, such as the applicant's video surveillance system, cannot be based from the outset on Article 6 (1), first subparagraph, lit. e of the General Data Protection Regulation. Accordingly, data processing must be necessary for the performance of a task which is in the public interest or is carried out in the exercise of official authority assigned to the person responsible. There is no provision for an additional weighing of the interests of the data subjects. In the light of the high importance of the right to informational self-determination of the data subjects, this can only be justified if the provision’s scope of application is limited to official or state-initiated processing operations in accordance with its wording. The processing of personal data falls under the scope of protection by the fundamental right to privacy under Article 7 and the fundamental right to the protection of one's own data under Article 8 of the Charter of Fundamental Rights of the European Union (ECJ, judgment of 11 December 2014 - C-212/13 – para. 28). Accordingly, Article 6 para. 1 subpara. 1 lit. e GDPR covers data processing operations carried out by authorities to perform their tasks. Private individuals may only invoke this right if they have been given the authority to access personal data in the public interest or as the exercise of official authority. They must act in place of a public authority. This requires an act of transfer by the state in whatever form. A private individual cannot declare him/herself to be a trustee in the public interest. In particular, they are not appointed to protect public security alongside or even in place of the police authorities. In protecting individual legal interests, whether their own or those of third parties, he or she does not pursue public interests but private ones (Buchner/Petri, in: Kühling/Buchner, DS-GVO/BDSG, 2nd ed. 2018, Art. 6 DS-GVO Rn. 111 ff.; Kramer, in: Auernhammer, DSGVO/BDSG, 5th ed. Pabst, in: Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 2018, Art. 6 DS-GVO para. 95; Wedde, in: Däubler/Wedde/Weichert/Sommer, EU-Datenschutz-Grundverordnung and BDSG-neu, 2018, DSGVO Art. 6 para. 87 and 89). It can therefore be left open whether Article 6 para. 1 subpara. 1 lit. e GDPR provides for the permission itself or whether the provision must be completed by EU or national provisions on official data processing in the public interest (cf. Schulz, in: Gola, DS-GVO, 2nd ed. 2018, Art. 6 paras. 48 and 197).” (paras. 44 and following).

  • Paragraphs referring to EU Charter (original language)

    “Die Zulässigkeitsvoraussetzungen für die Verarbeitung sind in Art. 6 Abs. 1 DSGVO abschließend geregelt, wobei die Absätze 2 und 3 begrenzte Öffnungsklauseln zugunsten der Mitgliedstaaten enthalten. Haben die Betroffenen wie im vorliegenden Fall nicht rechtswirksam in die Verarbeitung ihrer personenbezogenen Daten eingewilligt (Art. 6 Abs. 1 Unterabs. 1 Buchst. a i.V.m. Art. 4 Nr. 11 DSGVO), sind Verarbeitungsvorgänge nur rechtmäßig, wenn sie auf mindestens einen Erlaubnistatbestand des Art. 6 Abs. 1 DSGVO gestützt werden können. Datenverarbeitungen durch Privatpersonen wie die Videoüberwachung der Klägerin können von vornherein nicht auf Art. 6 Abs. 1 Unterabs. 1 Buchst. e DSGVO gestützt werden. Danach muss die Datenverarbeitung erforderlich für die Wahrnehmung einer Aufgabe sein, die im öffentlichen Interesse liegt oder in Ausübung öffentlicher Gewalt erfolgt, die dem Verantwortlichen übertragen wurde. Eine zusätzliche Abwägung mit den Interessen der Betroffenen ist nicht vorgesehen. Dies lässt sich in Anbetracht des hohen Stellenwerts des informationellen Selbstbestimmungsrechts der Betroffenen nur rechtfertigen, wenn der Anwendungsbereich des Tatbestands entsprechend seinem Wortlaut auf behördliche oder staatlich veranlasste Verarbeitungsvorgänge beschränkt wird. Die Verarbeitung personenbezogener Daten unterfällt dem Schutzbereich der Grundrechte auf Privatleben nach Art. 7 und auf Schutz der eigenen Daten nach Art. 8 der Grundrechtecharta der Europäischen Union (EuGH, Urteil vom 11. Dezember 2014 - C-212/13 - Rn. 28). Dementsprechend erfasst Art. 6 Abs. 1 Unterabs. 1 Buchst. e DSGVO Datenverarbeitungen durch Behörden, die diese in Erfüllung ihrer Aufgaben vornehmen. Privatpersonen können sich darauf nur berufen, wenn ihnen die Befugnis, auf personenbezogene Daten zuzugreifen, im öffentlichen Interesse oder als Ausübung öffentlicher Gewalt übertragen ist. Sie müssen anstelle einer Behörde tätig werden. Dies setzt einen wie auch immer gestalteten staatlichen Übertragungsakt voraus. Eine Privatperson kann sich nicht selbst zum Sachwalter des öffentlichen Interesses erklären. Insbesondere ist sie nicht neben oder gar anstelle der Ordnungsbehörden zum Schutz der öffentlichen Sicherheit berufen. Beim Schutz individueller Rechtsgüter, seien es ihre eigenen oder diejenigen Dritter, verfolgt sie keine öffentlichen, sondern private Interessen (Buchner/Petri, in: Kühling/Buchner, DS-GVO/BDSG, 2. Aufl. 2018, Art. 6 DS-GVO Rn. 111 ff.; Kramer, in: Auernhammer, DSGVO/BDSG, 5. Aufl. 2017, Art. 6 Rn. 24 f.; Pabst, in: Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 2018, Art. 6 DS-GVO Rn. 95; Wedde, in: Däubler/Wedde/Weichert/Sommer, EU-Datenschutz-Grundverordnung und BDSG-neu, 2018, DSGVO Art. 6 Rn. 87 und 89). Somit kann dahingestellt bleiben, ob es sich bei Art. 6 Abs. 1 Unterabs. 1 Buchst. e DSGVO um einen eigenständigen Erlaubnistatbestand handelt oder die Bestimmung durch unionsrechtliche oder nationale Bestimmungen über behördliche Datenverarbeitungen im öffentlichen Interesse ausgefüllt werden muss (vgl. Schulz, in: Gola, DS-GVO, 2. Aufl. 2018, Art. 6 Rn. 48 und 197).” (Rn. 44 ff.)