Who films, processes personal data. Whether it concerns a recorded church service or a security camera by the fence: the GDPR applies. Yet that does not automatically lead to the outcome that those involved had in mind. In a recent case dealt with by the District Court of Oost-Brabant, a daughter claims damages because the funeral of her mother remained online for months. The claim was dismissed, because a GDPR violation does not in itself give rise to a right to compensation. In another recent case which the District Court of Midden-Nederland had to consider, it was ruled that private security cameras only pass the GDPR test if they do not look further than necessary, and that the court can if necessary supervise this technically. Read further about both cases in this case law blog.
Damages Following the Recording of a Funeral Service
What happened?
In November 2018, a Protestant congregation organised the funeral service of the mother of the claimant. The service was filmed via a fixed camera in the church and broadcast live via the website kerkdienstgemist.nl. After the service, the recording remained online for over six months. The recording was also available for download throughout this entire period.
The claimant herself was unaware of this. It was not until May 2019 that she was alerted to the existence of the recording by an acquaintance. She immediately held the congregation liable, after which the recording was removed. She also lodged a complaint with the Dutch Data Protection Authority (AP). The AP concluded that the congregation had fallen short on a number of points and drew its attention to areas for improvement, such as better camera signage at the church door, an update to the privacy statement and the drafting of a consent form.
The parties were unable to reach an agreement between themselves. The claimant went to court and claimed a total of just over €12,000, including €10,000 in non-pecuniary damages.
What were the legal issues?
The claimant based her claim on two grounds:
- Article 82 GDPR provides that any person who has suffered material or non-material damage as a result of an infringement of data protection law has the right to receive compensation from the controller responsible for the processing of the personal data.
- Article 6:162 of the Dutch Civil Code (the classic tort of unlawful act) requires that damage has been suffered and that that damage is the result of the unlawful conduct.
Both grounds therefore impose the same requirement: the claiming party must demonstrate that they have actually suffered damage. The cantonal judge therefore decided to examine that point first. And it was precisely on that point that the case went wrong for the claimant, which meant that the question of whether the congregation had actually violated the GDPR or had acted unlawfully could remain unanswered.
The judgment
The cantonal judge acknowledged that it is conceivable that the recording affected the claimant's private life. But conceivable is not the same as demonstrated. The claimant had not specified when and how she had appeared on camera, what had been said during the service about her or her mother, or what concrete negative consequences she had experienced. Her emotional reaction to the situation was understandable, but without further substantiation insufficient to establish damage.
The reliance on the Österreichische Post judgment also did not assist her. That judgment does provide that no threshold of seriousness applies for non-material damages, but it leaves the burden of proof for the existence of damage intact. The absence of a seriousness threshold does not mean that damage can be assumed without evidence. A GDPR violation is not damage in itself.
The claim for hours spent failed for the same reason. The claimant submitted an overview of the hours she had spent on the matter, but failed to explain why that time expenditure was necessary and how the financial loss was causally linked to the alleged violation. That was insufficient.
Finally: the offer at the hearing to submit the recording after all was rejected by the court. The burden of substantiation had rested on the claimant from the outset. She should have submitted the recording in good time in the proceedings, or should have concretely described what she regarded as a privacy violation in it. She had not done so.
All claims were dismissed.
Established line
This judgment confirms an established line in case law: the seriousness threshold for GDPR compensation is low, but the burden of proof for the existence of damage does not disappear. Anyone wishing to bring a privacy claim must be able to make that damage concrete.
The Camera Dispute
The situation
The basement residents of an apartment complex had installed multiple cameras: on the first floor of their vacant penthouse, on the fence between the gardens and on the outer wall of an outbuilding. The ground floor residents sought the removal or restriction of those cameras. Their objection: the cameras captured not only the communal areas, but also their private garden.
The basement residents defended themselves with a series of incidents. Hoses from the irrigation system had been cut, a tyre had been punctured, a Ziggo cable had been severed, a heat pump had been put out of action, a fence had been sprayed with the name of a competitor, and there are further examples. Camera footage showed the ground floor neighbour at the scene of various incidents.
The legal framework: GDPR and unlawful act
The court applies two different frameworks. Camera surveillance that extends beyond one's own private areas in principle constitutes an infringement of the personal privacy of others and is therefore unlawful, unless a justification ground removes that unlawfulness. At the same time, the storage of camera footage of another person's home or communal areas qualifies as processing of personal data under the GDPR. This means that the requirements of Articles 5 and 6 GDPR also apply: a valid legal basis is required, and the principles of purpose limitation, data minimisation, proportionality and subsidiarity must be observed. Furthermore, the footage must be properly secured and may not be retained for longer than necessary.
What is permitted: communal areas
The court upholds the security interest of the basement residents to the extent that the cameras capture the communal access road and parking areas. That interest is sufficiently weighty to justify permanent camera surveillance, even if the ground floor residents are incidentally filmed in the process. The court rules that the latter is proportionate, because they can also reach their home unfilmed via the front door. The legal basis is the legitimate interest under Article 6(1)(f) GDPR.
What is not permitted: the private garden in view
The position is different with regard to the penthouse cameras. Still images submitted in evidence showed that the garden of the ground floor residents could be captured by those cameras, even when the neighbour was simply standing in their own garden. A sufficient justification for this is lacking: no incidents have occurred via that garden and no concrete risk thereof has been demonstrated.
The court orders the basement residents to remove or replace the cameras with one fixed camera, which must be adjusted by a professional security company in such a way that the private areas of the neighbours remain out of view. A notably practical detail: that same company must, within fourteen days of installation, show the neighbours what the camera can capture and provide a written declaration of how it is technically or physically ensured that the basement residents cannot themselves extend the camera's range. That is an effective means of enforcing compliance without the need to repeatedly go to court.
All in all, this judgment shows that the GDPR assessment of private camera systems is closely intertwined with the civil law test of unlawful act. Proportionality and subsidiarity are strictly assessed: the fact that neighbours can reach their home unfilmed via an alternative route is a factor in the balance. Moreover, technical safeguarding of camera limits can be imposed by the court as a condition, including verification by an independent third party.
Would you like to read more of our Data & Privacy case law blog? View the previous blog via the link below.
/63.png?width=600&height=300&name=63.png)
/59.png?width=600&height=300&name=59.png)
