Die EU-Datenschutzbehörde hat eine Richtlinie entworfen, die genauere Vorgaben für den Einsatz von Videoüberwachungssystemen und die dazugehörige Verarbeitung personenbezogener Daten machen soll. Das ganze versteht sich als detaillierte Ausgestaltung und Konkretisierung der EU-Datenschutzgrundverordnung (EU-DSGVO) eben in Bezug auf Videoüberwachung.
Zu dieser Richtlinie („Guidelines 3/2019 on processing of personal data through video devices„) gab es eine „public consultation“, also die Gelegenheit zur Stellungnahme durch die allgemeine Öffentlichkeit. Diese Chance haben wir genutzt und so – dank der engagierten Arbeit eines Menschen im freiheitsfoo – einige Anmerkungen verfasst, die wir hiermit nachfolgend veröffentlichen.
Leider verfährt das gesamte Konsultationsverfahren in englischer Sprache, so dass wir auch unsere Eingabe englischsprachig verfasst haben:
To whom it may concern,
as indicated on your website, we (“freiheitsfoo”) would like to comment on your “Guidelines 3/2019 on processing of personal data through video devices“ (adopted 10 July 2019).
„freiheitsfoo“ is a German civil rights group focusing on data protection and digital human rights:
https://freiheitsfoo.de/
We would appreciate if the EDPB takes into account the following 7 comments.
1. In Paragraph 35, the Guidelines refer to “reasonable expectations” as factor for assessing the legitimate interests of the data subject. However, clarification and examples on what can be considered objective criteria for assessing reasonable expectations would be helpful (Working Paper
217 is referring to Directive 95/46/EC, not yet to GDPR).Considering the struggle for authority on how key terms within GDPR are to be interpreted legally, the legitimate interest in Art. 6 (1) lit f is especially important. This said, Data Protection Authorities taking a firm stand in interpreting these terms could counter corporate use of terms until the Court of Justice has ruled in this issue (see also Para 5, Sentence 2 of the Guidelines).
2. With regard to Para 73 ff., it remains unclear to us why the category “biometric data” does only apply when all three factors (characteristics of a natural person, specific technical processing and the purpose of identifying a natural person) are existent at the same time.
This view seriously neglects data subjects‘ interests. For instance, the data subject cannot tell about a video monitoring device’s technical capabilities from merely looking at it. Nor has the data subject the chance to know whether special technical post-processing is applied in this case.
Moreover, as a face/iris/fingerprint are body features and cannot be changed, the data subjects has no way to get hold on a new identification method (as this would be the case with a simple e-mail address or phone number). Biometric features are permanent and thus require special protection efforts. Yet, compared to the data subject’s high level of risk, the margin granted to the controller’s interests is too broad. To this end, the present imbalance should be re-adjusted.
To summarize, categorically classifying video surveillance as processing data of special categories (under Art. 9) would address this flaw. First, it would require the controller to deploy further technical/organizational measures for using video surveillance and, second, may raise the bars for resorting to video surveillance processing in the long run.
3. In Paragraph 18, sentence 3, there is a typing mistake. The version for public consultation includes both the words “a” and “the” [data subject]. Albeit, only one grammatical article is needed. In order to be consistent with previous uses, “the” suits better.
[Comments without references to paragraphs in the Guidelines:]
4. In public discourse, video surveillance’s apparent effects on crime deterrence are often raised. However, critically addressing this line of argument would be very helpful in the context of these guidelines. This also includes studies that question the very effectiveness of video surveillance for overall crime deterrence compared to its effects for strengthening a subjective feeling of security. For instance, see Gras (2003: 178); Glatzner (2006: 17f., 43f., 60), Farrington/Welsh (2002: VI).
Farrington, David; Welsh, Brandon (2002): “Crime prevention effects of closed circuit television: a systematic review”, Home Office Research, Development and Statistics Directorate
Glatzner, Florian (2006): “Die staatliche Videoüberwachung des öffentlichen Raumes als Instrument der Kriminalitätsbekämpfung“.
Gras, Marianne (2003): “Kriminalprävention durch Videoüberwachung. Gegenwart in Großbritannien – Zukunft in Deutschland?“, Nomos, Baden-Baden.
5. Furthermore, taking into account the chilling effect of video surveillance towards citizens‘ behavior would serve as case in point here. Especially in democratic societies, this phenomenon constitutes a serious risk in expressing one’s own natural behavior and feelings.
6. Within the scope of GDPR, our future understanding of the principle of transparency (Art. 5 (1) lit a, Art. 12 GDPR) should also encompass the need for controllers of video monitoring devices (that at least partially monitor public spaces) to register with the local authorities. This step could improve awareness for public video surveillance while failure to do so should result in relevant sanctions (Art. 83 f. GDPR)
7. We appreciate this form of consultation process as it constitutes an effective way to bring in relevant stakeholders from the civil society. However, in the future, the possibility to hand in comments in other languages than English would improve this process significantly. This said, language barriers did prevent several individuals to participate in our case and we are certainly not the only ones having faced these issues.
Best regards,
the people from freiheitsfoo
