This decision, although not resulting in a sanction, details the Danish authority's analysis of the video surveillance practices of a housing company, emphasizing particularly the incomplete and passive nature of the information provided to the data subjects.

Facts and context

The Danish Data Protection Authority (Datatilsynet) published a decision closing an inspection against the housing company fsb, without imposing a sanction, but making significant observations on the use of video surveillance.

The case originated from a planned inspection by the supervisory authority in 2024, aimed at examining the compliance of video surveillance practices of five housing companies, including fsb.

Reasons for the decision

The authority examined fsb's practices and made several observations based on its legal analysis:

• Lawfulness and data minimization obligation (Article 5 of the GDPR): The authority recalls that video surveillance, being a highly intrusive form of processing, must only be implemented for compelling reasons, such as crime prevention and combating. It emphasizes that less intrusive measures must always be considered beforehand. Furthermore, cameras must be positioned so as not to track residents' movements to their homes, and the necessity of surveillance must be periodically reassessed.

• Storage limitation obligation (Article 5, paragraph 1, point e) of the GDPR): The authority specifies that the maximum retention period of 30 days, authorized by Danish law on video surveillance, is not an obligation. In accordance with the storage limitation principle, recordings must be deleted as soon as they are no longer necessary for the pursued purpose, which may imply a retention period shorter than 30 days.

• Information obligation (Article 14 of the GDPR): The authority found that the information provided to residents via the website and postings was incomplete. Notably missing were the identity of the data controller and information on the right to lodge a complaint. Similarly, the information note intended for employees was incomplete, omitting the retention period and possible recipients of the data. The authority insists that the data controller must take active measures to provide this information, mere availability on a website being deemed insufficient.

• Right of access (Article 15 of the GDPR): The authority positively noted that fsb had implemented detailed internal procedures to handle requests for access to video recordings. These guidelines notably provide for blurring other identifiable persons before any communication, which was deemed compliant with requirements.

Authority's decision

Consequently, the authority did not impose a sanction but closed its inspection by sending a letter with observations to fsb.

Lessons learned

This decision reminds that:

• The implementation of a video surveillance system must be justified by compelling reasons, such as proven crime, and only occur after evaluating less intrusive measures.

• The location and angle of cameras must be strictly defined to monitor only areas strictly necessary for the purpose, avoiding tracking residents' comings and goings to their private homes.

• The retention period of video recordings must correspond to the real need and be as short as possible, even if national legislation allows a longer maximum period.

• The information obligation is not limited to making notices available on a website; the data controller must take active measures to ensure that data subjects effectively receive the required information.

• Internal procedures for managing data subjects' rights, when clear and applied, constitute a compliance element appreciated by supervisory authorities.