BVwG April 5, 2024, W287 2259607-1/8E
It is generally known that secretly recording fellow citizens (whether it be photos in the swimming pool, recording a telephone conversation without the other person knowing, or video recordings, even of an intimate nature) is problematic and generally prohibited. It is also generally known that this creates civil law problems and can lead to an injunction. Claims for damages are also possible (§ 1328a ABGB, § 16 ECG). The fact that such "secret" recordings also give rise to data protection problems is shown by the following decision of the Federal Administrative Court or - before that - the Data Protection Authority:
In the course of an apparently long-standing bad neighborhood, one citizen filmed another. The reason was that the neighbor had been standing in the driveway while making a delivery. The amateur filmmaker wanted to prove this, he also wanted to document the disturbance, and finally he also feared being threatened (in fact, a threat was made during the course of the video, in that the neighbor's wife stated that she would kill the amateur filmmaker if he did anything to the other neighbor, whereby this threat was made at second 40 of the video, and the video had a total length of 05:06 minutes.
Now, one would basically think that the amateur filmmaker was in the right - he was threatened, as he feared, and he also filed a complaint for trespass, as well as a report to the responsible police station on suspicion of making a dangerous threat based on the above-quoted statement by the neighbor's wife.
However, both the data protection authority and the Federal Administrative Court (the latter with the decision of April 5, 2024, GZ: W 287 2259607-1/8E) found a violation of the right to confidentiality of the "parties involved", i.e. the neighboring couple. The reasoning seems questionable at first glance, but on closer inspection it is correct: First of all, it should be noted that any processing of personal data requires a legal basis and Article 6 (1) (f) GDPR is often used, according to which legitimate interests of the controller (i.e. the "data processor") or a third party must exist, unless the interests of others, in particular the data subject, prevail.
Therefore, three conditions are cumulatively required: the existence of a legitimate interest, the necessity of the processing and no outweighing of the fundamental rights and/or freedoms of the person affected by the processing.
In the present case, the Federal Administrative Court has now come to the conclusion that - also against the background of the principle of Article 5 paragraph 1 letter c GDPR, consisting in the obligation to minimize data "to the unavoidable" - the recording was excessive: On the one hand, the disturbance of property could also have been documented by a simple photograph, a video recording lasting several minutes including sound recording was not necessary for this. On the other hand, the amateur filmmaker/neighbor continued filming for another four minutes after the threat was made, there was a calm conversation between him and the neighbor (at least after the threat was made) and there were also witnesses on site, so it would not have been absolutely necessary to continue filming calmly for several minutes.
This decision certainly represents a borderline case. The court here requires citizens - who are usually not legally versed - to carry out a precise balancing of interests in what may be emotional situations, so that a "legal perfect landing" can be made and the right to confidentiality of third parties is not violated. However, it must not be forgotten that the administrative procedure under data protection law is a two-pronged one: On the one hand - as here - there can be an adversarial procedure in which the data subject and the data processor face each other and in which it is determined whether or not the data subject's right to confidentiality has been violated. On the other hand, there may also be an administrative criminal procedure in which the data subject does not participate in principle and in which the only question to be clarified is whether - on the basis of the finding in the first-mentioned procedure that a data subject's right to confidentiality has been violated - a penalty should also be imposed on the person responsible. In those administrative criminal proceedings, however, it must be taken into account that this is a borderline case and that it is not to be expected that a high penalty will be imposed.
05.08.2024