Private Citizen (pseudonymized)

The complainants worked at a private construction site next to the residence of the data controller. The latter had installed rotating cameras as part of a CCTV system, which were recording image from the complainant's property. Despite being repeatedly asked to cease the recording, the data controller refused, claiming the CCTV was necessary for the protection of his property and that in any case, due to the distance, the faces of the complainants were not visible in the images. The Hellenic DPA ruled that the data controller was in violation with the principles of transparency and data minimization, as well as the obligations set forth by the DPA's Directive 1/2011 on the use of CCTV. The Hellenic DPA also ruled that the visibility of the complainant's faces was irrelevant because the constant monitoring of an individual constitutes prima facie a violation of their privacy. The data controller was fined EUR 8,000 and was instructed to take the appropriate measures for the lawful operation of his CCTV system.