The town of Rajecké Teplice
- Country
- Slovakia
- Fine
- 10,000 EUR
- Date
- 2020-01-24
- Sector
- An independent territorial self-governing and administrative unit of the Slovak Republic
- Articles
- Art. 5 par. 1 letter a) GDPRArt. 5 par. 1 letter e) andart. 5 par. 2 GDPRArt. 12 par. 1 GDPRArt. 13 par. 2 letter b) GDPR
The Controller processed personal data in an illegal manner, kept camera recordings for longer than the time he had set, did not provide the data subjects with information pursuant to Art.13 GDPR in connection with the camera information system.
The Controller also does not provide the data subject with information on the right to object to the processing of personal data. The Controller illegally processed the personal data of the persons concerned by means of a camera information system, while at the time of the inspection he did not prove the fulfillment of at least one of the conditions of legal processing according to Art. 6 par. 1 GDPR. The Controller has kept the camera recordings for longer than the period specified in the security documentation, without proving the need to extend the retention period of the camera recordings. At the time of the inspection, the Controller did not provide the data subjects with information pursuant to Art.13 GDPR in connection with the camera information system in a sufficiently transparent, comprehensible and easily accessible form, formulated clearly and simply. The controller in relation to the camera information system does not provide the data subject with information on the right to object to the processing of personal data concerning him, which is carried out on the basis of Art. 6 par. 1 letter e) GDPR.
Additional information
The controller uses a camera system to capture the premises of the municipal office and public spaces. The purpose of operating a camera information system is to protect public order and security, detect crime, protect company property or the health of people in the monitored areas. Fine measures: <ul><li>perform an analysis in order to determine the retention period of camera recordings in accordance with Art. 5 par. 1 letter e) GDPR</li><li>duly justify the individual retention period of camera recordings and update its internal security policy for the processing of personal data</li><li>to update its information obligation, including the indication of the right to object pursuant to Art. 21 GDPR against the processing of personal data by the controller's camera information system</li></ul>