Transport company Bratislava a.s.
- Country
- Slovakia
- Fine
- 20,000 EUR
- Date
- 2020-07-07
- Sector
- Transport company Bratislava is the only public transport provider in the city of Bratislava
- Articles
- Art. 5 par. 1 letter c) GDPR
Insufficient legal basis for data processing, Breach of the information obligation
The Controller operates several camera systems, which are located in buses, trolleybuses, but also in bus stops. The controller had a document "personal data protection" published on his web page, on the basis of which he declared that he collects this data on the basis of Art. 6 par. 1. letter f) GDPR. The legitimate interest should be the protection of property, health and public order, security and the detection of crime. The Slovak Office for Personal Data Protection warned the operator that it is not within its competence to ensure the protection of public order. At the same time, the cameras captured not only the area of stops but also its surroundings (sidewalk, road), while it is possible to recognize the faces of people from the recording. The storage period was 15 days, which was observed at the time of control. The operator integrated the camera announcement into the operating rules and pasted the announcement on each bus door, which the DPA did not consider sufficient. as the responsible person was not mentioned either, the principle of minimizing and the principle of liability was violated.<br /><br />
Reported by: Advokáti Chlipala s.r.o.