The use of three CCTV cameras in a multi-family house violated Article 6(1)(f) of the GDPR

The Icelandic Data Protection Authority (“Persónuvernd”) found that the use of three CCTV cameras in a multi-family house violated Article 6(1)(f) of the GDPR. One of the neighbours of the Persónuvernd complainant had placed three CCTV cameras outside the multi-family house, and their field of view extended to the shared garden, the complainant’s car park and the public street and pavement in front of the house. Although, in theory, such monitoring could be based on the neighbour’s legitimate interests, in particular for the purposes of security and protection of property, the need to monitor areas outside his property in order to achieve the above-mentioned purposes had not been demonstrated, and therefore the neighbour’s legitimate interest as a legal basis for the processing in question had not been established. Persónuvernd ordered the neighbour to cease the redundant use of the monitoring and to delete all recorded material, as well as to submit confirmation of the implementation of these recommendations to the supervisory authority.