At the end of last year the Court of Justice of the European Union (“CJEU”) decided in František Ryneš the issue whether the “personal or household” exclusion from data protection law applies to the use of home surveillance devices.
The court found that a person who uses closed-circuit television (CCTV) cameras for the purpose of home security but at the same time also records a public sidewalk which is located outside of a private home may be governed by EU data protection law.
The CJEU decision is based on a referral from a Czech court. František Ryneš challenged a decision of the Czech Office for the Protection of Personal Data (the Úřad pro ochranu osobních údajů ) and asked the CJEU for a preliminary ruling regarding the interpretation of Article 3(2) of the Directive 95/46/EC.
Mr. Ryneš installed a video surveillance system at his house after his family had been subject to several attacks over the last years causing damages to the property, because he was unable to identify the perpetrator. During the course of the surveillance the suspected attackers were able to be identified. However, one of the suspects challenged the legitimacy of the surveillance evidence itself, because part of the public sidewalk was taped as well. The Czech Office for the Protection of Personal Data ruled in favor of the aggrieved and imposed a fine on Mr. Ryneš. Mr. Ryneš argued that the exclusion under Article 3(2) of the data protection Directive applies, which provides that processing “by a natural person in the course of a purely personal or household activity” is outside the scope of the Data Protection Directive.
The CJEU agreed with the Czech Office for the Protection of Personal Data and found that the exclusion was not applicable in this case. The essence of the decision is that the exclusion does not apply to the use of home surveillance devices as long as part of the public space is taped as well. The CJEU argued that
“[t]o the extent that video surveillance such as that at issue in the main proceedings covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity for the purposes of the second indent of Article 3(2) of Directive 95/46.”
The CJEU narrowed the exclusion from data protection law and thus expanded the set of activities that have traditionally fallen outside of the scope of its application (such as the protection of your own home by video surveillance).
The CJEU thus again reiterated that privacy is a fundamental right under EU law.