The Norwegian Data Protection Agency has fined the power company Dragefossen AS EUR 15,000 (NOK 150,000). The fine was imposed after the company put the centre of Rognan under CCTV surveillance and live-streamed the images without legal basis.
The power company has had a panning webcam mounted on top of its office building in the centre of Rognan with a panning facility. Images were live-streamed on YouTube and the company’s own website. Up until the Data Protection Authority contacted the company, it was possible to spool back recordings of the live-stream for up to 12 hours.
The area captured by the webcam included public roads, car parks and the entrances to two supermarkets, a pharmacy, a Vinmonopolet outlet, the local bank, the town hall and a number of other buildings.
Possible to identify
Due to the quality of the images and the distance from the camera, it was not possible to see details of faces or read vehicle registration numbers. However, the picture quality was good enough to identify the type of vehicle individuals were driving, what they were wearing, their hair colour and other identifying personal characteristics and distinguishing features. This was sufficient to enable those who saw the live-stream to identify and track employees, co-workers, friends, family members, girlfriends/boyfriends or others that they knew.
The Data Protection Authority concluded that the live-stream contravened Article 6(1) and Article 5(1)(a) of the GDPR.
In its decision, the Data Protection Authority has given weight to the fact that the illegal CCTV surveillance affected a substantial number of people, and that many people have been filmed repeatedly, some on a daily basis. Those who have been filmed were on their way to and from work, out shopping for food, medicines or alcohol, or were in the relevant public spaces for other reasons. These are activities which the data subject does not expect to be under surveillance; far less do they expect them to be live-streamed on the internet. Nor had Dragefossen AS any connection with the data subjects or the activities that were being captured on camera.
For further information, please contact the Norwegian DPA: international@datatilsynet.no
The press release published here does not constitute official EDPB communication, nor an EDPB endorsement. This press release was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. As the press release is represented here as it appeared on the SA's website or other channels of communication, the news item is only available in English or in the Member State's official language with a short introduction in English. Any questions regarding this press release should be directed to the supervisory authority concerned.