The Icelandic SA: Íþrótta- og sýningahöllin hf. fined 3.500.000 ISK for the use of video surveillance

Background information

• Date of final decision: 17 October 2023
• National case
• Controller: Íþrótta- og sýningahöllin hf.
• Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 13 (Information to be provided where personal data are collected from the data subject)
• Decision: Administrative fine, Compliance order
• Key words: administrative fine, CCTV, Children, Sensitive data, Transparency

Summary of the Decision

Origin of the case  

In July 2021, following media coverage about video surveillance cameras being active in facilities where teenagers slept and changed clothing during a sports tournament, the Icelandic Supervisory Authority (SA) launched an investigation into video surveillance being carried out at the facility. The facility in question is a large sports and entertainment venue in Reykjavík. The Icelandic SA carried out a field inspection of the premises to investigate the scope of the video surveillance and weather sufficient signs and information were provided to the data subjects when they enter the premises. The field inspection concluded that about 50 surveillance cameras were active at the facility, in almost all rooms and spaces except bathrooms and changing-rooms, simple markings about the surveillance were in various places around the facility but they lacked sufficient information about the data controller. Furthermore, during the investigation the Icelandic SA discovered that video surveillance had been active at the facility while mass vaccination for Covid-19 was carried out.

Key Findings 

Failure to comply with the principle that personal data shall be processed in a transparent manner in relation to the data subject (Article 5(1)(a). 
Failure to comply with the principle that personal data shall be collected for specified, explicit and legitimate purposes (Article 5(1)(b).
Failure to demonstrate that the processing of personal data with video surveillance, while the facility was rented out for events, was lawful in accordance with Article 6.
 

Decision 

The Icelandic SA concluded that the data controller had failed to assess whether its legitimate interest to protect the facility and its assets outweighed the data subjects right to privacy, both in a general manner and when the facility is rented out for events or other gatherings, in breach of Article 6. 

Furthermore, the Icelandic SA concluded that by operating active video surveillance in rooms, where children slept and changed clothes, and where mass vaccination for Covid-19 was carried out, the data controller had failed to comply with the principle that personal data shall be collected for specified, explicit and legitimate purposes, in breach of Article 5 (1)(b). 

Finally, the Icelandic SA concluded that the data controller had not notified the data subjects about the surveillance system in a sufficient manner in accordance with Article 13 and had, therefore, failed to comply with the principle that personal data shall be processed in a transparent manner in relation to the data subject in accordance with Article 5(1)(a). 

The Icelandic SA ordered the data controller to cease all video surveillance unless it could show that its legitimate interests outweighed the data subjects right to privacy, both in general and when the facility is rented out for events. 

Furthermore, that Icelandic SA ordered the data controller to provide the data subjects with sufficient information in accordance with Article 13. Finally, the Icelandic SA imposed an administrative fine on the data controller of approx. 23.820 EUR (3.500.000 ISK).

For further information: Sekt á hendur Íþrótta- og sýningahöllinni hf. vegna rafrænnar vöktunar í Laugardalshöll