Can private CCTV monitoring lead to a GDPR fine? Yes—especially if a supervisory authority's order is ignored.
The Polish Data Protection Authority (UODO) has published its first decision imposing an administrative fine on a private individual for failing to comply with a corrective order concerning CCTV monitoring.
The case involved a homeowner whose surveillance system captured not only his own property but also neighboring properties and a public road, resulting in the processing of the image and voice of local residents.
Following complaints from the affected individuals, UODO ordered the homeowner to stop processing personal data through monitoring that extended beyond the boundaries of his property. The decision became final, but the order was not implemented.
According to UODO, the monitoring continued despite the corrective decision, and the homeowner failed to demonstrate compliance. As a result, the authority imposed an administrative fine of PLN 26,711 (approximately €6,300).
This decision highlights several important GDPR principles:
• Private CCTV systems may fall within the scope of data protection law when they monitor areas beyond the owner's property.
• Supervisory authorities have the power to issue corrective orders requiring unlawful processing to stop.
• Ignoring a legally binding decision of a supervisory authority may itself result in significant administrative penalties.
I suppose that this case is a valuable reminder that GDPR enforcement extends beyond businesses. Individuals who process personal data outside the purely personal or household context are also expected to respect data protection rules and comply with decisions issued by supervisory authorities.
Top comments (0)