The operator of a hostel for the blind and visually impaired films the residents and only draws attention to this by means of a message on the notice board. There is no doubt that this is not permissible under data protection law. But how do you do it right?
The facts
By decision of 16 September 2021, the Italian data protection authority (Garante per la protezione dei dati personali) imposed a fine of 5,000 Euros on the operator of a residential home for visually impaired in the Sicilian port city of Catania. This was triggered, among other things, by violations of the data protection information obligations under Art. 12 et seq. of the General Data Protection Regulation ("GDPR").
The administration of the dormitory had video-monitored parts of the exterior and interior of the facility, according to its own information, in order to be able to prevent unauthorised individuals from entering and committing crimes. They only informed the residents about this video surveillance, which constitutes processing in the sense of data protection law, after the Italian data protection authority had started its investigations. In doing so, the responsible persons limited themselves to making the information available in the porter's lodge and by posting it on the notice board. No further measures were taken to inform those affected - especially the visually impaired residents – about the video recording. De facto, they had no possibility to take note of the processing of their data.
The argumentation of the authority
The authority therefore came to the unsurprising conclusion that this way of providing information was not sufficient and imposed a fine on the operator. Taking into account the consulted "Guidelines on Transparency under Regulation 2016/679" of the independent advisory body of the European Commission on data protection issues (so-called “Article 29 Data Protection Working Party”), the Garante per la protezione dei dati personali found that if the controller knew that its service would be used by, or was even intended precisely for, vulnerable members of society, including persons with disabilities or persons who had difficulties in accessing information, it had to take into account the vulnerability of these persons in the context of its transparency obligations.
In particular, if data subjects are visually impaired, the information on the processing of personal data must also be communicated by the controller by acoustic means in order to ensure that it can actually be perceived by the data subjects.
The legal background: information obligations pursuant to Art. 12 et seq. GDPR
According to Art. 13, 14 GDPR, every controller is obliged, when processing personal data, to inform data subjects about this free of charge before the processing starts. This must be done in a precise, transparent and easily accessible manner, using clear and simple language. Concerning the concrete design of the information obligations, the respective controller has a degree of freedom, whereby the requirements for the design are largely determined by the type, scope and risk of the respective processing activity. In this context, a graduated information provision can be used: At the first level, information on the controller and the purposes of the processing should be provided; at the second level, information on the rights of the data subjects as well as on the other mandatory information should be provided.
In the case of video surveillance, this graduated information is typically provided by means of two different signs in the following manner: Signs are placed in front of the video-monitored area with an indication of the circumstance of the video surveillance – usually in the form of a pictogram of the camera symbol – and the essential information regarding the video surveillance, such as the identity of the person responsible and the purpose of the surveillance. In addition, a detailed information sheet with all additional necessary information within the meaning of Art. 13, 14 GDPR is provided in another easily accessible place. German data protection authorities provide uncomplicated samples for both information signs.
The problem: Providing information to blind and visually impaired people
This recognised way of fulfilling the duty to inform is, of course, only suitable for people who can see the two signs. For the estimated 100000-150000 blind or severely visually impaired people living in Germany, however, it is obviously unsuitable. The problem is not limited to homes for the blind, but extends from museums to supermarkets to a large part of social life.
This poses challenges for those responsible, who are usually already happy if they can comply with their information obligations in the "standard case". However, as the case of the Italian living facility presented shows, this is not a justification: The protection of personal data is a fundamental right that applies to every natural person, regardless of any physical, mental or intellectual disabilities. As an offshoot of this fundamental right, according to Art. 12 et seq. GDPR, the data controller must also fulfil his duty to inform disabled persons, taking into account their limitations, such as the visual impairment in this case.
The solution?
The apparent solution demanded here by the Italian data protection authority, namely to transmit the information acoustically, would certainly have been expedient in the specific case, but may often be completely impracticable.
It is difficult to imagine a supermarket owner interrupting the Christmas jingles and advertising slogans every quarter of an hour for announcements with a reference to video surveillance, possibly supplemented by the further data protection law explanations. The fact that by doing so he does not even necessarily ensure that he fulfils his duty to inform, for example because the supermarket visit of a blind person does not last that long or the announcement does not take place before the data processing, is irritating. Playing a notice about the video surveillance when entering the shop, for example triggered by a light barrier, would at least avoid the latter problems, but would also not promote sales. Putting up a sign in Braille, on the other hand, would cause other problems: It would already be a challenge to place it in such a way that the people concerned would notice it at all.
The best solution seems to be an event-related transmission of information by means of aids such as smartphones suitable for the visually impaired. Taking into account the possibility of staged information delivery, those affected could be automatically informed of the recording via a vibration alarm before entering video-monitored areas and receive the further information in the form of an audio file on their smartphone.
