The Norwegian Data Protection Agency has fined the power company Dragefossen AS EUR 15,000 (NOK 150,000). The fine was imposed after the company put the city centre of Rognan under CCTV surveillance and live-streamed the images without legal basis.
The power company has had a webcam mounted on top of its office building in the city centre of Rognan with a panning facility. Images were live-streamed on YouTube and the company’s own website. Up until the Data Protection Authority contacted the company, it was possible to rewind video recordings of the live-stream for up to 12 hours.
The area captured by the webcam included public roads, car parks and the entrances to two supermarkets, a pharmacy, a Vinmonopolet outlet, the local bank, the town hall and a number of other buildings.
Due to the quality of the images and the distance from the camera, it was not possible to see details of faces or read vehicle registration numbers. However, the picture quality was good enough to identify the type of vehicle individuals were driving, what they were wearing, their hair colour and other identifying personal characteristics and distinguishing features. This was sufficient to enable those who saw the live-stream to identify and track employees, co-workers, friends, family members, girlfriends/boyfriends or others that they knew.
The Data Protection Authority concluded that the live-stream was in violation of Article 6(1) and Article 5(1)(a) of the GDPR.
In its decision, the Data Protection Authority has given weight to the fact that the illegal CCTV surveillance affected a substantial number of people, and that many people have been filmed repeatedly, some on a daily basis. Those who have been filmed were on their way to and from work, out shopping for food, medicines or alcohol, or were in the relevant public spaces for other reasons. These are activities which the data subject does not expect to be under surveillance; far less do they expect them to be live-streamed on the internet. Nor had Dragefossen AS any connection with the data subjects or the activities that were being captured on camera.