Background information

• Date of final decision: 31 May 2022
• Cross-border case or national case: national case
• Controller: Warsaw Centre for Intoxicated Persons
• Legal Reference: lawfulness of processing (Art. 6.1), lawfulness, fairness, transparency (Art. 5.1(a))
• Decision: administrative fine of PLN 10 000 (approx. EUR 2200)
• Key words: audio surveillance, lawfulness, fairness, transparency

Summary of the Decision

Origin of the case

The Polish Supervisory Authority (SA) was informed about the practices applied by the Warsaw Centre for Intoxicated Persons in connection with its surveillance system.

The Centre was accused of recording sound at the premises of the facility through the installed surveillance system without any legal basis.

The Polish SA asked the controller to comment on the information received and to indicate the legal basis authorising it to collect personal data in the form of sound. As the legal basis for the data processed in this way, the controller indicated that the processing of the data is necessary for compliance with a legal obligation.

The controller referred to the regulations included in the Polish Act on Upbringing in Sobriety and Counteracting Alcoholism, executive acts to this act and the statute of the Centre.

Key Findings

The controller confirmed that its system records both video and audio, and the purpose of  processing is, among other things, to exercise continuous surveillance over persons brought to sober up in order to ensure their safety. The controller also informed that the audio and video signal is recorded and stored from 30 to 60 days, except when the recording is secured as evidence in ongoing proceedings.

The explanation provided by the controller showed that data including audio was recorded from 2016 to 2021. The fact that the sound was recorded for such a long period of time makes the infringement to potentially relate to a large number of persons.

In the opinion of the Polish SA, the recording of voices of people who are often in the state of alcohol intoxication, which prevents them from making conscious statements or controlling the sounds they make, is excessive and unintended.

Decision

The Polish SA stated that the controller cannot invoke any of the grounds listed in Article 6.1 of the GDPR, and in particular the one indicated in Article 6.1(c), according to which the processing of data is necessary for compliance with a legal obligation to which the controller is subject. Moreover, none of the regulations governing the Centre's activity allows the Centre to record this type of data (sound) as part of surveillance.

When determining the amount of the administrative fine, the degree of cooperation with the Polish SA was taken into account as the mitigating circumstance.

The controller also reacted (although not immediately) to the notice of initiation of administrative proceedings, ceased (preventively - until the decision is issued) the processing of data and erased all registered data, which demonstrated consideration for the data subjects’ rights.

An administrative fine of PLN 10 000 (approx. EUR 2200 ) was imposed on the controller.

For further information: decision in national language.