TK v Asociaţia de Proprietari bloc M5A-ScaraA.
Date: 2019-12-11
32


Secondly, by its first and second questions, Tribunalul Bucureşti (Regional Court, Bucharest, Romania) refers to Articles 8 and 52 of the Charter, taken in isolation or read in conjunction with Article 7(f) of Directive 95/46. The Court has made clear that the assessment of the condition laid down in that provision, relating to the existence of fundamental rights and freedoms of the data subject which override the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, necessitates a balancing of the opposing rights and interests concerned which depends on the individual circumstances of the particular case in question, and in the context of which account must be taken of the significance of the data subject’s rights arising from Articles 7 and 8 of the Charter (judgment of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 40). It follows that Articles 8 and 52 of the Charter must not, in the present case, be applied in isolation.
34


It must be borne in mind that surveillance in the form of a video recording of persons, which is stored on a continuous recording device — the hard disk drive — constitutes, pursuant to Article 3(1) of Directive 95/46, the automatic processing of personal data (judgment of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraph 25).
36


In addition, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of Directive 95/46 and, secondly, with one of the criteria for making data processing legitimate listed in Article 7 of that directive (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 71 and the case-law cited).
37


Article 7 of Directive 95/46 sets out an exhaustive and restrictive list of the cases in which the processing of personal data can be regarded as being lawful. The Member States cannot add new principles relating to the lawfulness of the processing of personal data in that article or impose additional requirements that have the effect of amending the scope of one of the six principles provided for in that article (judgment of 19 October 2016, Breyer, C‑582/14, EU:C:2016:779, paragraph 57).
40


In that regard, Article 7(f) of Directive 95/46 lays down three cumulative conditions in order for the processing of personal data to be lawful, namely, first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; secondly, the need to process personal data for the purposes of the legitimate interests pursued; and thirdly, that the fundamental rights and freedoms of the person concerned by the data protection do not take precedence over the legitimate interest pursued (judgment of 4 May 2017, Rīgas satiksme, C‑13/16, EU:C:2017:336, paragraph 28).
42


In the present case, the objective which the controller essentially seeks to achieve when he or she installs a video surveillance system such as that at issue in the main proceedings, namely protecting the property, health and life of the co-owners of a building, is likely to be characterised as a ‘legitimate interest’, within the meaning of Article 7(f) of Directive 95/46. The first condition laid down in that provision appears, therefore, in principle, to be fulfilled (see, by analogy, judgment of 11 December 2014, Ryneš, C‑212/13, EU:C:2014:2428, paragraph 34).
46


As regards the second condition laid down in Article 7(f) of Directive 95/46, relating to the need to process personal data for the purposes of the legitimate interests pursued, the Court has pointed out that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary (judgment of 4 May 2017, Rīgas satiksme, C‑13/16, EU:C:2017:336, paragraph 30 and the case-law cited).
53


In that context, the Court has held that Article 7(f) of Directive 95/46 precludes Member States from excluding, categorically and in general, the possibility of processing certain categories of personal data without allowing the opposing rights and interests at issue to be balanced against each other in a particular case. Thus, Member States cannot definitively prescribe, for certain categories of personal data, the result of the balancing of the opposing rights and interests, without allowing a different result by virtue of the particular circumstances of an individual case (judgment of 19 October 2016, Breyer, C‑582/14, EU:C:2016:779, paragraph 62).
54


It is also apparent from the case-law of the Court that it is possible to take into consideration, for the purposes of that balancing, the fact that the seriousness of the infringement of the data subject’s fundamental rights resulting from that processing can vary depending on the possibility of accessing the data at issue in public sources (see, to that effect, judgment of 4 May 2017, Rīgas satiksme, C‑13/16, EU:C:2017:336, paragraph 32).
55


Unlike the processing of data from public sources, the processing of data from non-public sources implies that information relating to the data subject’s private life will thereafter be known by the data controller and, as the case may be, by the third party or parties to whom the data are disclosed. This more serious infringement of the data subject’s rights enshrined in Articles 7 and 8 of the Charter must be taken into account and be balanced against the legitimate interest pursued by the data controller or by the third party or parties to whom the data are disclosed (see, to that effect, judgment of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 45).