Spying on Rudolph
To figure out Santa’s secrets, there are modern high-tech devices that might come in handy. But what does the law allow?
Lots of people are curious to catch a glimpse of Santa Claus sneaking down the chimney to deliver toys—or finding some other means of ingress if the home doesn’t have a chimney. Old-fashioned methods, like stringing up bells that would jingle as he passed, laying out cookies as bait, or listening closely for the pitter-patter of little reindeer hooves on the rooftop, have delivered disappointing results. How many people fall asleep with their eye to the keyhole, wake to find presents next morning, and think, maybe next year?
But some more enterprising folks draw on the arsenal of high-tech devices to spy on Kris Kringle. All it would take is to install a small motion-sensitive video monitoring device on the roof to capture Rudolph and his team of reindeer in action. But what if Santa frowns on such tomfoolery? Even worse, what if he pursues legal remedies?
At first glance, snoopy homeowners might think the coast is clear. In Poland, the proposed Visual Monitoring Act is still in the very early stages of the legislative process, which means there are no regulations in force at the moment expressly regulating the use of monitoring systems on public or private property.
But in certain circumstances, regulations from the Personal Data Protection Act might be applicable. This could be the case if the image of a natural person—which Claus no doubt is—is recorded and stored so that it could be played back later. Before processing personal data, a number of requirements must typically be met. Often a condition is to obtain the consent of the data subject.
But what if the monitoring is used only for gift-giving purposes, inside or just around a private household? Art. 3a of Poland’s Personal Data Protection Act provides that the act does not apply to individuals who process data exclusively for personal or domestic use—and it is hard to imagine a more personal use than fulfilling one’s childhood wishes.
For an answer to this question, we can turn to the decision handed down by the European Court of Justice—just in time for Yuletide—in Ryneš v Úřad pro ochranu osobních údajů (Case C‑212/13, judgment of 11 December 2014). There the court addressed the issue of processing of personal data by an individual “in the course of a purely personal or household activity.”
W 2007 the Czech citizen František Ryneš had a problem more serious than catching Saint Nick in the act of delivering Christmas presents. Over the previous years, unknown perpetrators had attacked his house and broken the windows on several occasions. Concerned for the safety of himself and his family, Ryneš installed a system of video cameras under his roof, capturing the scene at the entrance to his house and on a public footpath leading up to the house. Thanks to this device, next time around the intruders were captured. But one of them demanded a review of the legality of the system of video cameras Ryneš had installed. The Czech Office for Personal Data Protection (ÚOOÚ) found that Ryneš had not met the legal requirements imposed on him as a controller of personal data. The case reached the Czech Supreme Administrative Court, which in turn sought a preliminary ruling from the European Court of Justice.
The ECJ held that the image of a person recorded by a video camera constitutes personal data if it enables the specific person to be identified. The ECJ also held that monitoring involving recording of such images of persons and storing them on equipment that records in a continuous manner (e.g. on a hard drive) constitutes the processing of personal data.
The ECJ adopted a narrow interpretation of the concept of processing data “in the course of a purely personal or household activity.” According to the court, “To the extent that video surveillance such as that at issue in the main proceedings covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity” for purposes of Art. 3(2) of the Data Protection Directive (95/46/EC).
However, the court also pointed out that, “where appropriate,” the directive permits taking into account “legitimate interests pursued by the controller, such as the protection of the property, health and life of his family and himself.”
Under Polish law, such a provision is Art. 23(1)(5) of the Personal Data Protection Act, under which processing of data is permissible “if necessary to fulfil legally justified aims pursued by data controllers or data recipients, and the processing does not violate the rights and freedoms of the data subject.”
So, applying the ECJ’s holding in the Ryneš case to attempts to capture Santa Claus & Co. on a video monitor, as long as the monitoring device covers only the private sphere—and there does not appear to be any public aspect to the chimney of a house—it is entirely permissible without the need to comply with any formalities connected with the processing of personal data.
Doubts would arise, however, if the video camera were turned away from the private sphere to capture the scene on the street outside, covered with freshly fallen snow and gleaming in the moonlight.
As Santa is deemed to pursue laudable purposes when making his yearly rounds, and is not up to anything naughty or nefarious, spying on the jolly old fellow on public property—and perhaps memorialising the frigid features of Jack Frost or the innocent mugs of carefree carollers—could hardly be justified by the homeowner’s need to protect the family’s property, health and life. And for his pains, the snoop just might find a lump of coal in his stocking come Christmas morning.
Jacek Czarnecki, New Technologies Practice, Wardyński & Partners
