A cyclist was fined for taking pictures of car number

The Bavarian Data Protection Authority (DPA) fined a cyclist for taking pictures of car numbers of wrongly parked cars.

The cyclist’s aim was to send the pictures to the police in order to fine the owners of the parked cars. However, the result obtained was different from what was expected.

Penalty against Responsible for taking pictures of car numbers

Based on Article 58(2)(b) of the GDPR, the Data Protection Authority imposed a penalty against the cyclist. It argued that taking and sending pictures of car numbers involves the processing of personal data.

It also found that the Responsible for did not comply with its information duties under Articles 13(1)(d) and 14(2)(b) of the GDPR. 

It ruled that there was no legitimate legal basis for the processing referred to in Art. 6.1 GDPR, since the controller did not obtain the consent of the vehicle owners.

It also did not have a legitimate interest justifying the processing. Therefore, the Responsible for was requested to pay a fine of €100.

Complaint against the decision of the data protection authority

The cyclist filed a complaint against the decision of the Bavarian Data Protection Authority in a written statement to the Administrative Court of Ansbach.

The court overturned the DPA’s decision. It argued that the reprimand issued by the DPA was unlawful, holding that the complainant did not violate any provision of the GDPR.

Taking pictures of vehicles and subsequently sending them to the police constitutes the processing of personal data pursuant to Article 2(1) of the GDPR and Article 4(1) of the GDPR.

It considers that a car number is information that allows the identification of a natural person, even though the provision of additional information by the authorities is necessary to identify the data subject.

In addition, the domestic exception established in Article 2 (2) GDPR is not applicable to the case, as the processing of personal data goes outside the private sphere.

The pictures taken were intended to be sent to the police, which is not considered a purely personal activity.

Legal basis for prosecution

Overturning the fine imposed against the cyclist for taking pictures of car numbers imposed by the DPA, the Administrative Court of Ansbach notes that the cyclist, the data controller, could rely on Article 6(1)(f) of the GDPR to process the personal data in question.

This is because the Responsible for had a legitimate interest in being able to report a crime by forwarding the pictures to the police.

For this, it will be necessary to turn to Consideration 50, “The indication of possible criminal acts or threats to public security by the data controller and the transmission to the competent authority of data in respect of individual cases or diverse cases relating to the same criminal act or threat to public security must be considered to be in the legitimate interest of the data controller.”

The Court held that the reporting of criminal offenses generally constitute a legitimate interest.