Home is where the heart is: the household exemption in the 21st century

5

Right from the initial proposal for a DPD by the Commission, the household exemption was included in the text. Throughout the legislative process, the provision underwent several small, but important changes. From the legislative history, no unified approach can be discovered with respect to the meaning, interpretation, rationale and scope of application of the exemption. Rather, it seems that while sometimes explicitly substituting its own wording for that of another party to the legislative process, most revisions are not the result of a critical dialogue, but rather of ad hoc and standalone suggestions and variations on a theme. Some of the most important aspects of the household exemption in the legislative process of the DPD will be discussed below to understand the ambiguity that later plagued its interpretation and meaning in jurisprudence and opinions. The text that was finally adopted in the Directive is:

6

Examples: Both in the legislative history and in the relevant recital, several closely related, but distinct examples of when the household exemption would apply have been provided. The example given by the Commission in its initial proposal was that of keeping a personal electronic diary. [5] A diary is highly personal, and something normally not shared with third parties. It contains subjective interpretations and private emotions as well as objective facts, such as what a person did or whom they spoke to on a certain day. A diary may contain data about a person themself, but often also discusses the lives and behaviour of loved ones, friends, and family. It may also include statements or observations about public events and figures or personal effusions like ‘I’m in love with my boss’ or ‘I think the prime minster is a total creep’. A second example is that of a personal address file. [6] An address file is distinctly different from a personal diary. It contains far less information and in principle no sensitive data (though of course an example might be construed where a person lives in a brothel or similarly sensitive location). These addresses are usually already in the public domain; addresses, names and telephone numbers were traditionally made available through a phone book or similar catalogues. Normally, a person only holds an address book with people whom they are in contact with or plan to be; importantly, a person may keep an address book for both personal and professional reasons (especially as some colleagues may be friends). A third and final example, which was incorporated in the recital only late in the process, was that of correspondence. [7] Obviously, this example is directly related to keeping an address file. Still, it is distinct in that it entails acting on the data, engaging with persons outside the home or family sphere and that personal data of third parties may be disclosed. An e-mail addressed to a friend may, for example, concern the awkward behaviour of a mutual colleague, a friend, or the prime minister. This example, as well as the second example, is directly linked to Article 8 of the European Convention on Human Rights (ECHR), the right to correspondence, while the first example, that of keeping a diary, may be seen as linked to the right to private life. The first example was not, the latter two examples were incorporated in the recital of the DPD.

7

Rationale: The Commission favoured a household exemption because an “invasion of privacy was unlikely to occur” when data are used for private purposes only, [8] thus focussing on the potential impact of the data processing. [9] A second rationale was that household activities themselves were deemed to fall under the right to private life (Article 8 ECHR). [10] Because the data protection framework was set out to enhance the privacy of citizens, it should not intrude on the private sphere of individuals.

8

Scope: The standard approach to the household exemption is that if it applies, then the data protection framework is inapplicable. Another approach was suggested by the Economic and Social Committee (ESC), which stressed that it supported the household exemption, but that “the general principles of Convention108 should continue to apply to such processing to guard against improper use.” [11] The DPD, which is meant to provide for more and stricter rules than Convention108, cannot lead to a lower level of protection than provided by Convention108, which does not contain a household exemption.

9

Private/personal/household/domestic: The initial proposal for the Article did not refer to the household, but spoke of “private and personal”, while the initial recital referred to the exercise of a natural person’s right to privacy. This was changed only quite late in the legislative process, when it was suggested that the recital speak of “personal or domestic” and the article of “personal or household”. [12] No explanation was given for this amendment. It might be suggested that the revised wording makes clear that the private domain in which the processing takes place should be a central element, thereby excluding private activities that take place outside the home. But, if this were the correct interpretation, this raises a question concerning the relationship between private and personal and between personal and domestic. Why the recital speaks of domestic and the article of household was left unexplained.

10

And, or: The revision had another important effect, namely that it changed “and” for “or” [i.e. “personal or household” instead of “personal and household”]. With respect to “and”, it could be wondered whether it was meant as an exclusive or an inclusive term. Was it used in the sense of “I like to go on vacation to Paris and New York” or in the sense of “I like to go on vacation to a place warm and sunny”? This is important, because though “private” is replaced by the more specific and potentially more restrictive “domestic” and “household”, the term “personal” has a broad connotation and personal activities could extend far beyond the private sphere. The legislator seems to have made an end to this discussion by using the term “or” instead. Yet, the term “or” raises similar questions, as it can be used in an inclusive way, “I like to go on vacation to France or Spain”, or in an exclusive way, “I like to go on vacation to a place that’s very warm or ice-cold”.

11

Purposes/activities: The initial proposal spoke of private and personal purposes. Consequently, it was the goal or the reason for which personal data were processed that was determinative for the question of whether processing of personal data fell under the household exemption. Parliament suggested to change that to activities, without providing explanation. Perhaps it is because activities can be objectively assessed, while purposes are purely subjective. Although there is something to be said for this interpretation, and this line of is at times adopted by the CJEU, it would still be remarkable because the purpose for processing personal data is arguably the central element in the data protection framework.

12

Exclusivity: The Commission’s proposal referred to “solely”, both in the recital and in the article. Later, this was changed so that the recital speaks of “exclusively” and the article of “purely”. All words seem to mean more or less the same, and no discussion or explanation exists of why these words have been changed. Consequently, it might be suggested that they could be treated as interchangeable synonyms. At the same time, if these words mean the same, the question is why they are changed, and different wording is used for the recital and the article. An additional question that might be posed is whether the exclusivity clause only refers to “personal” and not to “household” activities (“exclusively personal” and “household”, instead of “exclusively personal” and “exclusively household” or “exclusively personal or household”), but from the changing of the order of the terms, it seems clear that this is not the case. [13]

13

Files/personal data: The initial proposal by the Commission referred to files held by an individual solely for private and personal purposes. The notion of data file, instead of personal data, was central throughout the initial proposal for the Directive by the Commission. This was changed on the suggestion of the ESC because the concept of data files seemed too narrow: “personal data can nowadays be processed in an expert system without necessarily having to be structured (integrated data-bases). Moreover, it is the “purpose” of the processing that is crucial in data protection and that establishes whether or not the collection of data is legitimate. Accordingly, the Committee feels that the concept “processing of personal data”, rather than the “file”, should be used to define the scope of the Directive. The term “processing” should therefore replace the term “file” in Articles 3, 4, 5, 7, 8(l)(c), 8(2) and 11.” [14]

14

Embedding: The initial proposal referred not only to the matters falling outside community law, but also, in paragraph 2 of Article 3, both to the household exemption and to non-for-profit-organisations holding files on its members, who have consented to their personal data being processed, where those data are relevant for the interests of these organisations and where the data are not transferred to third parties. Examples that were given related to political organisations, sport organisations, trade unions, religious organisations and, more generally, cultural, philosophical, and even leisure organisations. The reason to treat this exemption in the same paragraph as the household exemption was that in both situations, harm was thought to be unlikely. [15] This suggestion did however not make it to the final text. [16]

15

The EDPS has only in a small number of opinions referred to the household exemption, the WP29 in a substantial number of opinions. Several points stand out from their reflections.

16

Controllership: The WP29 treats the household exemption, in quite a number of instances in the context of controllership, as if the household exemption was an exemption to the notion of controllership instead of the data protection framework as a whole. [17] For example, it stressed that a citizen needs not assume the role of the data controller when using Social Network Sites (SNS), [18] when they can rely on the household exemption, [19] an approach which was repeated in its opinions on the concepts of data controller and processor, [20] search engines [21] and when assessing the quality of Quebec’s data protection legislation. [22] If a citizen relies successfully on the household exemption, and would have been the only controller, the question is what should be the legal status of the processor, which has to process data at the instruction of the data controller and, inter alia, has to report on potential leaks.

17

Joint controllership: By far most references by the WP29 and the EDPS in respect of the household exemption is to cases in which, would the household exemption not apply, there would be joint controllership. Such is the case with SNS, IoT devices and other products or services that a citizen may use for personal activities. Interestingly, both advisory bodies are often ambivalent as to whether the household exemption applies. [23] When the user can rely on the household exemption, both advisory bodies point out, such does not have an effect on the legal status of the joint controller (e.g. the SNS or the party to which the data of IoT devices are sent). This is understandable, because these parties process the data for their own interests, be it commercial, be it otherwise. Yet, it does raise the question where the boundary should be drawn. For example, suppose a non-for-profit-foundation was set up with the sole purpose of the processing personal data for personal activities by citizens, would such processing also not fall under the household exemption? In addition: to what extent can the joint controller (e.g. the social media platform) be held accountable for the activities of citizens relying on the household exemption?

18

Purposes: Contrary to the legislative choice, the WP29 generally focusses on purposes rather than activities when determining whether the household exemption applies. What is more, it has referred not only to personal purposes, but also to family affairs and recreational purposes. [24] This raises complex issues, because when assessing SNS sites, the WP29 stressed that if citizens use the sites not so much for fun, but for productivity, to advance commercial, political or charitable goals, the household exemption would not apply. [25] This yet again brings the question to the fore where the boundary is drawn. Is saying on Facebook “I really like Emmanuel Macron’s plans” personal or political and what about “Emmanuel Macron is sexy and hot” or “I think Emmanuel Macron has leadership skills”? All concern processing personal data of Emmanuel Macron, but the purpose behind the statement is not always clearcut. At least two rationales have played a role in the legislative process of the DPD (minimal harm for the “data subject” and the private sphere of the “data controller”, both between brackets because the data protection regime does not apply when the household exemption applies). Suppose A places a photo on a social network where a person’s child can be seen in an embarrassing situation and B states on a blog “I think we should vote for Emmanuel Macron”. If the rationale behind the household exemption should be understood as that no harm is typically done by private processing activities, then A’s expression seems potentially more harmful than B’s, but if it concerns activities that normally fall under the right to private life, it is A’s expression that could fall under the household exemption, while B’s would normally not. Interesting in this respect is the discussion of the WP29 on IoT devices, and the fact that it does not answer questions such as: [26] is a smart refrigerator that automatically orders a bottle of milk considered a (exclusively) household activity or a (partially) commercial activity?

19

Sphere: The WP29 does not exclude that when data are made available in open access databases for re-use, individuals that harvest that data for personal activities could rely on the exemption. [27] This is remarkable, because the CJEU has stressed that gathering personal data from the public domain does not fall under the household exemption (next sub-section). A bit puzzling as well is the remark by the WP29 on video surveillance. It points out that premises other than those related to one’s household—such as hotel rooms, offices, restrooms, cloakrooms, in-house phone booths, etc.—are to be regarded as private premises. It is unclear how this remark should be interpreted, whether it means, for example, that there are limits to putting camera surveillance in hotel rooms by hotel owners, or the other way around, that citizens monitoring a hotel room for private purposes (e.g. to protect their private property) fall under the household exemption. [28] If the latter, the question is how the situation in which a cleaning person might enter the room should be assessed. [29]

20

Other legal regimes: Time and again, the WP29 makes clear that even if the household exemption applies, other legal regimes will still need to be respected, such as “the general (civil law) provisions safeguarding personal rights, image, family life and the private sphere – one need only think, for instance, of the visual angle of a camera installed outside the door of a flat, which may allow systematically recording the clients of a medical clinic and/or law firm located on the same floor and thereby cause undue interference with professional secrecy.” [30] Although this seems obvious, at the same time, it echoes the statement by the ESC during the legislative process of the Directive. If interpreted strictly, the relevance of the household exemption might be significantly reduced as Article 8 ECHR would still be applicable as well as the tort law regime. For example, the WP29 stressed that if the household exemption does not apply to citizens that use SNS, the freedom of speech exemption in the data protection framework might. This could mean that legality of processing would be treated as a potential conflict between Article 8 ECHR and 10 ECHR. [31]

21

The CJEU has issued several rulings important to understanding the household exemption.

35

Before turning to the concrete analysis of the legislative process of the GDPR, it is important to recount two detailed assessments of the household exemption that provided the basis of the discussion, namely the Impact Assessment and an opinion by the WP29.

36

The Impact Assessment distinguished between three core problems with the data protection framework, one of which were the difficulties for individuals in exercising their data protection rights effectively. One of the solutions it offered was to introduce legislative amendments to reinforce responsibility of data controllers, which could be done, inter alia, by clarifying the household exemption: “In this case, when the processing has no gainful interest and concerns a ‘definite’ number of individuals they would be totally exempted from data protection rules.” [51] One of the main challenges identified was the unclarity of the legal status of citizens using SNS and their obligations within the data protection framework. It was recounted that the yardstick used by the CJEU, whether the data were disclosed to an indefinite number of people, meant that the data protection framework would apply in full, “even if the processing relates to purely non-economic, charitable and religious purposes.” In practice, it found, Member States (MSs) limited the obligations of the users or even simply ignored their obligations when processing personal data on SNS, instead focusing on the responsibilities of the SNs. This meant that although there was a formal rule following from the CJEU judgement, in practice, it was not or only marginally enforced.

37

The WP29 devoted no less than 10 pages explaining why it thought the household exemption should be revised. It focussed on the relation of the household exemption vis-à-vis the rules regarding the freedom of expression and stressed that although historically, both exemptions had their clearly defined and demarcated scope, this was no longer the case: “Rather than relating to individuals’ correspondence or their holding of records of addresses, for example, the queries and complaints DPAs receive increasingly concern individuals’ publication of personal data, either about themselves or about other individuals. It would be wrong to say that all of an individual’s personal online activity is being done for the purposes of journalism or artistic or literary expression. However, the advent of ‘citizen’ bloggers and the use of social networking sites to carry out different forms of public expression, mean that the two exemptions have become conflated.” [52]

38

It stressed the variations in the implementation of the DPD by MSs, inter alia highlighting that some laws exempted personal processing from the data protection principles but not from the Data Protection Authority (DPA)’s powers of investigation. But, in par with the impact assessment, it noted that DPAs had focused their attention almost exclusively on processing done by corporate entities or by natural persons acting in a professional capacity—for example, financial advisors or doctors. It also questioned whether the rationales for introducing the household exemption were still applicable. It stressed that since the adoption of the Directive, citizens’ access to information technology had expanded enormously. Consequently, while the processing of personal data by citizens used to be very limited both in terms of the amount of data, the sensitivity of the data and the potential impact of the data processing, this had radically changed, if only because data that are processed and kept privately can be instantaneously spread to an indefinite number of people with the click of a button.

39

Consequently, it suggested to revise the household exemption. One approach is to let all personal data processing fall under the scope of the data protection regime, or to have a specific set of requirements be applicable when citizens process personal data about other citizens, such as implementing light security measures, respecting some of the data subject rights, the data quality principle, the requirement of having a legal basis, and the transparency requirement. Although it saw merits in these more clear-cut approaches, it also acknowledged that it might put too high a burden on citizens, it may be undesirable for citizens to have a public authority scrutinize their dealings in private settings (one of the two original rationales for introducing the household exemption) and it might be difficult to envisage how DPAs could police individuals’ affairs as the logistical and practical issues might be insurmountable.

40

That is why it favoured leaving the household exemption intact but granting DPAs the authority to assess whether it applied in specific cases. The WP29, consisting of representatives of all national DPAs, thus suggested to enlarge the powers of the DPAs. The DPAs should perform that assessment on the basis of a list of criteria, none of which were to be understood as determinative in and of themselves: (1) Are the personal data disseminated to an indefinite number of persons, rather than to a limited group of friends, family members or acquaintances? [53] (2) Are the personal data about individuals who have no personal or household relationship with the person posting it? [54] (3) Does the scale and frequency of the processing of personal data suggest professional or full-time activity? [55] (4) Is there evidence of a number of individuals acting together in a collective and organised manner? [56] (5) Is there potential adverse impact on individuals, including intrusion into their privacy?

41

The legislative process of the GDPR is relevant because, although only the relevant recital has been revised, the household exemption was one of the main battlegrounds when drafting the Regulation. Discussions under the DPD were revived and new ones introduced. [57]

42

Gainful interest: The initial proposal of the Commission both in the relevant recital and in the article suggested that the household exemption to apply, the activity in question should be both for exclusively personal or household activities and be without gainful interest. This would introduce a new criterium (the interest), seemingly very closely aligned to the purposes for which data are processed, a commercial purpose generally meaning the pursuit of a gainful interest. This suggestion, however, received quite some criticism, both from the WP29 and from Parliament. The latter, for example, made clear that there may be gainful interests involved with the processing of personal data, such as when selling private belongings to another person. [58] The examples given by the WP29 are especially illustrative, such as “where an individual sells their unwanted birthday presents on an e-commerce site is an obvious example of ‘personal’ gainful interest. Another example might be where a child uses the internet to raise sponsorship money for a charity run”. [59] These examples seem to run counter to the CJEU judgements. When a person sells a book of Dan Brown through a website, she will process the personal data of Dan Brown and make those data available to an unlimited number of people.

43

Professional or commercial activity: The recital of the Commission’s proposal after its reference to the gainful interest included the text, “and thus without any connection with a professional or commercial activity”. Again, it met resistance and again the WP29 provided an example of why this clause should be omitted, which undermined the CJEU’s jurisprudence, namely when “an individual blogs about his day to day experience of working in a floristry shop, perhaps talking about customers and other staff members. WP29 does not accept that the processing of personal data done for a purpose such as this should necessarily fall outside the exemption, simply because any internet user can read the blog. It might be better to amend the wording to say ‘in pursuit of a professional or commercial objective’, rather than ‘in connection’ with it. Thought should also be given as to whether non-commercial, non-personal activity – such as running a political campaign – also needs to be addressed. We also need to consider whether a natural person’s keeping of professional contacts – ones that will not be shared or used by anyone else – is an activity that should fall outside the exemption.” [60]

44

Although the introduction of the gainful interest was rejected from the final text of both the recital and the provision, the reference to “no connection to a professional or commercial activity” was retained in the recital. This is remarkable because it seems redundant. If an activity is to be for purely personal or household activities, it cannot also be, even partially, for professional or commercial activities. An activity can logically speaking not be fully and only A but also B, if B is not a subset of A. The new clause could perhaps have made sense when different wording was chosen; for example, the Committee on Civil Liberties, Justice and Home Affairs (CCLJHA) had suggested to refer to a professional or commercial objective. Then, it would mean that purely personal or household activities which have a professional commercial objective fall outside the household exemption. But the final recital uses “activity” with respect to both personal and household and with respect to professional and commercial. Perhaps the added value of the clause lies in the “connection”, as some activities could in and by themselves be understood to be purely personal or household activities, but still have a connection to a professional or commercial activity. But what example the drafters of the GDPR had in mind remains unclear. [61]

45

Examples: The CCLJHA suggested to refer to, besides keeping an address file and correspondence, “the personal use of certain electronic services”, without explaining which electronic services. Parliament members suggested, inter alia, to provide, after the example of “correspondence’”, “independently by the medium used”, [62] perhaps thinking of personal correspondence through SNS. A suggestion was to speak of “purely personal or family matters”, [63] another amendment spoke of “exclusively personal, family-related, or domestic” [64] and a final text made mention of both family related activities and private sale. [65] All of these were rejected, which is remarkable in the case of reference to “family”, because it played an important role in the interpretation of the DPD by both the WP29 and the CJEU.

46

The final version of the recital provides, besides a reference to correspondence and keeping an address book, “or social networking and online activity undertaken within the context of such activities.” [66] This addition again seems to be confusing rather than clarifying. Apparently, there is a difference between correspondence and holding addresses on the one hand and social networking and online activities on the other, and apparently, the two mutually exclude each other signified by the “or”. “Fishing or sporting activities” implicitly means that fishing is not a sporting activity, while e-mailing, just to provide a basic example, seems a matter of both correspondence and an online activity. What is additionally confusing is that the social networking and online activities can be performed “in the context” of the personal and household activities, perhaps similar to when a professional karate sportsman is sent on a Siberian fishing expedition by his trainer to practice endurance and patience. The fishing activity is not performed for its own sake, but is an ancillary activity, performed in the context of a karate training. Perhaps chatting with family members is a household activity and social networks can be used in the context of that activity.

47

Indefinite number of people: The unofficial leaked version of the GDPR codified the CJEU’s Lindqvist doctrine by including a reference to the dissemination of data to an indefinite number of people. The first official draft, however, did not. Parliament members made many attempts to reintroduce this clause, in various wordings, and the CCLJHA suggested to provide in the article: “This exemption also shall apply to a publication of personal data where it can be reasonably expected that it will be only accessed by a limited number of persons”. [67] These suggestions were all rejected, perhaps again due to the strong intervention by the WP29, who found it “difficult to accept that the fact that an individual makes his blog or her social networking profile available to the world at large is – in itself – a factor that means that any processing of personal data done in connection with necessarily falls outside the scope of personal or household processing.” [68] The fact that indeed, no reference is made to this factor in either the recital or the article arguably means that the GDPR overrules the CJEU judgements on this point. At the same time, it is important to note that the WP29 did suggest including a reference to this element, for example in the recital, along with the other factors it had indicated as relevant but not determinative when assessing whether the exemption applies. [69]

48

Data gathering: It is remarkable that there was considerable discussion on the potential codification of the Lindqvist doctrine, but virtually none concerning the Rynes doctrine. There was one unsuccessful suggestion by a member of Parliament making an indirect reference to the question where data are gathered, suggesting to make reference in the recital to “purely personal or family matters that have been disclosed to them by the data subject himself or that they have received in a lawful manner.” [70] It seems to imply that when data are gathered lawfully in the public domain, that is on the basis of consent or one of the other legitimate grounds for processing, such could fall under the household exemption. This would create a difficult loop, because in order to assess whether the gathering of data was legitimate, the requirements from the data protection framework would have to be assessed, and when these are met, the consequence would be that the data protection framework would not apply. Perhaps unsurprisingly, the proposal was rejected.

49

Third parties: The WP29 had underlined time and again that the fact that a citizen may lawfully invoke the household exemption should not have implications for third parties. This led to the inclusion in the recital of the following phrase: “However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.” Though the reason for adopting this clause seems to be to regulate situations in which, would the household exemption not apply, there would be two or more joint controllers, such as with SNS, the recital also mentions processors. Such could be relevant, for example, when a cloud provider merely stores data on behalf of a citizen, who pursues a household activity. This would mean that there would be no controller, but a processor, who has to abide by the GDPR. This complicates matters, because most obligations in the GDPR are directed at the data controller. Also, data subject rights can be invoked vis-à-vis the data controller and some of the obligations directly applicable to processors indirectly concern the data controller, such as that when a data breach has occurred, the processor must notify the data controller. [71] The recital does not provide any further clarification on this point, neither does it explain the extent to which the joint data controller can be held accountable for the actions of the natural person that can invoke the household exemption. [72]

50

The implementation laws in the MSs mostly either adopt the wording of the GDPR or simply refer to the GDPR when it comes to the scope and limitations of the data protection regime. Inter alia dealing with the implications of the Rynes case, a number of countries have implemented special rules in their implementation laws concerning video surveillance or have adopted official guidelines on video surveillance. Some of these have chosen to follow the Rynes judgements, others seem to nuance the outcomes of that case.

51

In the first group, Austrian and Croatian data protection law deserve mention. Austria provides special rules for recording images, meaning observing occurrences in public or non-public space for private purposes, using technical devices for the processing of images. It provides that recording images is permitted if: (1) it is necessary in the vital interest of a person, (2) the data subject has consented to the processing of the data subject’s personal data, (3) it is ordered or permitted by special statutory provisions, or (4) there are overriding legitimate interests of the controller or a third party in a particular case. In the latter case, relevant factors to determine the legitimacy are: (a) whether it serves the protection of persons and property, whether the recordings focus on privately owned land “except when it includes public traffic areas, which may be unavoidable to fulfil the purpose of the image recording”, or (b), perhaps thinking of drones used to make landscape recordings, whether it serves a private documentary interest and does not aim to record uninvolved persons to identify or to record them, in a targeted manner, or (c), directly referring to the Rynes judgement, when “it is required for the precautionary protection of persons or items in publicly accessible places that are subject to the controller’s right to undisturbed possession because that right has already been infringed or because the place, by its nature, has a special risk potential”. [73]

52

Croatian law provides that the processing of personal data through video surveillance may be carried out only for the purpose necessary and justified for the protection of persons and property, if the interests of respondents who are in conflict with the processing of data through video surveillance do not prevail. Video surveillance may include premises, parts of premises, external surface of a building, as well as internal space in public transport. [74] Both the Croatian and the Austrian law follow the GDPR and the Rynes doctrine in the sense that these types of video surveillance in the public domain are said to fall under the scope of the data protection regime but can still be deemed legitimate when certain criteria are met.

53

A different approach is taken by the Latvian legislator, providing that the data protection regime shall not apply to data processing that natural persons conduct by using automated data recording facilities in road traffic, for personal or household purposes. It does clarify, nevertheless, that it shall be prohibited to disclose the records obtained in road traffic to other persons and institutions, except for the cases when any of the grounds for data processing specified in the data protection legislation are present. Secondly, it provides that the data protection regime shall not apply to data processing which natural persons conduct by using automated video surveillance facilities for personal or household purposes: however, “Surveillance of public space on a large scale or cases when technical aids are used for structuring of information shall not be considered as data processing for personal or household purposes.” [75] The latter negation seems to imply, a-contrario, that when the public domain is not monitored on a large scale or when no technical aids are used for structuring the data, the data protection regime would not apply. A similar approach seems to be taken in the official guidelines on camera surveillance in the Netherlands: “A person that wants to attach a camera to his jacket (a so-called 'bodycam') and use it to film the environment for himself when he is walking on the street. Other people will also be portrayed on these images. This is for personal or household use only, because this person does not pass on the camera images to third parties. The provisions of the [Dutch Data Protection Framework] therefore do not apply.” [76]

54

In an opinion, the EDPB reaffirmed all of the relevant factors set out by the WP29. It also gave illustrative examples: “A tourist is recording videos both through his mobile phone and through a camcorder to document his holidays. He shows the footage to friends and family but does not make it accessible for an indefinite number of people. This would fall under the household exemption. Example: A downhill mountainbiker wants to record her descent with an actioncam. She is riding in a remote area and only plans to use the recordings for her personal entertainment at home. This would fall under the household exemption. Example: Somebody is monitoring and recording his own garden. The property is fenced and only the controller himself and his family are entering the garden on a regular basis. This would fall under the household exemption, provided that the video surveillance does not extend even partially to a public space or neighboring property.” [77] It seems that the EDPB, like the WP29, tries to nuance the Rynes judgement by suggesting that when personal data are gathered from the public domain, but not made accessible to an indefinite number of people, such could still fall under the household exemption. [78]

55

Finally, there was a petition for information from the Commission on the household exemption. The petitioner argued in favour of broadening the scope of application of activities of a purely personal or domestic nature so as to include all acts carried out by natural persons that by their nature do not intend to violate the rights of a data subject without a valid reason and to allow data processing by natural persons in all cases as required for the purpose of reasonably reporting breaches or offences under the laws of MS. Remarkably, the Commission again focussed on the notion of controllership and linked this to commercial and professional activities: “Situations in which natural persons could act as controllers are when they process personal data in connection with their professional or commercial activities. Examples would be a medical doctor in private practice documenting treatment administered, or a sole trader processing personal data as part of delivering the services they offer.” [79] Thus, while the CJEU in Österreichischer Rundfunk and Bodil Lindqvist, found that the data protection also applied to situations in which personal data are processed for non-commercial or non-economic activities, now, at least with respect to data controllers that are natural persons, the Commission seems to find exactly that. It does not adopt the wording of the GDPR, namely that the household exemption does not apply in case data processing has a connection to a commercial or a professional activity, but stresses that a natural person can only be a data controller when they process personal data in connection with their professional or commercial activities.