The Hague District Court cuts DPA fine on police for mobile camera cars without completed DPIA to 30,000 euros

What it is about

At the start of the pandemic mobile camera cars were deployed in Rotterdam while the police had not yet completed the data protection impact assessment (DPIA). The DPA fined the police 50,000 euros under the Police Data Act. The court finds that police data were processed on 20 and 29 May 2020, but only 20 May is a breach, because the DPIA was completed after 26 May. The court considers the breach serious and culpable and rejects force majeure. Because the breach lasted only one day and repetition is very unlikely, the court sets the fine at 30,000 euros.

What this means in practice

A deployment framework or preliminary DPIA does not replace a full impact assessment with risk analysis and measures; it must be finished before the camera is switched on. Processing starts only when the camera is actually on, which determines the duration of the breach and thus the fine. Acting fast in a crisis can lower the fine but does not justify the breach. For the DPIA duty under the Police Data Act the court follows the interpretation of GDPR article 35 and the EDPB guidelines.

The GDPR articles concerned

• Article 35: Data protection impact assessment