> ## Content Index
> Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Ryneš: When Home Security Cameras Reach Beyond the Household
- URL: https://www.thedelatorrereview.com/rynes-when-home-security-cameras-reach-beyond-the-household/
- Published: 2014-12-11T19:46:00.000Z
- Updated: 2026-10-18T19:48:05.000Z
- Description: Protecting your home does not automatically put your camera outside data protection law. In Ryneš, the CJEU explained why recording a public footpath exceeded the household exemption—and why the homeowner’s legitimate security interests still mattered.
- Author: Lydia
- Tags: Court of Justice of the European Union (CJEU), Caselaw, Internet of Things (IoT), Personal Information, Processing, Surveillance, Legitimate Interests, Security (a.k.a. Integrity and Confidentiality)

**Case C-212/13 | František Ryneš v Úřad pro ochranu osobních údajů | Court of Justice of the European Union | Fourth Chamber | 11 December 2014**

> **Practice Takeaways:** **① Identifiable camera images are personal data. ②** Recording and storing those images can constitute automated **processing** without live viewing. **③ The household exemption is narrow**: home surveillance that also covers public space falls outside it. **④ A legitimate security purpose** does not itself establish an exemption. ⑤ Falling within data protection law does not automatically make surveillance unlawful or require consent.

**Can a camera installed to protect a family home bring its owner within EU data protection law?** And does that mean the owner needs permission from every passerby it records?

In Ryneš, the Court addressed the first question by examining the reach of the surveillance. The camera protected a private home, but it also recorded people using a public footpath and entering the house opposite. **That outward reach prevented the recording from qualifying as a purely personal or household activity.**

The answer to the second question required a separate assessment. The Court expressly recognized that data protection law could accommodate the homeowner’s legitimate interests in protecting property, health, and life.

**NOTE: The judgment interpreted Directive 95/46, the GDPR’s predecessor. Its distinction between the scope of the household exemption and the lawfulness of surveillance remains relevant under the GDPR.**

> **Practice Tip:** Assess the household exemption before selecting a legal basis. If the exemption does not apply, examine how the surveillance can satisfy the applicable requirements, including whether legitimate interests can support it.

## **What happened**

František Ryneš and his family had experienced repeated attacks by unidentified individuals. T**heir windows had been broken several times between 2005 and 2007\.** To protect his family and their home, Ryneš installed a fixed camera under the eaves. (Judgment, paras. 13–14.)

**The camera recorded the entrance to his home, the public footpath, and the entrance to the house opposite.** It captured images only and stored them on a hard disk in a continuous loop, overwriting older footage when the device reached capacity. **There was no monitor for viewing the images in real time, and only Ryneš had direct access to the system and recordings**. (Judgment, para. 13.)

On the night of 6–7 October 2007, another window was broken by a shot from a catapult. The recording helped identify two suspects. Ryneš gave the footage to the police, and it was used in subsequent criminal proceedings. (Judgment, para. 15.)

**One suspect asked the Czech data protection authority to examine the surveillance system’s lawfulness.** The authority found infringements concerning collection without consent, failure to provide information, and failure to notify the authority of the processing. Those were the authority’s findings; they should not be confused with the CJEU’s later answer. (Judgment, para. 16.)

After Ryneš unsuccessfully challenged the decision before the Prague City Court, the Czech Supreme Administrative Court referred a question to the CJEU: **could surveillance installed to protect a home and its occupants qualify for the household exemption when it also monitored public space?** (Judgment, paras. 17–19.)

## **Why the case matters**

Consumer security devices make it easy to record activity beyond the property they are intended to protect. A camera mounted on a private home may capture neighbors, visitors, delivery workers, and people simply walking past.

Ryneš explains why the owner’s personal reason for installing the camera does not settle whether data protection law applies. The nature and reach of the activity matter as well.

- A camera can serve a family’s security interests while recording activity beyond the family’s private setting.

The case also preserves room for the homeowner’s rights. Applying data protection law brings the competing interests into a framework for assessing necessity and protection. It does not resolve the balance against the homeowner in advance.

---

> **"To the extent that video surveillance such as that at issue in the main proceedings covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity \[...\]" (Judgment, para. 33.)**

---

## **Key holding**

The Court’s reasoning establishes three principal points:

1. **Identifiable images and their recording fall within data protection law.** An image constitutes personal data insofar as it allows identification. Recording and storing images on a continuous recording device constituted automated processing. (Judgment, paras. 21–25.)
2. **The household exemption did not cover the surveillance at issue.** A home security system that also monitored public space exceeded a purely personal or household activity, even though its purpose was to protect the occupants and their property. (Judgment, paras. 29–35.)
3. **Security interests remained relevant within the Directive.** Its provisions allowed appropriate consideration of the controller’s legitimate interests in protecting property, health, and life. The Court did not conclude that consent was the only possible basis for the processing. (Judgment, para. 34.)

## **The Court’s analysis**

### **1\. A recognizable image can be personal data**

The Directive covered information relating to identified or identifiable individuals. Applying that definition, the Court explained that a camera image constitutes personal data insofar as it makes identification possible. (Judgment, paras. 21–22.)

- The analysis did not depend on the camera recording names or attaching labels to the footage. **The image itself could make the person identifiable**. In the underlying dispute, the recording had in fact helped identify two suspects.

> **Practice Tip:** Assess whether footage permits identification, including through the surrounding circumstances. The absence of names from a recording does not establish that it contains no personal data.

### **2\. Recording and storage mattered without live viewing**

The system did not allow Ryneš to watch people in real time. It nevertheless recorded and stored images automatically on a hard disk. Those operations fell within the Directive’s definition of processing and its rules covering automated processing. (Judgment, paras. 23–25.)

- **Automatic overwriting did not change that classification**. Images were collected and stored before they were erased. Nor did the Court require publication or broad access to the recordings: only Ryneš had direct access to the system. (Judgment, paras. 13, 23–25.)

> **Practice Tip:** Examine what a device records and stores, even if nobody routinely watches the footage and older recordings are automatically deleted.

### **3\. The household exemption required a narrow interpretation**

The Court connected the Directive’s high level of protection with the fundamental right to private life. Exceptions and limitations concerning personal data protection had to remain within what was strictly necessary. The household exemption therefore required narrow interpretation. (Judgment, paras. 27–29.)

- Its wording reinforced that conclusion. The Directive referred to a ***purely* personal or household activity.** A connection with home or family life was insufficient by itself. The processing had to occur within the individual’s purely personal or household setting. (Judgment, paras. 30–31.)
- The Court also preserved ordinary private activities. Correspondence and address books could qualify for the exemption even when they incidentally concerned another person’s private life. The presence of information about someone outside the family did not, by itself, eliminate the exemption. (Judgment, para. 32.)

### **4\. Recording public space took the surveillance beyond the private setting**

The camera’s field of view supplied the decisive connection to the outside world. The surveillance covered a public footpath and was directed beyond Ryneš’s private setting. The Court held that surveillance of the kind at issue could not qualify as purely personal or household where it covered public space, even partially. (Judgment, para. 33.)

- The camera’s position on the family home did not confine the processing to household activity. Its operation also encompassed people moving through public space.

> **Practice Tip:** Review the actual field of view. The location of the camera and the owner’s security purpose do not establish that the people being recorded remain within a private household setting.

This conclusion concerns the surveillance described in the case. It should not be converted into a rule that every private photograph or holiday video taken in public falls outside the exemption.

### **5\. Protecting the family remained relevant to lawfulness**

Having rejected the exemption, **the Court expressly noted that the Directive allowed appropriate consideration of legitimate interests such as protecting the property, health, and life of the controller and his family.** (Judgment, para. 34.)

- It referred to Article 7(f), the legitimate-interests basis, as well as Article 11(2) and Article 13(1)(d) and (g), concerning specified exceptions or restrictions to obligations. These provisions had their own conditions; the Court did not grant a general security exemption.
- The homeowner’s purpose therefore remained legally significant. It belonged within the assessment of the applicable requirements, rather than automatically removing the surveillance from their scope.

> **Practice Tip:** Keep the scope question distinct from the legal-basis question. Failure to qualify for the household exemption does not establish that consent is required, and identifying a legitimate security interest does not complete the necessity and balancing assessment.

## **The Advocate General’s Opinion**

Advocate General Niilo Jääskinen proposed the same answer in his Opinion of 10 July 2014, explaining in greater detail why the homeowner’s purpose and the surveillance’s reach required separate consideration.

- First, **applicability should rest on objective criteria.** A controller’s subjective security purpose could matter to lawfulness, but pedestrians’ protection should not depend on the private intention of the person recording them. (Opinion, points 40–47.)
- Second, **the household connection had to be exclusive**. Although protecting a dwelling was a household activity, systematic surveillance extending into public space also concerned people with no connection to that family. The Court expressly referred to the Advocate General’s analysis of exclusivity. (Opinion, points 51–58; Judgment, para. 31.)
- Third, **publication was unnecessary for the Directive to apply**. Recording and retaining personal data could themselves affect protected rights. The lack of public dissemination did not establish a household exemption. (Opinion, points 59–60.)
- Finally, **applicability did not establish unlawfulness.** The Advocate General considered that Article 7(f) might support the processing, subject to necessity and balancing the competing rights in the circumstances. That assessment was for the national court and exceeded the question referred. (Opinion, points 23, 61–67.)

The homeowner’s security interests can be considered within data protection law even when they do not take the surveillance outside it.

## **What the Court did—and did not—decide**

The Court decided that the **recorded surveillance described in the reference fell outside the Directive’s household exemption because it also monitored public space**. It also confirmed that **identifiable camera images could be personal data** and that their **automatic recording and storage constituted processing.**

- It did not decide that all home security cameras were unlawful, require consent from every person recorded, or complete the legitimate-interests assessment. Nor did it determine whether the recording was admissible in the criminal proceedings. Its preliminary ruling supplied the interpretation needed by the national court.

The case involved a fixed camera with continuous recording. **It did not decide the treatment of every modern video doorbell configuration**, including systems with different activation, recording, audio, or cloud features. Applying its reasoning requires attention to the particular processing.

Under the GDPR, Article[ 2(2)(c)](https://gdpr-info.eu/art-2-gdpr/?ref=thedelatorrereview.com) retains the household exemption, while Article [6(1)(f) ](https://gdpr-info.eu/art-6-gdpr/?ref=thedelatorrereview.com)provides the legitimate-interests basis. The **EDPB’s video-device guidelines expressly carry forward Ryneš’s approach to surveillance extending into public space.** They also recognize that ordinary private filming and some surveillance confined to private premises can qualify for the exemption, depending on the circumstances. (GDPR, Articles 2(2)(c) and 6(1)(f); EDPB Guidelines 3/2019, paras. 11–14.)

- [Recital 18](https://gdpr-info.eu/recitals/no-18/?ref=thedelatorrereview.com) separately explains that providers supplying the means for household processing remain subject to the GDPR. An individual’s exemption therefore does not automatically extend to a camera or cloud-service provider.

The Directive’s notification requirement should not be imported into the GDPR. **The GDPR does not retain that general prior-notification system.** Ryneš itself did not decide GDPR recordkeeping obligations.

## **Conclusion**

Ryneš makes the **camera’s reach central to the household-exemption analysis**. Recording public space can bring home surveillance within data protection law even when the owner’s sole aim is protecting the family.

Once the law applies, that **security purpose still matters.** The next question is whether the recording satisfies the applicable requirements, including an appropriate legal basis and an assessment of the competing interests.

## **Sources and Useful Reading**

### **Sources**

CJEU judgments, Advocate General opinions, and related case materials are available through [InfoCuria](https://infocuria.curia.europa.eu/?ref=thedelatorrereview.com), the Court of Justice of the European Union’s official case-law database. The case can be located using **Case C-212/13, František Ryneš v Úřad pro ochranu osobních údajů**.

- Court of Justice of the European Union, Fourth Chamber, Case C-212/13, *František Ryneš v Úřad pro ochranu osobních údajů*, Judgment of 11 December 2014, ECLI:EU:C:2014:2428.
- Opinion of Advocate General Niilo Jääskinen, Case C-212/13, delivered 10 July 2014, ECLI:EU:C:2014:2072\.

**Directive 95/46/EC**, particularly Articles 2, 3(2), 7(f), 11(2), 13(1), and 18, which supplied the framework interpreted in the judgment. [Read the Directive](https://eur-lex.europa.eu/eli/dir/1995/46/oj/eng?ref=thedelatorrereview.com).

**GDPR: Regulation (EU) 2016/679**, particularly Articles 2(2)(c), 4(1), 4(2), 4(7), 6(1)(f), and 30, and Recital 18\. These provide the corresponding scope and definition provisions and the GDPR’s separate requirements. [Read the Regulation.](https://gdpr-info.eu/?ref=thedelatorrereview.com)

**EDPB Guidelines 3/2019 on processing of personal data through video devices**, particularly sections 2.3 and 3.1 on the household exemption and legitimate interests. [Read the Guidelines](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb%5Fguidelines%5F201903%5Fvideo%5Fdevices%5Fen%5F0.pdf?ref=thedelatorrereview.com).

### **Useful reading from The de la Torre Review**

- **Jehovan: When Door-to-Door Notes Create Joint Control** — Examines the household exemption in organized religious outreach. Read alongside Ryneš, it shows why an individual’s personal motivations do not settle whether processing remains within private or family life. [Read the Article](https://www.thedelatorrereview.com/jehovan-when-door-to-door-notes-create-joint-control/).
- **Wirtschaftsakademie: When a Facebook Page Creates Joint Control** — Examines the functional assessment of responsibility for processing performed through another company’s technology. It complements Ryneš by addressing a separate question: who determines the purposes and means of the processing? [Read the Article](https://www.thedelatorrereview.com/wirtschaftsakademie-when-a-facebook-page-creates-joint-control/).
- **Google Spain: The “Right to Be Forgotten”—While the Past Remains Online** — Explains the protection of fundamental rights that Ryneš draws on when interpreting the Directive and narrowly construing its household exemption. Ryneš expressly cites Google Spain in paragraphs 27 and 29\. [Read the Article](https://www.thedelatorrereview.com/google-spain-the-right-to-be-forgotten-while-the-past-remains-online/).
- **What Is a Controller?** — Explains why controller status depends on determining the purposes and means of processing. Provides the foundation for understanding how an individual operating a security camera can have controller responsibilities when the household exemption does not apply. [Read the Article](https://www.thedelatorrereview.com/what-is-a-controller/).
- **Material Scope of the GDPR** — Explains what constitutes processing, when automated and manual processing fall within the GDPR, and the household exemption under Article 2(2)(c). Provides the broader framework for understanding why recording and storing identifiable images constituted processing in *Ryneš* and why surveillance extending into public space exceeded the narrow household exemption. [Read the Article](https://www.thedelatorrereview.com/material-scope-of-the-gdpr/).

![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/10/ChatGPT-Image-Jul-4--2026-at-04_44_14-PM-21.png)