Regarding the Google Street View service and the equivalent service provided by the Greek Geoinformatics company Kapou Ltd through the web page www.kapou.gr the Hellenic DPA announces the following:
In both cases, it concerns services which will provide the users with three-dimensional navigation of the streets of selected cities through the internet.
Google Inc., whose headquarters are located in the USA, has submitted a notification to the Hellenic DPA concerning its Street View Service. The service is already offered in the USA and is being expanded to European Union countries. According to the notification the pictures, in which identifiable faces of passing people or car –license plates are located, will be further processed and the pictures in question will be blurred. Only after blurring will the service be offered to the public through the internet. Moreover, data subjects and third parties maintain the right to object if they locate a picture not sufficiently blurred or if they do not wish the publication of the picture of their house.
The European Data Protection Authorities are already dealing with this particular service, which has also been discussed in the context of the Article 29 Working Party of the Directive 95/46/EC.
The Hellenic DPA considered the notification and, after taking into account the views of Article 29 Working Party of Directive 95/46/EC, judged that it is competent to judge the lawfulness of the processing as the particular service processes personal data and the collection of data is carried out by means situated on the Greek territory. The Hellenic DPA reserved its right to judge the lawfulness of the processing after the submission of additional clarifications and it did not allow the commencement of the collection of pictures until then. The additional requested clarifications refer particularly to the following:
• Completion of the notification by Google designating its representative in Greece and clarification of the role of the affiliated company of Google established in Greece regarding the particular service as well as clarification of the geographic territory that the service in Greece will cover.
• Taking of appropriate and sufficient measures for informing the data subjects about the characteristics of the service and their rights. The simple marking of the equipped vehicles is not considered as a sufficient and appropriate method of informing the data subjects.
• Report on the measures taken in order to avoid taking pictures of areas where sensitive data may be revealed.
• Determination with sufficient justification of the retention period, the purpose, and the necessity to store the raw data, i.e. the pictures before their blurring process, as well as determination of categories of possible recipients of these data.
• Periodical security and data protection audits must be held by specialised audit companies.
Regarding the equivalent service provided by the Greek company Kapou.Ltd., for the time being for the cities of Thessalonica, Athens and Trikala, the Hellenic DPA asked the company to submit the obligatory notification according to the law, to proceed in blurring the pictures that contain identifiable faces of passing people and vehicle–license plates, to take measures for the effective protection of personal data, equivalent to those mentioned above for Google Inc., and to interrupt the provision of service to the public until then.
