Scenario: A shop owner decided to install a video surveillance system to protect the property against theft. However, the cameras also capture a considerable part of the store next door. Questio n: Which statement below is correct in this case?

The General Data Protection Regulation (GDPR) applies to the processing of personal data, which includes images of identifiable individuals captured by video surveillance. The shop owner acts as a data controller. According to the principle of data minimization (Article 5(1)(c) of the GDPR), personal data collected must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." In this scenario, the purpose is to protect the owner's property. Capturing a considerable part of the neighboring store is excessive and not necessary for this purpose, thus violating the data minimization principle. Therefore, the processing falls under GDPR, and the scope of surveillance is non-compliant.

A. This statement is too vague. The specific legal framework is the GDPR, not generic "community privacy requirements."
B. This is incorrect. Video surveillance of individuals constitutes the processing of personal data and can pose a high risk, placing it firmly within the scope of GDPR.
D. This is incorrect. While security can be a legitimate interest for processing, it does not provide an exemption from the GDPR's rules and principles.

1. European Data Protection Board (EDPB). (2020). Guidelines 3/2019 on processing of personal data through video devices. Version 2.0.

Paragraph 53, Section 4.2 (Data minimisation): "As a general rule, the controller should not carry out surveillance of areas that are not under his/her responsibility, such as public spaces or the property of neighbours. The camera’s field of view should be limited to the area of interest... If it is unavoidable to film the neighbourhood or the public space, the controller should use technical measures such as the masking or blackening out of these areas." This directly supports the conclusion that capturing the neighboring store is a violation.

2. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).

Article 5(1)(c): This article establishes the principle of 'data minimisation', stating that personal data shall be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". This is the core legal principle violated in the scenario.

3. Kamarinou, D., et al. (2016). The new EU General Data Protection Regulation: A first analysis. Queen Mary School of Law Legal Studies Research Paper No. 236/2016.

Section 3.1 (Principles relating to processing of personal data): The paper discusses the data minimization principle as a cornerstone of the GDPR, emphasizing that controllers must justify the extent of data collection in relation to a specific, legitimate purpose. The scenario clearly shows a failure to limit collection to what is necessary. (Available via SSRN and other academic databases).