When The Household Exemption Stops Applying
A camera above a front door records the doorstep, the path and two metres of pavement. The person who fitted it was thinking about parcel theft. Data protection law was not on the list. It applies anyway, and the household exemption is where that argument begins.
Domestic camera disputes turn on the same short provision.
What the household exemption actually says
The GDPR does not apply to processing “by a natural person in the course of a purely personal or household activity”. That is the whole of Article 2(2)(c). Recital 18 supplies the second half of the test. The activity must have “no connection to a professional or commercial activity”, and the recital offers correspondence, address books and social networking as examples.
Two words carry the weight of the household exemption. The first is “purely”. The second is “activity”, because the exemption attaches to what someone is doing. It does not attach to where they happen to be standing.
Recital 18 then closes with a warning candidates skip. The household exemption covers the individual. It leaves out the company supplying the camera, the cloud storage and the app. Those providers stay controllers or processors in their own right.
Rynes narrowed it, and the narrowing stuck
The leading authority is Case C-212/13 Rynes, decided on 11 December 2014. Mr Rynes fitted a camera to his family home after repeated attacks on the property. It recorded the entrance, the public footpath and the door of the house opposite.
What the Court held
The Court ruled that his set-up fell outside the exemption. Continuous recording installed on a family home to protect property, health and life, “but which also monitors a public space”, is not a purely personal or household activity. Protecting the home counted as a genuine motive. The motive did not rescue the household exemption.
Paragraph 29 is the sentence worth memorising. The exception “must be narrowly construed”. At paragraph 30 the Court pressed on the adverb. An activity has to be purely personal or household, not merely personal or household.
Losing the household exemption is not the end of the road
Paragraph 34 matters as much as the finding. Failing the household exemption does not make a camera unlawful. Mr Rynes could still rely on legitimate interests, including the protection of property, health and life. He simply had to do it as a controller, carrying the duties that follow.
Two further cases fill in the shape. Lindqvist, from 6 November 2003, concerned personal data published on a website. Access by “an indefinite number of people” put it outside private and family life. Buivids, from 14 February 2019, applied that reasoning to a video of police officers uploaded without access restrictions. Both concerned the predecessor directive, whose wording on the household exemption Article 2(2)(c) reproduces in substance.
The most recent addition came on 11 July 2024. In Case C-461/22 the Court held that a former guardian acting professionally cannot claim the household exemption. His place inside the person’s personal circle made no difference. That is Recital 18’s professional connection limb, tested head on.
Where the regulators draw the line
The EDPB landed in the same place in its Guidelines 3/2019 on video devices, version 2.0, adopted in January 2020. Section 2.3 repeats the narrow reading. Surveillance covering a public space, “even partially”, cannot be a purely personal or household activity.
The Guidelines beat the case law on ordinary situations, because they work through examples. A fenced private garden stays inside the household exemption where only family regularly enters. The coverage must not extend even partially to a public space or a neighbour’s property. Holiday footage shown to friends also stays inside it.
Nothing here is a single-factor test. The Guidelines ask for an overall assessment of the household exemption. Weigh the relationship with the people filmed. Then take in the scale and frequency of the recording, and the possible adverse effect on those captured.
The ICO’s guidance on home CCTV treats fixed cameras and smart doorbells together. Its position is blunt. Where the system captures someone else’s property, a public area or a communal space, the household exemption is gone and data protection law applies. The page then lists what the householder owes: a clear reason for recording, no more capture than is needed, a sign, footage supplied on request, and deletion on a schedule.
How CIPP/E tests the household exemption
Exam items on this subject rarely ask you to recite Article 2(2). They describe a situation and ask whether the Regulation reaches it. That is a material scope question wearing a domestic disguise.
The reliable move is to find the moment the activity leaves the private setting. A camera pointed at your own hallway is one thing. The same camera angled ten degrees down the street is another. Nothing else in the scenario has changed, and the answer has.
Watch for the second trap too. Candidates who correctly spot that the household exemption has failed then reach for “so the recording is unlawful”. Wrong turn. The consequence is that the GDPR applies, which pulls in the lawful basis analysis and every downstream duty, including the rights of the people captured. Scope questions of this kind sit next to the territorial scope tests in the same domain. If the neighbour later asks for the footage to be parked rather than deleted, you are into restriction of processing.
The Body of Knowledge is the IAPP’s published map of what each exam covers. The household exemption sits in the domain on the Regulation’s scope, and that domain rewards precision about boundaries rather than breadth.
Boundary questions are easy to misread and expensive to get wrong. The free CIPP/E assessment takes about fifteen minutes and shows you where the gaps sit. Where scope questions keep sliding away, the problem is usually reading rather than knowledge, and that is what the CIPP/E Exam Question Masterclass drills.
