Video surveillance and GDPR - a balance between security and privacy

From public places to private sites and residential buildings, the presence of surveillance cameras aims to deter crime and ensure safety. However, with video surveillance becoming more common, privacy and data protection concerns are coming to the fore.

The most widely used ground for the processing of personal data through video surveillance is the so-called "legitimate interest" of the controller. In cases where video surveillance is deemed necessary to protect the legitimate interests of the controller (most often the protection of property), this is only allowed if the interests and fundamental rights of those filmed do not prevail. However, referring to the legitimate interest is not sufficient - a balance between these interests must always be struck and this should be set out in an appropriate document for each specific case of processing.

For example, a restaurant manager decides to install video cameras in the restrooms to monitor cleanliness and hygiene. In this case, obviously the rights of the data subjects prevail and it would be unacceptable to install video cameras inside.

It avoids requesting consent from those being filmed, as the nature of the surveillance implies the coverage of an indefinite number of people and the data controller would be hardly able to prove that the data subject has given his prior consent.

Alongside the issues of the basis of processing, issues of awareness of data subjects also arise in practice. This issue is often underestimated and ignored, but the Data Protection Commission does not fail to address this point when dealing with alerts and complaints.

In view of the amount of information to be provided to the data subject, controllers may apply a layered approach to ensure transparency. In the case of video surveillance, the most important information should be displayed on the warning sign (first level), while additional mandatory data can be provided in other ways (second level).

It is a misconception that only an image signalling the surveillance being carried out is sufficient. According to the guidelines of the European authorities, the information from the warning sign must show the most important things, such as the purpose of the processing, the identity of the controller and the existence of the rights of those filmed. In addition, it should also refer to the more detailed second-level information and indicate where it can be found. The detailed information is most often found in the controller's internal policies relating to video surveillance.

The video surveillance case studies can be varied and the above is by no means exhaustive. KGK's team has many years of experience in the field of personal data protection and is ready to assist you in case you need advice on the matter, as well as in preparing the necessary documentation.