The Irish Data Protection Commission has issued guidance on CCTV and GDPR.
Key takeaways:
- Put in place clear signs to advise people that CCTV recording is taking place, and to outline the purposes for it.
- The signs should also provide the contact details of the relevant data controller or their agent.
- CCTV footage may be recorded based on a business’s legitimate interest to protect their premises and property from crime or damage, or to ensure the health and safety of staff members and the public.
- If relying on legitimate interest the data controller must explain to you how they have justified this based on necessity and proportionality.
- CCTV should not be employed in areas where employees spend their free time unless it can be justified, for example, based on a need to monitor safety and security. Use of CCTV in break rooms, changing rooms, and bathroom areas is difficult to justify.
- If you are aware that your image or recorded footage has been published on a social media platform online, you can request that the social media platform used remove it.