The Irish Data Protection Commission has issued guidance on CCTV and GDPR.

Key takeaways:

  • Put in place clear signs to advise people that CCTV recording is taking place, and to outline the purposes for it.
  • The signs should also provide the contact details of the relevant data controller or their agent.
  • CCTV footage may be recorded based on a business’s legitimate interest to protect their premises and property from crime or damage, or to ensure the health and safety of staff members and the public.
  • If relying on legitimate interest the data controller must explain to you how they have justified this based on necessity and proportionality.
  • CCTV should not be employed in areas where employees spend their free time unless it can be justified, for example, based on a need to monitor safety and security. Use of CCTV in break rooms, changing rooms, and bathroom areas is difficult to justify.
  • If you are aware that your image or recorded footage has been published on a social media platform online, you can request that the social media platform used remove it.

Read the full guidance.