The European Data Protection Board has issued guidance on the use of video surveillance.
- The monitoring purposes of cameras should be documented in writing.
- Data subjects must be informed of the purpose(s) of the processing: “safety” or “for your safety” is not sufficient
- The most likely legal bases for video surveillance are: legitimate interest and “necessary in the public interest.”
- Data subjects’ consent can only serve as a legal basis in exceptional cases.
- When blurring the picture with no retroactive ability to recover the personal data the picture previously contained, the personal data are considered erased in accordance with GDPR.
- The notice under Article 13 should be provided in a layered manner – first layer (warning sign) and second layer (other location).
- Controller should implement technical measures to fulfill an access request without revealing the identities of other people (e.g. image-editing such as masking or scrambling).
- If the video footage is not searchable, data subject should in its request, specify when, within a reasonable time frame, he or she entered the monitored area.