The European Data Protection Board has issued guidance on the use of video surveillance.
Key takeaways:
  • The monitoring purposes of cameras should be documented in writing.
  • Data subjects must be informed of the purpose(s) of the processing: “safety” or “for your safety” is not sufficient
  • The most likely legal bases for video surveillance are: legitimate interest and “necessary in the public interest.”
  • Data subjects’ consent can only serve as a legal basis in exceptional cases.
  • When blurring the picture with no retroactive ability to recover the personal data the picture previously contained, the personal data are considered erased in accordance with GDPR.
  • The notice under Article 13 should be provided in a layered manner – first layer (warning sign) and second layer (other location).
  • Controller should implement technical measures to fulfill an access request without revealing the identities of other people (e.g. image-editing such as masking or scrambling).
  • If the video footage is not searchable, data subject should in its request, specify when, within a reasonable time frame, he or she entered the monitored area.