The European Data Protection Board (EDPB) has issued final guidance for using video surveillance under GDPR. Hear are some high-level takeaways:
- You must have a legal basis.
- Legitimate interest could work, BUT…
- You have to balance carefully, and putting up a sign may not be enough.
- You have to be transparent about what you do.
- You must respond to data subject requests, even if it’s not easy to do so.