The European Data Protection Board (EDPB) has issued final guidance for using video surveillance under GDPR. Hear are some high-level takeaways:

  • You must have a legal basis.
  • Legitimate interest could work, BUT…
  • You have to balance carefully, and putting up a sign may not be enough.
  • You have to be transparent about what you do.
  • You must respond to data subject requests, even if it’s not easy to do so.

For a deep dive, read my detailed analysis.