In today's world, video surveillance has become ubiquitous to the point that most people hardly even notice the presence of cameras and in some instances even expect cameras to be in place. Such an attitude towards the use of cameras belies how commonplace they have become and how accustomed we have grown to being constantly under surveillance. Acknowledging this reality, the European Data Protection Board ('EDPB'), which was established just over a year ago with the introduction of the General Data Protection Regulation ('GDPR'), has recently made available for public consultation its Guidelines on the processing of personal data through video devices ('the Guidelines'), which includes not just CCTV, but also dashcams, private security cameras and mobile phone cameras.
These Guidelines shed light on how video surveillance may be made use of and under what parameters, especially in light of the new GDPR paradigm. First and foremost, it is vital to note that these Guidelines only concern video surveillance wherein personal data, as understood by the GDPR, are actually being processed. Therefore, the surveillance must include information that relates to an identified or identifiable natural person (i.e. a 'data subject'), such as footage of a person's face, name tag, or other distinguishing characteristics that render them identifiable (e.g. unique tattoos or birthmarks). Personal data, in any but especially in this context, would also include car license plates, identification documents and most notably, biometric data. On the other hand, footage lacking any such personal data (e.g. research cameras that solely monitor wildlife creatures, the night sky or microscopic organisms) would fall outside the scope of the GDPR and consequently, of these Guidelines.
The departure point for setting up any kind of video surveillance system should always be an assessment of whether such a system is needed in the first place. The Guidelines suggest considering alternatives wherever possible, depending of course, on the purpose in question. If the camera is going to be installed for security purposes, the data controller, i.e. the person who will be responsible for the video footage that would be collected, should consider what other measures may be implemented instead of a camera system, which measures would be less intrusive on individuals' rights to privacy and data protection. For instance, one should consider whether reinforced walls and glass, better locks, better lighting or hiring security guards would have the same effect.
Furthermore, any installed cameras should only record those areas that need to be surveilled. The typical example provided by the EDPB is that of a shop with a camera installed outside to monitor the entrance to the shop and/or the shop windows, to protect against theft and vandalism. Wherever possible, those cameras should not also monitor the pavement or the road outside, since that would mean that personal data of persons who simply pass by and never even enter the shop are being processed, which would exceed the purpose of installing such cameras i.e. security. Hence, the principle of data minimization – only collecting that data which is strictly necessary - as enshrined by the GDPR, plays a key role in video surveillance.
Another consideration should be whether the persons that will be recorded as a result of the installation of the video surveillance system, would reasonably expect to be recorded in that particular instance. For instance, the Guidelines opine that at the workplace, an employee would in most cases not likely expect to be monitored by their employer, whilst a visitor at a bank or at a jewellery store would be more likely to expect that they would be monitored due to the increased need for security. This is not to say that video surveillance cannot take place when an individual does not always expect it, but there must be even greater transparency and information provided to the recorded data subject in those instances where they are less likely to expect such recording.
To view the full article please click here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.