The use of video surveillance by data controllers, particularly in workplaces or other public facilities such as shops and restaurants, is common and, when used appropriately, can bring numerous benefits to businesses. However, it's important to remember that its installation and formal implementation must comply with specific rules and legal regulations.
What can be processed as part of monitoring?
When using monitoring, the Administrator is obligated to process only video, i.e., images captured by cameras. Voice recording is not permitted. Furthermore, the quality of the monitoring should allow for the appropriate recording of images, facial images, and body shapes (recording of standard data). If the monitoring were used for automatic facial recognition, and thus for access control to premises, this activity would constitute biometric data processing.
Legal basis for data processing
It's important to remember that the use of monitoring must be based on a specific legal basis. The applicable legal basis is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the controller in protecting people and property, as well as ensuring the security of personal data and legally protected secrets in the monitored area.
Each time data is processed, a balancing test must be carried out on this basis, which:
- identifies the legitimate interest of the controller in carrying out a given processing activity;
- demonstrates the necessity of data processing to achieve the purpose in question;
- will help to weigh the interests, i.e. to examine whether the controller's interest in data processing is more important than the interest of the person recorded in the recording.
Information obligation
Placing surveillance in a workplace or other space also involves fulfilling the information obligation arising from Article 13 of the GDPR, which obliges the controller to provide information, among other things, about the controller's identity, the purposes and legal basis of processing, the rights, etc. Additionally, there is an obligation to appropriately graphically mark the monitored space.
Furthermore, video surveillance should be placed in a way that does not violate employee privacy, i.e., it cannot be located in bathrooms, locker rooms, kitchens, or other sanitary areas not directly related to work. It should also not be used to measure work time.
Video surveillance data should be processed for a maximum period of three months, after which it should be deleted or overwritten with new recordings. If the surveillance footage constitutes evidence in a case or may constitute such evidence, the recordings should be retained until the final conclusion of the proceedings.
This article is for informational purposes only and does not constitute legal advice.
Legal status as of September 25, 2024
author:
