PROCESSING SITUATIONS

Camera surveillance

When you use surveillance cameras to safeguard your buildings and/or company, you must also take the GDPR into account, besides any national provisions that may apply to different situations in which you can use surveillance cameras.

By filming locations where people may pass by, you are gathering personal information such as their images and their behaviour. If smart cameras are used that allow, for example, facial recognition or license plate recognition, sensitive information such as biometric information is also processed.

Check national law

Note that the use of (surveillance) cameras will first and foremost be governed by national law.

Your national law may prohibit the use of specific or all cameras in all or some circumstance (for example when continuously filming public places), may impose specific requirements (for example in an employment context), may require that the used surveillance cameras are notified to and/or registered with the government, may require that the police has access to the images upon simple demand, may require that a specific pictogram is displayed to inform persons who may be filmed, etc.

From a GDPR point-of-view the following specific requirements apply

The public/employees must be informed/notified of the video surveillance in a clear and effective way.
Obligations to employees must be fulfilled (e.g. information provided, and provisions included in the company's privacy policy and work rules).
The company must comply with certain obligations relating to the processing, access to and storage of the images
The company must make sure to add this processing in its record of processing activities and in its (public) privacy policy.

Informing/notifying the public

Most countries require the use of a specific pictogram at the entrance of a place where camera surveillance is organized.

For example, in Belgium, the following pictogram must be placed, on which specific information must be mentioned:

In general, the pictogram will have specific requirements with regard to the size, the material, the visibility, the information mentioned on the pictogram, etc.

From a GDPR point of view, any such notification must make it sufficiently clear to the persons being filmed:

Who is responsible for the surveillance camera?
The website where the applicable privacy policy (with more information about the video surveillance) can be consulted.

Obligations to employees

When employees may be filmed, specific requirements under national law will most likely apply, which may impose specific limitations and requirements, specific information obligations towards employees and specific procedures to be followed before the surveillance cameras can be used.
This information must also be included in the company's employee privacy policy.

Obligations relating to the processing, access to and storage of images

Depending on your national legislation, specific obligations may apply, such as:

Surveillance cameras directed at an entrance door must be oriented in such a way that the (indirect) recording of public space is kept to a strict minimum.
Real-time viewing of the images of surveillance cameras is only allowed to be able to establish criminal acts at the time of the act. It is also allowed to show a publicly visible screen, on which the recorded images can be viewed in real time.
Images may be recorded only to gather evidence of a nuisance, criminal behaviour or acts that cause damage and to identify the perpetrators of such acts, the witnesses thereto or the victims thereof.
Footage may be stored for a maximum period of one month, unless it is established that it contains images related to a crime.
Persons may only be filmed after the required notification has been made and the pictograms affixed. Entering a room where a clearly visible pictogram is displayed is considered implied consent to be filmed.
The right to access and search the recorded images must be limited and a record kept of these actions.
Persons who have access to the images must be bound by a duty of confidentiality and discretion.
Images may not be recorded that violate the right to privacy of individuals or for the purpose of gathering information about philosophical, religious or political convictions, trade union membership, ethnic or socio-economic background, sexual orientation or the health of individuals.
All persons filmed have the right to view the video footage in which they appear, provided they can provide enough details in order to locate the images in question.
Etc.

In addition to such specific obligations, the obligations laid down in the privacy legislation and the GDPR also apply, considering the sensitive nature of video surveillance.

A record

Pursuant to the GDPR, a record of processing activities must be kept for the processing of personal data, including video surveillance.
National law may require that an additional record is established, in which specific information about the video surveillance is registered, for example:
- an indication of the type of place that is under surveillance;
- a technical description of the surveillance cameras as well as, for fixed cameras, their location, where applicable indicated on a map;
- for temporary or mobile surveillance cameras, a description of the areas under surveillance by the cameras and the time periods during which the cameras are in use;
- the means of providing information about the processing;
- the place where the images are processed; and
- whether viewing in real time is organised or not and, where applicable, the way it is organised.

Criminal sanctions

National legislation may impose criminal sanctions on the infringement of the video surveillance legislation.

Time for action

Verify if your surveillance cameras comply with national law, if all the required policies and notifications are in place and if the persons concerned have been duly informed.