This article wraps up what we wrote last week.
Smile, you are being watched!
The controller should assess whether a data subject entering the surveillance area can easily spot the security camera. Its location doesn’t need to be disclosed if it’s clear which areas are being observed. The placement of security cameras should be chosen carefully to ensure the scope of surveillance doesn’t go beyond the actual necessity. The controller should put up an information sign that gives Level 1 and Level 2 information described below.
It’s also important to determine the angle and the area the security camera will cover. If this includes some public space or another person’s private property, the controller should take all possible steps to minimise the target area.
Level 1 information
This is the most important piece of information to be placed on the information sign. This information may be placed visually to notify the data subject in a way that’s easy to understand. The Level 1 information should also refer to Level 2 information.
The minimum Level 1 information includes the following details:
- The controller’s name
- The controller’s contact details
- The purpose of data processing
- A statement of ways to obtain more information prescribed by GDPR article 131
Level 2 information
These are details of video surveillance that must be given in addition. This information should be provided in a place the data subject can easily access, in the form of a completed information sheet or a conspicuous poster, for example. Additional details may also be given on the website or with a QR code, making it easily accessible to the data subject.
How long footage may be retained and the right to have your data deleted
The law is silent on how long security camera footage may be retained, yet personal data must not be retained longer than the required purpose. The controller should determine the retention period so that this data processing follows the principle of data minimisation. The controller should evaluate how long security camera footage is retained depending on whether the risk is low or high. For example, a couple of days will be enough to discover a crime in a small shop. However, discovering such a crime in a large warehouse may take more than a couple of days.
A data subject has the right to object to video surveillance at any time if he has been subject to it. The controller must reply to such a request within a month and stop recording unless there is a legitimate interest that’s more important than the data subject’s rights. The data subject has the right to access any security camera footage that’s still retained and file a complaint with the National Data Office if such retention is unlawful. Yet the controller has the right to refuse a request that’s unreasonable or excessive.
Key takeaways
- Reconsider the need for video surveillance if it’s possible to install alternatives.
- Setting up an information sign requires you to notify the data subject of video surveillance.
- Choose the location of video surveillance carefully.
- Make sure that technical measures are adopted.
- The data subject has the right to object to video surveillance.
- Security camera footage must not be retained longer than is necessary.
____________________
