The National Data Office has stated that installing video surveillance devices in the workplace with audio recording is unlawful unless the law expressly permits their use. This article explores video surveillance in the light of the General Data Protection Regulation (GDPR).1
The legal basis for data processing
As today’s dynamic environment sees technologies developing very fast, new devices are being marketed featuring high-resolution video recording, sound quality, and indefinite storage of recordings made during video surveillance.
However, before buying such devices, the employer should check for any obligations and prohibitions to be considered before starting video surveillance. Video surveillance should be done lawfully and according to predetermined goals the employer plans to achieve. A special effort should be made to check that video surveillance is balanced with workers’ right to privacy. Putting up signs to inform the workers of video surveillance is not sufficient to consider the employer compliant with statutory requirements.
The most common legal basis for processing video surveillance data is the employer’s legitimate interests under GDPR article 6(1)(f) but the employer should do a balancing test for this processing.
The employer can also have some other lawful basis prescribed by GDPR article 6, such as obtaining the data subject’s consent to video surveillance. For example, data subjects are considered to give consent when they enter the employer’s premises where video surveillance is done, as long as the employer has put up an appropriate notice (sign, poster etc). It will be assumed that the data subject is aware of video surveillance on the employer’s premises and has consented to such data processing.
We recommend describing the lawful basis for processing video surveillance data in the company’s internal policies or online privacy information.
The purpose of video surveillance
Video surveillance is permitted if it helps to protect human life, health and property and to identify any trespassers or wrongdoers.
Companies are not permitted to use recordings made by their video surveillance devices for any other purpose, e.g. to monitor the quantity or quality of work done by workers, unless the employer has given an advance warning and the data subject (worker, customer etc) is aware of the purpose of such data processing.
In practice we often see employers doing video surveillance to monitor the process and quality of work done by workers. Such video surveillance is unlawful because it is likely to affect the person’s right to privacy. A careful assessment should be done to ensure such data processing has a lawful basis.
For example, in June 2019 the French Data Office imposed a fine of 20,000 euros on a small company employing a staff of nine for video surveillance done in a room accommodating six office workers.
2
With Europe moving towards a single approach to penalties, when it comes to evaluating data protection offences committed by Latvian companies, the National Data Office will consider EU regulators’ approach to imposing fines.
A balancing test
If a company is processing personal data based on legitimate interests, for example, a video surveillance device is counting vehicles that enter a parking lot, or video surveillance is done in the workplace, then a balancing test should be done for each party to this processing.
If the company has not done a balancing test, there is a risk the company has failed to consider and balance the rights of data subjects with other basic rights according to the principle of proportionality laid down by the GDPR. A review by the National Data Office may find the company in breach of GDPR article 6(1)(f) and impose a fine.
A balancing test basically requires you to establish that data processing is done with due regard to data minimisation or proportionality, and that a data subject’s rights override the interests of the company or any third party.
We recommend drawing up your internal policies and procedures for balancing tests with forms to be completed for any data processing based on your legitimate interests. This will result in personal data being processed to achieve the necessary purpose, with adequate safeguards in place for a review by the National Data Office.
We recommend that data protection experts be involved in developing and running your balancing test procedures.
(to be completed next week)