On 9 and 10 July 2019 the European Data Protection Board (EDPB) adopted new guidelines on video surveillance.
The document analyzes the impact of the use of video devices on the behavior of citizens within the European Union, and the consequences of the resulting data processing on these individuals. The analysis deals with the use of both traditional and “intelligent” video devices.
The use of increasingly advanced technologies can interfere with freedom of movement and with the individual’s choices, based on whether or not they would be monitored by the devices. However, citizens can also appreciate the use of video surveillance for security purposes, since in these cases the benefit of protection might be greater than the resulting “loss of confidentiality”.
A problem arises when operators “associate” video surveillance for security purposes with other purposes, possibly less pleasing to the person concerned, such as marketing or the analysis of work performance. In these cases, the surveillance can be developed as “intelligence systems” that pool large amounts of data, with increased risks of misuse.
Therefore, the European Board reiterates that the principles applicable to the processing of personal data, as set out in Article 5 of the General Data Protection Regulation (GDPR), always apply when using video devices. In addition, video surveillance should be a “reserve measure”, to be used only when the same purpose cannot be achieved in a less intrusive manner.
The Guidelines spell out important points on video surveillance, with real consequences in daily life.
First, the document describes two exceptions to the application of the GDPR.
The first is regulated by article 2.2 letter c) of the GDPR, when the data processing is carried out by a natural person for the exercise of exclusively personal or domestic activities.
The second, where the processing is carried out by the competent authorities for purposes of prevention, investigation, detection or prosecution of crimes, and for the implementation of criminal penalties, as these fall within the scope of application of European Directive 2016/680.
Another interesting area concerns the EDPB analysis of “legitimate interest” and “consent of the data subject” as legal bases for legitimizing the data processing.
In case of video surveillance for legitimate interests, the Guidelines call for more attention to the “balance of interests” in specific cases.
Indeed, legitimate interests would exist when there are situations of real danger, such as previous occurrences of thefts or serious incidents, and only when the same purpose cannot be achieved by other means.
The Board considers the subject’s consent to the processing of personal data to present a kind of “residual” legal basis, which gives rise to many critical issues at both the collection stage and in relation to certain subjects, such as employees, who are unlikely to give their free consent.
The Guidelines also place strong emphasis on the GDPR transparency and information requirements, confirming once again the application of this approach at multiple levels.
The first level consists of a visible warning, i.e. a sign depicting a video surveillance symbol and showing the identity of the data controller, their representative (article 27 GDPR), the contact details of the data processing officer, the purposes of the processing, the legal bases and a reference to the subject’s rights. The guidance of the Board is that the sign should be placed at a reasonable distance in relation to the range of the video camera.
The second level consists of the controller providing complete information on processing, as required by article 13 of the GDPR, in a place easily accessible by the person concerned and not in the area subject to video surveillance.
With regard to the retention of data, the guidelines confirm that these cannot be held for longer than necessary for the purposes for which they were collected. In the case of video surveillance, the period is one or two days. In case of periods longer than 72 hours, the data controller must provide reasons to support the legitimacy of the data retention.
In short, the Board confirms all the precautions already provided for in the previous measures, and if anything, places even more emphasis on the need for attention to video-surveillance systems, which are in general highly invasive and therefore must be adopted with extreme caution.