Video surveillance has always been a sensitive topic in the area of data protection. It is even more so when video surveillance devices are used not (only) for the usual security purposes, but for less expected and common purposes such as marketing or employee performance monitoring. When concerning these matters, the lawfulness of surveillance and questions regarding it gets even trickier.
Accordingly, to address some of these matters, recently the European Data Protection Board (EDPB) (that consists of the representatives of national data protection authorities and the European Data Protection Supervisor) adopted Guidelines 3/2019 on the processing of personal data through video devices. These guidelines cover both – traditional video devices and smart video devices.
Among other topics, a newly adopted document also covers the lawfulness of processing, the applicability of the household exemption and the disclosure of footage to third parties. Some important provisions, showing the general position of EDPB, are provided below.
- Lawfulness. Video surveillance is lawful if it is necessary in order to meet the purpose of a legitimate interest. However, such legitimate interest needs to be of real existence and has to be a present issue (i. e. it must not be fictional or speculative).
- Balance of interests. With respect to data protection principles, video surveillance measures should only be chosen if the purpose of the processing could not reasonably be fulfilled by other, less intrusive means. Data subjects’ reasonable expectations always must be taken into account.
- Consent. Entering a marked monitored area does not constitute a statement or a clear affirmative action needed for consent. Given the imbalance of power between employers and employees, in most cases, employers should not rely on consent when processing personal data.
- Storage. The personal data should in most cases (e. g. for the purpose of detecting vandalism) be erased, ideally automatically, after a few days. The longer the storage period is set (especially when beyond 72 hours), the riskier data protection is, the more argumentation for the legitimacy of the purpose and the necessity of storage has to be provided.
- Biometric data. The video footage of an individual cannot in itself be considered as biometric data if it has not been specifically technically processed in order to contribute to the identification of an individual.
- Household exemption. The so-called household exemption must be construed narrowly. If video devices are (at least partially) directed at public space, it cannot be regarded as an activity, which is purely ‘personal or household’.
New video surveillance guidelines, that are designed to clarify how the GDPR applies to the processing of personal data when using video devices, will be subject to public consultation until 9 September 2019. Now the EDPB is waiting for the comments from data protection lawyers or other data protection specialists, data controllers, data subjects or other individuals.
The version for public consultation is here.