EU: Legal basis for CCTV monitoring
Irrespective of its scope, whether for security or simply domestic usage, continuous monitoring through CCTV cameras is a case of data processing and an aggressive one. Therefore, all the prerequisite conditions according to the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') should be checked. Ana-Maria Udriște, Founder of Avocatoo.ro, provides details about the conditions of CCTV surveillance and what companies need to consider when using CCTV.
What legal basis should we chose for CCTV surveillance?
The European Court of Justice has stated that, in order to legally process data through CCTV cameras, a legal basis for data processing must exist, which is also called the legality principle under the GDPR. You cannot process any kind of data unless you have legal grounds to do so.
There are six legal bases for data processing according to Article 6 of the GDPR, such as the data subject's consent and an organisation's legitimate interests.
Therefore, if you want to install CCTV cameras for continuous monitoring, you can use legitimate interests as the legal basis for such monitoring.
What conditions should be met in order to have a legal CCTV surveillance?
Choosing the proper legal basis can feel like looking for a needle in a haystack, as there can be more than one legal basis for a type of processing. However, with respect to CCTV monitoring, legitimate interests is one of the best options.
If you plan to choose legitimate interests as your legal basis for video data processing, three conditions should be cumulatively met:
- a legitimate interest of the data controller / third party should exist;
- the controller must first establish the legitimate interest before processing personal data; and
- the fundamental rights and liberties of the affected data subjects must not override the legitimate interests pursued.
Therefore, solely mentioning in a privacy notice that you use legitimate interests as legal grounds for video processing is not enough. A thorough internal analysis should be conducted for the organisation to clearly identify if this is the best legal basis or if something else should be taken into consideration.
What key elements should we consider when choosing legitimate interests as a legal basis for CCTV monitoring?
When focusing on the analysis for legitimate interests, you should take time to answer the following questions:
- Why do we want to install CCTV monitoring?
- What is the area covered by CCTV monitoring? Does it include public spaces, such as streets or public parking?
- What are we looking to achieve through this operation?
- Are there are alternative methods that can help us achieve the same objective? If so, what are their advantages and disadvantages?
- Have we tried to implement other alternative measures before we decided to look into CCTV surveillance? What was the result?
- What is the risk for the data subjects who will be monitored? Can we minimise it?
- Have we clearly identified where we are going to install the CCTV cameras and why? What is the perimeter?
- What kind of data are CCTV cameras processing, such as people's faces and vehicle's plate numbers?
- Who has access to the video and how?
- Does the company that will install the CCTV cameras have all the necessary authorisations?
- How long are we going to keep the recorded data?
- How are we going to provide access to the data subject in case of a data subject access request and do we have the appropriate technical methods to blur other processed data?
Even though it is thought by many that consent is the first legal basis that controllers should turn to, in many situations consent will not be an appropriate basis for data processing, and companies should research other legal grounds.
However, irrespective of the legal basis chosen, organisations should clearly define the categories of data they are processing, who the affected data subjects are, and the risk to their rights and freedoms, as well as conducting a thorough analysis that will sustain that choice.
Ana-Maria Udriște Founder