Video surveillance and data protection

A legal basis pursuant to Art. 6 (1) GDPR is required for the processing of personal data, and this also applies to video surveillance. Because as soon as a person can be seen on the video recordings, it is personal data. In principle, video surveillance can be based on the legitimate interest of the controller pursuant to Art. 6 (1) (f) GDPR. As soon as a processing operation is based on the legitimate interest of the controller, a detailed weighing of interests is required. Furthermore, a case-by-case reasoning for which purpose the video surveillance is used is necessary. The documentation must clearly show that the responsible party’s legitimate interest in video surveillance is higher than that of the data subject. Only then may the video surveillance be installed.

We would like to point out that it may be necessary to conduct a Data Protection Impact Assessment in accordance with Art. 35 of the GDPR. Whether a DPIA must be carried out will be assessed on a case-by-case basis based on the scope of the video surveillance as well as the monitored areas and the data subjects. According to Art. 35 of the GDPR, a DPIA must be carried out if a form of processing, in particular where new technologies are used, is likely to result in a high risk to the rights and freedoms of natural persons by virtue of the nature, scope, context and purposes of the processing.

Surveillance of the company premises is generally possible if there are justified reasons for video surveillance. An example of this is the protection of the company premises against break-ins, theft or vandalism. However, it is imperative to ensure that no public areas are included in the recording area. If the cameras record public areas due to the setting, these must be made unrecognizable, e.g. by pixelating the public area.

Furthermore, it should be noted that monitoring of areas used by employees for relaxation or breaks may not take place. This is because the interests of the persons concerned prevail here. If the employee knows that video surveillance is taking place in such areas, he or she cannot behave freely and is thus protected in his or her general right of personality pursuant to Art. 2 (1) in conjunction with Art. 1 (1) GG. Art. 1 para. 1 GG is restricted.

But what about video surveillance in the workplace? We are often asked this question in our daily work as external data protection officers, and we are happy to comment on it. In principle, the employer has the right to check whether his employees fulfill all their contractual obligations. However, there are limits to this control. The use of video surveillance to monitor employees is generally not permitted. Only in very rare exceptional cases can video surveillance of employees be permissible by way of exception. There are milder means of monitoring performance, such as personal, random checks, which should be used as a matter of priority. In addition, the rights of the person concerned also prevail in this case.

In the opinion of the supervisory authorities, video surveillance data storage is permitted for a maximum of 72 hours. However, this cannot be applied across the board to all cameras. In order to determine the exact storage period, it is necessary to examine each video camera and its purpose. The respective storage period must be justified in order to achieve the purpose.

According to Art. 12, 13 GDPR, data subjects must be informed about data processing and their rights under the GDPR. We will explain how this obligation to inform can be met in Part 2 on the topic of video surveillance and data protection.

 

We will be happy to help you implement video surveillance in your company in compliance with data protection regulations, as well as answer any questions you may have about data protection. Simply call us at our headquarters in Hutthurm at +49 (0) 8505 91927 – 0 or at our branch office in Munich at +49 (0) 89 413 2943 – 0 or use our contact form.