In January this year, the European Data Protection Board (EDPB) issued Guidelines 3/2019 on processing of personal data through video devices, which shall assist the video surveillance systems operators to comply with the rules contained in the General Data Protection Regulation (GDPR) using the devices for optical or audio-visual monitoring. The Guidelines emphasise transparency, information of the data subject and assessment of justification and necessity for the use of a camera system for their surveillance.
In order to comply with this information requirement, so called „multi-layered approach” shall be applied. The warning sign positioned in a clearly visible place before the entrance of the data subject into the monitored area shall be recommended as the first layer („first layer“). In addition to the clearly readable picture (image of a camera), the warning sign should convey the most important information, including the purposes of processing, identity of the controller or the existence of the rights of the data subject and, furthermore, reference to the more detailed second layer („second layer“) e.g. in the form of a QR code or a web address or information on where the more detailed information can be obtained beside the electronic media (i.e. for instance in the form of a paper leaflet).
In assessing the justification and necessity of processing of personal data through video devices, it will be necessary to demonstrate that the video surveillance system operator has conducted so called proportionality test, within which the interests and rights of the data subjects were weighted against legitimate interests of the controller. In practise, the legitimate interest (e.g. for protection of property) and performance of a task carried out in the public interest will be the most frequently claimed reasons for data processing. The Guidelines set out that the consent of the data subject shall not be applied often while processing data in this way, namely with respect to the character of the technology and the fact that the consent may not be used in the relationships of superiority and subordination (typically employer – employee). Linked to the above is also the requirement on data minimisation and the obligation to use less invasive devices, such as fencing the property or installing security locks for the protection of property.
Limitation of the storage period for video footage can be regarded as the essential message of the Guidelines. As it was until now, the records can be maintained for a maximum period necessary for fulfilment of an individually defined purpose of processing. Nevertheless, compared to the former interpretation of the Czech courts and administrative bodies according to which it was possible to maintain the footage as a rule for up to 14 days, the Guidelines reduce this period to the maximum of 72 hours, since for example the damage suffered to the assets can be identified by the operator of the surveillance system much earlier in most of the cases. Any longer period for storage of a video footage is be possible only in case of a detailed justification. Disclosure of the video footage to third parties (typically the police) is possible only in case of a legitimate reason for such a disclosure.
In addition to the above, the Guidelines 3/2019 regulate also other areas and recommendations, such as special data categories or specific rights of the data subject.
The European Data Protection Board, as the author of the Guidelines, contributes to the consistent application of the data protection rules throughout the European Union, so it can be expected, that in the future, controls of the Czech national Office for Personal Data Protection focused on operation of surveillance systems shall be based precisely on these Guidelines 3/2019.