Privacy & Information Security Law Blog

The European Data Protection Board (the “EDPB”) recently adopted its Guidelines 3/2019 on processing of personal data through video devices (the “Guidelines”). Although the Guidelines provide examples of data processing for video surveillance, these examples are not exhaustive. The Guidelines aim to provide guidance on how to apply the EU General Data Protection Regulation (“GDPR”) in all potential areas of video device use.

Key takeaways of the Guidelines include:

• Scope of Application: Use of video devices may trigger the application of the GDPR only if:
  • Personal data is collected through the video device (i.e., an individual can be identified directly or indirectly);
  • The processing is not carried out by EU competent authorities for the purposes of prevention, detection or prosecution of criminal offenses or the execution of criminal penalties (otherwise, the processing would fall within the scope of the EU Law Enforcement Directive (Directive (EU)2016/680)); and
  • The processing is also not carried out in the course of a purely personal or household activity. Should the processing be carried in the course of such activity, the so-called household exemption would apply. This exemption must, however, be narrowly interpreted in the context of video surveillance.
• Lawfulness of the Processing: Data controllers must specify the purposes of the data processing in detail before using video devices. Video surveillance based on the mere purpose of “safety” or “for your safety” will not be considered sufficiently specific. In compliance with the accountability requirement of the GDPR, these purposes should be documented in writing and specified for every surveillance camera in use. In terms of the legal basis for the data processing, the processing will most likely be legitimized by the data controller’s “legitimate interests” or under the “public task” basis (if the processing is necessary to perform a task carried out in the public interest or in the exercise of official authority). Consent might serve as a valid legal basis in rather exceptional cases, except if special categories of data (i.e., sensitive data) is processed through the video device (see below).
• Purpose Limitation: Guarantees must be taken to avoid any misuse for totally different and unexpected purposes for the individuals concerned.
• Processing of Special Categories of Data (e.g., biometric data): Video surveillance is not always considered to be processing of special categories of personal data. However, if it is, the data controller must identify both an exemption from the general rule that one should not process special categories of data under Article 9 of the GDPR and a legal basis for the data processing under Article 6 of the GDPR. Furthermore, processing of special categories of data and, in particular, biometric data (e.g., when using facial recognition technology) entail heightened risks for individuals and therefore require an increased and continued vigilance with regard to certain obligations: e.g., a high level of security and a data protection impact assessment, where necessary. Use of video surveillance including biometric recognition installed by businesses for their own purposes will, in most cases, require the explicit consent of all individuals.
• Transparency of the Processing: In light of the volume of information to be provided to individuals under the GDPR, the EDPB recommends adopting a layered approach to providing notice, by displaying a warning sign that contains the most important information (first layer), while the further mandatory details may be provided in a privacy notice (second layer). That second layer information should be easily available to individuals both digitally and non-digitally and it should be possible to access that information without entering the surveyed area.
• Storage Periods: In some EU Member States, there may be specific provisions for storage periods with regard to video surveillance. If not, taking into account the data minimization and storage limitation principles of the GDPR, the personal data should be erased after a few days in most cases (e.g., for the purpose of detecting vandalism).
• Security Measures: Data controllers must adequately protect all components of a video surveillance system and data at all stages, i.e., during storage (data at rest), transmission (data in transit) and processing (data in use) with a combination of organizational and technical security measures. In light of the data protection by design requirement under the GDPR, data controllers should select privacy enhancing technologies, such as systems that allow masking or scrambling areas that are not relevant to surveillance, or irrelevant parts of a digital image.

The Guidelines will be open for public consultation until September 9, 2019. The EDPB is expected to adopt a revised and final version by the end of the year.