Lawfulness of video surveillance – Part 4 of 13

Video surveillance is a common means of collecting and processing personal data, and as such, it is subject to the General Data Protection Regulation (“GDPR”).

Under the GDPR, the use of video surveillance is legal only if it is carried out by the principles of data processing, which include lawfulness, fairness, and transparency. This means that organizations must have a clear and lawful basis for using video surveillance and must inform individuals about their use of the technology. In this blog post, we’ll explore the lawful basis for video surveillance about the GDPR and what businesses and organizations need to consider when using these technologies.

For a data processing activity to be legal, it needs to be based on one of the six lawful bases for processing personal data, which are consent, contract, legal obligation, vital interest, public task, and legitimate interests.

1. Consent: Organizations can rely on consent as a lawful basis for processing personal data if individuals have given their explicit agreement to the processing of their data for a specific purpose. This means that organizations must inform individuals about the purpose of video surveillance and obtain their explicit consent before using the system.
2. Contract: Organizations can rely on the contract lawful basis if the processing of personal data is necessary for the performance of a contract to which the individual is a party. For example, an organization may use video surveillance to monitor employee attendance and performance as part of their employment contract.
3. Legal obligation: Organizations can rely on the legal obligation lawful basis if the processing of personal data is necessary to comply with a legal obligation. For example, an organization may be required to use video surveillance to comply with health and safety regulations.
4. Vital interest: Organizations can rely on the vital interests lawful basis if the processing of personal data is necessary to protect the vital interests of the individual or of another person. This might include the use of video surveillance to prevent crime or protect individuals from harm.
5. Public task: Organizations can rely on the public task lawful basis if the processing of personal data is necessary for the performance of a task carried out in the public interest. For example, an organization may use video surveillance to monitor public areas for the purpose of public safety.
6. Legitimate interests: Organizations can rely on the legitimate interest’s lawful basis if the processing of personal data is necessary for the legitimate interests of the organization or a third party, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the individual. Organizations must carefully consider the impact of their video surveillance activities on the rights and freedoms of individuals and ensure that their legitimate interests are not outweighed by any negative impacts on the individual.

Video surveillance is lawful if it is required to further a controller’s or a third party’s legitimate interest unless the data subject’s interests or basic rights and freedoms outweigh those interests ( Article 6 (1)(f) of the GDPR ). Legal, financial, or non-material interests may be pursued by a controller or a third party. However, the controller should take into account that if the data subject of the surveillance objects in accordance with Article 21, the controller can only continue to video surveillance activities on that individual if there is a compelling legitimate interest that outweighs the individual’s interests, rights, and freedoms or if it is necessary for the establishment, exercise, or defense of legal claims.

Additionally, the GDPR strongly emphasizes that any data collected from the data subjects must serve a purpose. If the collected data is not used for a specific purpose, it must be deleted immediately. Personal data cannot be collected for future use, except for public interest, scientific or historical purposes. The principles relating to the processing of personal data are clearly explained in Article 5 of GDPR.

💡 The purpose of ensuring physical security, protecting the workforce against any workplace hazards, and ensuring occupational health and safety constitutes a legitimate interest for video surveillance.

In the context of workplace safety, the use of video surveillance can be justified as a legitimate interest if it is necessary to protect the safety and well-being of employees and other individuals present in the workplace. This might include the use of video surveillance to monitor hazardous areas or to identify and prevent safety risks.

💡 The purpose of data processing at Intenseye is simple; providing risk-free work environments in terms of occupational safety and health.

Where the legal basis for processing personal data via video surveillance is based on legitimate interest:

• Legitimate interest must be tied to a demonstrably ‘real’ matter, not fictitious or speculative. In this context, workplace accident statistics in an industry or for a particular facility or the experiences of similar data controllers will constitute appropriate evidence. Data controllers should document the relevant subject, statistics, or events as strong evidence of the existence of a legitimate interest.
• Data controllers should consider where and when video surveillance measures are absolutely necessary. For example, when it is necessary to capture more than the immediate surroundings of a facility; The data controller should take data masking measures such as blocking or pixelating irrelevant areas (image digitization) through physical and technical means.
• In cases where the recording of footage is necessary, the data controller must, on a case-by-case basis, make a legitimate decision to consider and evaluate (i) the extent to which the monitoring affects the legitimate interests, fundamental rights, and freedoms of individuals, and (ii) whether this has negative consequences for the rights of the data subject. It is necessary to establish a balance of interests (legitimate interest assessment).
• While making a legitimate interest assessment, the data subject’s reasonable expectations (based on the expectations of an objective third party) at the time the data is processed and in the context in which the data is processed must be taken into account. In some cases, data subjects may prefer data processing with video footage to data processing by other means.
• To a limited extent, legal grounds (with reference to Article 6(1)(a) and (f)) may also apply, such as the consent of the data subject and the performance of a task in the public interest. However, if consent is relied upon, consent must meet GDPR standards. Entering an area where there are signs of image acquisition in that area does not by itself constitute a necessary declaration of consent or express consent unless it meets the requirements of Articles 4 and 7 of the GDPR. There must be a proper privacy notice.

To conclude, we are of the opinion that video surveillance for workplace safety can be justified under the lawful basis of legitimate interests as set out in the GDPR. Legitimate interests refer to the interests of an organization or a third party, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the individual. However, it is important for organizations to carefully consider which lawful basis is most appropriate for their video surveillance activities and to ensure that they are able to justify their use of the system under one of the lawful bases set out in the GDPR. Organizations must also be transparent with individuals about the purpose of video surveillance and inform them of their rights in relation to the processing of their personal data.

Don’t forget to tune in for our next post, where we will be exploring Transparency: Importance of the Privacy Notice.