EUROPEAN DATA PROTECTION BOARD ISSUES DRAFT GUIDANCE ON THE PROCESSING OF PERSONAL DATA THROUGH VIDEO DEVICES

Written by: Richard Sheinis, Esq.

The European Data Protection Board (“EDPB”) recently issued guidance on the use of video devices to process personal data. The guidelines are in draft form, and were open for public comment through September 9, 2019.  The final version of the guidelines is expected later this year.

The use of video devices is quite common in the business world, but is often overlooked when it comes to compliance with GDPR.  The guidance makes it clear that the use of video devices is the processing of personal data under GDPR.  A few of the important points in the guidance are as follows:

An organization must have a legal basis for conducting video surveillance.  The provisions most likely to be used as a legal basis for video surveillance are the legitimate interest of the data controller, and the necessity to perform a task carried out in the public interest or in the exercise of official authority.  It is rare that the legal basis of consent may be used to justify video surveillance. For practical purposes, we will focus on legitimate interest as the legal basis for video surveillance.

As with any other circumstance in which legitimate interest is the legal basis for processing, the data controller must go through a documented balancing test to demonstrate the applicability of legitimate interest. The first part of the test is whether a video surveillance system is suitable to attain the desired goal, and whether the purpose of the surveillance could not reasonably be fulfilled by other means which are less intrusive to the fundamental rights and freedoms of the data subject.  Presuming that video surveillance is necessary to protect the legitimate interest of a data controller, it still must not override the interests or fundamental rights and freedoms of the data subject.  For example, a business might have the problem of vandalism occurring in their publicly accessible restroom.  While a surveillance camera in the restroom might protect the legitimate interest of the business to catch the vandals, a surveillance camera in a restroom would greatly affect the fundamental rights and freedoms of the persons using the restroom.  Therefore, a video camera in a restroom would not pass the balancing test in this circumstance.  The result might be different if cameras were placed in other areas of the business outside the restroom.

If video surveillance is allowed under the legitimate interest basis, the data controller must still observe all the other requirements of data processing such as documentation, an appropriate retention plan, and having a procedure to comply with the rights of the data subject, such as the right to access, right to delete, etc.

In order to comply with the transparency obligation of GDPR, the use of video cameras also requires appropriate notice to those who are likely to be subject to the video surveillance.  In this regard, appropriate warning signs in the area of the video cameras are necessary to alert persons to the existence of the video cameras.  This notice must also provide enough information, so the data subject knows how to obtain additional information regarding the video surveillance. The additional information is called the “second layer of information”.

We will let you know when the guidance is in final form, and we can provide additional information to assist you in developing a compliance plan for the use of video surveillance devices.