Camera surveillance in or around a store, restaurant or sports club can help protect property, visitors and staff. But the invasion of customer and employee privacy is significant. Therefore, business owners may only put up cameras if they meet a number of conditions. They must also ensure that the invasion of customers' and staff's privacy is as small as possible. A camera in a fitting room, dressing room or restroom goes too far, as people could be exposed in the picture.
The business owner must have a legitimate interest for camera surveillance. For example, preventing theft or protecting customers and employees.
The camera surveillance must be necessary. That is, the business owner cannot achieve the goal any other way. Is there no other option that is less invasive of privacy? The business owner must first check that. Also, the camera surveillance must not stand alone. It must be part of an overall package of measures.
The business owner must first pass a privacy test. This means weighing the interests of customers and employees against his own.
Is the business owner deploying large-scale and/or systematic camera surveillance to combat employee theft and fraud? If so, the employer must conduct a data protection impact assessment (DPIA). This is the case, for example, if the entrepreneur deploys camera surveillance structurally or for a longer period of time for this purpose. Does the entrepreneur want to deploy a hidden camera (covert camera surveillance)? Then the entrepreneur must always conduct a DPIA for this. Even if the covert camera surveillance is incidental.
Before customers go inside, they should be able to know that there is camera surveillance. The business owner should inform them of this. For example, by hanging signs. It must be clear for what purpose the cameras are hanging there. In addition, the General Data Protection Regulation (AVG) gives the following privacy rights to data subjects:
The right to view data (camera images);
the right to be forgotten;
The right to restrict processing;
The right to object to the use of personal data.
The business owner may not keep camera images longer than necessary. The guideline for this is a maximum of 4 weeks. But has an incident been recorded, such as theft? Then the employer may keep the relevant footage until this incident is dealt with.
