Does your organization want to use camera surveillance to secure property, personnel or buildings? Then the General Data Protection Regulation (AVG) has requirements for this. Here you can read what the rules are.
Basis is necessary
You must have a basis for camera surveillance. Is it for the security of property and personnel? Then the basis is often legitimate interest. For example, to prevent theft. Or to protect people, such as your customers, visitors, employees, pupils or patients.
Camera surveillance should be only option
The camera surveillance must be necessary. That is, you cannot achieve the goal any other way. Is there no other option, which is less invasive of privacy? You must check that first.
Also, camera surveillance should not stand alone. It must be part of an overall package of measures.
Conduct DPIA at high privacy risk
Is the data processing likely to pose a significant privacy risk to the people you are filming? If so, you are required to conduct a data protection impact assessment (DPIA).
In 2 cases, a DPIA is required anyway necessary. Even if you believe the camera surveillance does not pose a significant privacy risk. Namely:
In large-scale and/or systematic camera surveillance to prevent theft or protect people. This is the case, for example, if you use camera surveillance structurally or for an extended period of time for this purpose.
If you have a hidden camera (covert camera surveillance) to be used. This applies even if the covert camera surveillance is incidental (and therefore not structural or long-term).
Learn more about the DPIA and when it is required .
Requesting consent from works council or participation council
Is the camera surveillance aimed at your employees? Then you must discuss the plans in advance with the works council discuss.
Is the camera surveillance aimed at your teachers and/or students? If so, you must discuss the plans with the participation council in advance.
The works council or employee participation council must have approved the cameras before you may start camera surveillance.
Taking privacy rights into account
You need to make sure people know there is a camera and for what purpose. For example, by putting up signs.
Retention period of camera images: no longer than necessary
You may not keep camera footage longer than necessary. Has an incident been recorded, such as theft? Then you may keep these images until the incident is dealt with.
Hidden cameras: when to/not to
Normally, you should not use hidden cameras. But are there clear suspicions of, for example, theft or fraud by employees or students? Then you may use a hidden camera under certain conditions:
You do not succeed in stopping the theft or fraud despite efforts.
Hidden camera monitoring is temporary. Permanent covert camera surveillance is not allowed.
The invasion of the privacy of the people you are filming is as small as possible. A camera in a fitting room, dressing room or restroom is not allowed.
You have informed your customers, visitors, employees, students or patients in advance that hidden cameras are possible in certain situations (theft or fraud). For example, in staff regulations or in a camera surveillance regulation.
Does it involve camera surveillance of employees and/or students? Then you need consent of the works council or participation council for a regulation on the use of hidden cameras. And you must inform the employees and/or pupils involved about the use of the hidden camera afterwards.
You have conducted a DPIA.
Did the DPIA reveal that the intended use of hidden cameras poses a high privacy risk? And are you unable to find measures to mitigate this risk? Then you must consult with the Personal Data Authority (AP) before starting camera surveillance. This is called a prior consultation called a prior consultation.
