Camera surveillance has several purposes, which fall roughly into purposes serving a public purpose and purposes serving a private purpose.

Camera surveillance for public purposes

The municipality is in charge of establishing the camera policy in public spaces. The rules for this are contained in the Municipalities Act, Police Act and Police Data Act.

Camera surveillance by municipalities: Municipal Law

Municipalities may establish temporary camera surveillance within a predetermined area based on Article 151c of the Municipalities Act if this is necessary for the maintenance of public order. The presence of cameras must be made known in a clear manner, for example with a warning sign. Camera surveillance must be accompanied by additional measures, such as improved street lighting or street surveillance. When camera surveillance is no longer necessary, it should be lifted.

Police camera surveillance: police law

Based on Article 3 of the Police Act, the police may introduce temporary camera surveillance if there is a concrete reason for it and it is necessary to maintain public order. This means that it must involve an actual (impending) disturbance of public order.

Processing by municipalities and police: police data act (Wpg)

The processing of camera images by both the municipality and the police is classified as a processing of police data. The Police Data Act applies in this context. The AVG does not apply: Personal data processing for detecting criminal offenses is exempted from the regulation on the basis of Article 2 paragraph 2 AVG.

The processing of police data under the Wpg is subject to the following conditions:

• Necessity: The goal to be achieved cannot be achieved with less far-reaching measures than the establishment of camera surveillance (Article 3 Wpg).

• DPIA: A DPIA (Article 4c Wpg) must take place prior to processing because it involves personal data processing that is systematic and on a large scale.

• Information obligation: The police must inform data subjects of their privacy rights regarding the processing of camera images, for example the right to inspect. The municipality must clearly communicate to concerned parties that there is camera surveillance.

• Retention period: Both the municipality and the police may only retain camera images if necessary. For the municipality, a maximum period of four weeks applies (Article 151c of the Municipalities Act). The police may retain police data processed for the performance of daily police duties for a maximum of five years. Specific retention periods apply to the various cases in which police data may be processed further, see Article 14 of the Police Data Act.

• Security and access camera footage: Camera images must be secured appropriately and the police must ensure that camera images are not processed unlawfully. The chief of police, as the data controller, decides who has access to the camera images (Article 4a Police Data Act).

• External Processors: If an external party processes the camera images on behalf of the police, the police must enter into a processing agreement with this party. The external party is under the instruction of the police. (1)

Camera surveillance for private purposes: AVG

Camera surveillance can also be used for private purposes. Commercial companies -just like (semi-)public organizations- can install cameras, for example to prevent theft. This is subject to the AVG.

Personal data processing under the AVG is subject to the following conditions:

• Justified interest (Art. 6(1)(f) AVG): The camera policy must serve an actual legitimate interest. Such an interest is, for example, the prevention of theft or the protection of employees and visitors. (2) The camera policy must thereby be necessary. The goal to be achieved cannot be achieved with less far-reaching measures than by establishing camera surveillance. Moreover, the legitimate interest must outweigh the privacy interests of the individuals being filmed.

• Additional measures: Camera surveillance should be accompanied by an overall package of measures.

• Works Council (OR) consent: The implementation of a camera policy requires prior approval from the Works Council.

• DPIA: When camera surveillance is on a large and systematic scale, the organization must conduct a DPIA. With covert camera surveillance, a DPIA is always required.

• Duty to inform: The organization must inform data subjects about their privacy rights regarding the camera policy. For example that data subjects have inspection and deletion rights.

• Retention period: Camera images should not be kept longer than necessary; the guideline is a maximum of 4 weeks. For example, if an incident has been recorded (e.g. theft), the images may be kept until the incident has been dealt with.

For camera surveillance at a residential property, this is allowed provided that one's own belongings are filmed. Private individuals may not hang cameras in public areas. (4)

File Contents

This file provides an overview of all relevant information that professionals can consult when (further) designing their camera policy. The tabs at the top of this file allow you to navigate between news, legislation and Q&A, among others.

Footnotes

(1) https://www.autoriteitpersoonsgegevens.nl/nl/onderwerpen/foto-en-film/cameratoezicht-op-openbare-plaatsen#wie-is-verwerkingsverantwoordelijke-voor-de-verwerking-van-beelden-die-met-cameratoezicht-door-de-overheid-in-de-openbare-ruimte-zijn-gemaakt-8349

(2) https://www.autoriteitpersoonsgegevens.nl/nl/onderwerpen/cameratoezicht/cameratoezicht-winkels-horeca-en-sportclubs

(3) https://www.autoriteitpersoonsgegevens.nl/nl/onderwerpen/cameratoezicht/cameratoezicht-op-de-werkplek

(4) https://www.autoriteitpersoonsgegevens.nl/nl/onderwerpen/foto-en-film/cameras-bij-huis-en-bij-de-buren