Who is a data controller for the processing of images taken by government camera surveillance in public places?

In camera surveillance in public spaces to maintain public order, the municipality and the police both play a role. The mayor, together with the city council, decides on the deployment of regular camera surveillance, but the police are responsible for processing the camera images. The mayor is therefore responsible for camera surveillance in a political-administrative sense, but is not the controller for processing the camera images. That is the chief of police. Below you can read why.

Mayor decides on deployment

Municipalities can use camera surveillance to monitor public places if this is necessary in the interest of maintaining public order. Article 151c of the Municipal Law contains the rules for this. The mayor, together with the city council, decides in which cases, where and for how long camera surveillance will be used. If you disagree with the decision to place surveillance cameras in a certain place, you can object to this decision of the mayor.

Camera images are police data

According to the Municipal Law, the processing of camera images falls under the Police Data Act. This means that the camera images are police data.

Processing of police data

Although the mayor decides on the deployment of regular camera surveillance under Article 151c of the Municipalities Act, he is not the data controller for processing camera images. Who is the data controller for the processing of police data is stated in the Police Data Act. In this case, it is the chief of police. The fact that the processing of the camera images falls under the Police Data Act also means that this processing must meet the requirements of the Police Data Act. For example, the police must prepare a data protection impact assessment (DPIA) before starting the processing of the camera images.

The police may view camera images and use them to maintain public order. For example, to combat unsafe situations or regular disorder. If incidents are recorded on the camera footage, such as a fight, the police may also use the camera footage to track down the perpetrators of crimes.

Incidental camera surveillance by police: camera footage also police data

The police can also use camera surveillance incidentally under Article 3 of the Police Act if there is a concrete reason for it and it is necessary for the maintenance of public order.

For example, in the event of unforeseen disturbances or (the fear of) disturbances of a temporary nature, such as a high-risk match in professional soccer, in the event of (the threat of) riots, at events or demonstrations.

Even with this incidental camera surveillance, the processing of the camera images falls under the Police Data Act. The chief of police is the data controller for the processing of the camera images (police data), and the processing must meet the requirements of the Police Data Act.

Chief of police is data controller

The Municipalities Act provides that the images from camera surveillance in public places are police data covered by the Police Data Act and are processed by the police. The Police Data Act states that the chief of police is the data controller for processing camera images.

Indeed, the chief of police is designated by law as the data controller for police data processing in the police. Because the legislature has determined who is the data controller for processing police data in the police, it is no longer relevant who in practice determined the purpose of and means for processing.

The chief of police is therefore responsible for ensuring that the processing of camera images complies with all the requirements of the Police Data Act. He must also be able to demonstrate this.

Provision of camera images

The police may only provide the camera images if this is permitted under the Police Data Act. Thus, the municipality does not have easy access to the camera footage and the police must monitor this.

Conducting DPIA

The fact that the chief of police is the data controller also means that he is responsible for conducting a DPIA. This must be done before camera surveillance and thus the processing of camera images is started. Because in the case of regular camera surveillance the mayor decides, among other things, on the location of the camera surveillance and its duration, it is obvious that the chief of police should involve the mayor in conducting the DPIA.

Agreements with the municipality

It is also obvious that the police and the municipality are in close contact about the implementation of camera surveillance. For example, about informing citizens. Under the Municipalities Act, the municipality must clearly indicate where cameras are hanging. Under the Police Data Act, the police must inform those involved about the processing of police data (the camera images) and about their privacy rights. Think of the right of inspection.