For those considering the use of video-surveillance

To use video-surveillance, you must comply with one of the legal grounds for processing set out in the GDPR. Generally, having a legitimate interest is the most commonly used ground when using a video-surveillance system not requiring a permit. Your legitimate interest in carrying out video-surveillance must override the data subject’s interests or the fundamental rights and freedoms of the individual. This assessment must be carried out as well as documented before you begin using video-surveillance. 

In order for the video-surveillance to be legal, you are obliged to have a specific, explicitly stated and legitimate purpose for the surveillance. The purpose of the surveillance sets the limits for what you may and may not do. You may not add new purposes for the surveillance unless these are compatible with the original purpose.

E.g., you may not begin to carry out surveillance for the purpose of preventing and hindering vandalism and later on also use the same surveillance footage to examine the number of external visitors a company has during a certain timespan. The surveillance must be necessary in order to fulfil the set purpose. It must therefore not be reasonably plausible to fulfil the purpose of the surveillance with any less intrusive means. 

Keep in mind that you must have what is referred to as a legitimate interest for your video-surveillance. For instance, the purpose to protect property against burglary, theft or vandalism can constitute a legitimate interest for video-surveillance. Your legitimate interest needs to be an actuality and needs to be a current issue.

Accordingly, if you are using video-surveillance in order to prevent or investigate crime, you must be able to demonstrate that the area under surveillance is exposed to crime. Another legitimate interest is accident prevention. In this case, you must be able to demonstrate that there is a concrete risk of accidents present in the area you wish to monitor. 

It is of great importance that you don’t carry out video-surveillance of an area which is larger than what is necessary in relation to the purpose of the surveillance. This is due to the fact that it is not allowed to collect more personal data than what is necessary in order to fulfil the purpose of the surveillance. There are technical solutions available with the ability to mask certain areas. This can be appropriate/useful in cases where it is not possible to direct the camera in such a way that it doesn’t capture an area larger than what is necessary or certain categories of areas, for instance residential areas, playgrounds and other areas used for recreation. 

What hours of the day you need to carry out video-surveillance is also something that must be considered. If, for example, you have issues with crime and vandalism occurring exclusively late in the evening and during night, you may not carry out your surveillance during daytime. In order for around the clock surveillance to be allowed you must be able to demonstrate a need for it.  

You may only retain the camera footage for as long as it is needed for the purpose of your video-surveillance. Accordingly, there is an obligation to strive for as short storage time as possible. The European Data Protection Board’s recommendation of a three-day storage period is a good rule of thumb. If you have an actual need of a longer storage time you must be able to provide a specific motivation.

You must decide when and by whom the video-surveillance is monitored. Casual viewing or viewing of camera footage for other purposes than the explicitly stated purpose of the surveillance is not in accordance with the law. I.e. if you initiate video-surveillance for the purpose of crime prevention you may not view the footage for any other purpose. In that case, access to the footage should be restricted to the occurrence of an incident or crime.

You may not share information obtained by video-surveillance which relates to an individual’s personal circumstances. Such information is confidential. Sharing the footage with the police or other competent authorities in the area of the prevention, investigation, detection or prosecution of criminal offences is, however, allowed, if the sharing is necessary for the investigation, prevention or detection of a crime where prison is a possible penalty. 

You are obliged to inform of your video-surveillance in an intelligible and easily accessible way. The General Data Protection Regulation contains several requirements regarding the content of the information.

IMY recommends that you implement a layered approach providing information. The first layer of information can be provided by a warning sign containing the most relevant information regarding the surveillance. Another layer of information may be provided in another way, for example through a website.

Inform about your video-surveillance

If you are considering implementing video-surveillance, it is important to be aware of and have routines for complying with the rights of the individuals who are subject to the surveillance. The rights of the individuals subjected to video-surveillance follow from the GDPR. 

The data subject's rights 

The purpose of the surveillance is the same as the surveillance interest, for instance video-surveillance for the purpose of preventing crime or accidents.

If the purpose is crime prevention → Document what has occurred in the area.

If the purpose is accident prevention → Document your account of the risk related to the area.

The lawful ground which is typically applicable for private use of video-surveillance is legitimate interests. For public authorities and entities performing a task in the public interest, the lawful ground for processing is often the performance of a task in the public interest. Regardless of whether the applicable lawful ground is legitimate interest or performing a task in the public interest, an assessment of your legitimate interests needs to be done.
An assessment of legitimate interests consists of the following parts:

1. Assess violations or negative consequences to the data subject’s rights. To what extent does the surveillance affect interests, fundamental rights and freedoms of individuals?

2. Assess your need to process. The reason why you want to carry out video-surveillance is the interest of your surveillance. Such interests that should be given specific consideration are in short:

• Prevention, detection or investigation of crime 
• Prevention or detection of disruptions of public order and safety
• Execution of supervisory activity
• Prevention or detection of accidents, and
• Other comparable purposes. 

3. You must balance these interests. The surveillance is admissible if the interest behind the surveillance overrides the violations or negative consequences to the data subject’s rights after adjustments of the surveillance have been implemented in order to lessen these violations or negative consequences.

When the violations of or negative consequences for the data subject’s rights have been identified, you should consider how you may reduce the risk for those subject to surveillance in order to limit the violations. Times of day for the surveillance; is it enough to carry out video-surveillance during evenings and nights or only in case of an alarm? How large does the surveillance area need to be, is there need for any masking of sensitive spaces within the area? Do you need to store footage or is real-time surveillance enough? Keep the principle of data minimisation in mind, only surveillance that is necessary for your purpose is permitted – is your intended video-surveillance too extensive? 

If your surveillance footage is to be stored, the storage time may not be longer than necessary. If a long storage time can be motivated, it may be admissible. Longer storage periods must have a more comprehensive motivation, especially if the intended storage time is longer than 72 hours.

A permit for video-surveillance is mandatory for public authorities. It is also mandatory for those performing a task carried out in the public interest, if they intend on carrying out constant or regularly recurring surveillance of individuals in areas to which the public has access.

What information are you obliged to provide and how is the information to be provided? Information of the video-surveillance should be provided in two layers. The first layer is a warning sign, on which the most important information is to be displayed. The sign also has to refer to the more detailed second layer of information and where and how to find it.

Inform about your video-surveillance

The surveillance footage may need to be protected through the use of data encryption or other security measures. The level of security must be appropriate to the situation in each individual case. This applies to both technical and organisational security. Organisational security measures include, i.a, policies for management of the surveillance footage as well as access limitations regarding the footage.

Video-surveillance is a sensitive form of data processing since such surveillance often means processing of a significant volume of information. In order to ensure that the surveillance is lawful, a number of assessments must be made. These should be documented in writing in order to inform the data subjects of the camera surveillance and to ensure compliance of beforehand set policies. Documentation is also of core importance to demonstrate which assessments have been carried out in accordance with the principle of accountability in the GDPR.

The need for video-surveillance must be regularly reassessed. If there are any changes in the monitored space or if other circumstances have changed resulting in the need surveillance no longer being necessary or being adjusted, this should be remediated as soon as possible. If there is a permit for video-surveillance, an application for a change of the permit in accordance with Section 14 of the Camera Surveillance Act may have to be made.