Guidelines 03/2019 on processing of personal data through video devices

Section 3.2  Necessity to perform a task carried out in the public interest or in the exercise of official authority vested in the controller, Article 6 (1) (e)

41. Personal data could be processed through video surveillance under Article 6 (1) (e) if it is necessary to perform a task carried out in the public interest or in in the exercise of official authority. It may be that the exercise of official authority does not allow for such processing, but other legislative bases such as “health and safety” for the protection of visitors and employees may provide limited scope for processing, while still having regard for GDPR obligations and data subject rights.

42. Member States may maintain or introduce specific national legislation for video surveillance to adapt the application of the rules of the GDPR by determining more precisely specific requirements for processingas long as it is in accordance with the principles laid down by the GDPR (e.g. storage limitation, proportionality).