Guidelines 03/2019 on processing of personal data through video devices

Section 4.2  Disclosure of video footage to law enforcement agencies

56. The disclosure of video recordings to law enforcement agencies is also an independent process, which requires a separate justification for the controller.

57.  According to Article 6 (1) (c), processing is legal if it is necessary for compliance with a legal obligation to which the controller is subject. Although the applicable police law is an affair under the sole control of the Member States, there are most likely general rules that regulate the transfer of evidence to law enforcement agencies in every Member State. The processing of the controller handing over the data is regulated by the GDPR. If national legislation requires the controller to cooperate with law enforcement (e. g. investigation), the legal basis for handing over the data is legal obligation underArticle 6 (1) (c).

58. The purpose limitation in Article 6 (4)is then often unproblematic, since the disclosure explicitly goes back to Member State law. A consideration of the special requirements for a change of purpose in the sense of lit. a -e is therefore not necessary.

59 Example: A shop owner records footage at its entrance. The footage shows a person stealing another person’s wallet. The police asks the controller to hand over the material in order to assist in their investigation. In that case the shop owner would use the legal basisunder Article 6 (1) (c) (legal obligation) read in conjunction with the relevant national law for the transfer processing.

60 Example: A camera is installed in a shop for security reasons. The shop owner believes he has recorded something suspicious in his footage and decides to send the material to the police (without any indication that there is an ongoing investigation of some kind). In this case the shop owner has to assess whether the conditions under, in most cases, Article 6 (1) (f) are met. This is usually the case if the shop owner has a reasonable suspicion of that a crime has been committed.

61. The processing of the personal data by the law enforcement agencies themselves does not follow the GDPR (see Article 2 (2) (d)), but follows instead the Law Enforcement Directive (EU2016/680).