Guidelines 03/2019 on processing of personal data through video devices

SECTION 3   LAWFULNESS OF PROCESSING

15. Before use, the purposes of processing have to be specified in detail (Article 5 (1) (b)). Video surveillance can serve many purposes, e.g. supporting the protection of property and other assets, supporting the protection of life and physical integrity of individuals, collecting evidence for civil claims. These monitoring purposes should be documented in writing (Article 5 (2)) and need to be specified for every surveillance camera in use. Cameras that are used for the same purpose by a single controller can be documented together. Furthermore, data subjects must be informed of the purpose(s) of the processing in accordance with Article 13 (see section 7, Transparency and information obligations). Video surveillance based on the mere purpose of “safety” or “for your safety” is not sufficiently specific (Article 5 (1) (b)). It is furthermore contrary to the principle that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (see Article 5 (1) (a)).

16. In principle, every legal ground under Article 6 (1) can provide a legal basis for processing video surveillance data. For example, Article 6 (1) (c) applies where national law stipulates an obligation to carry out video surveillance. However in practice, the provisions most likely to be used are

• Article 6 (1) (f) (legitimate interest),

• Article 6 (1) (e) (necessity to perform a task carried out in the public interest or in the exercise of official authority).

In rather exceptional cases Article 6 (1) (a) (consent) might be used as a legal basis by the controller.