The Precise Art of Videosurveillance - Episode 2
Some words of explanation from our Legal Counsels
EL.MO. S.p.a., has been operating in the Video Surveillance sector for over twenty years, boasting Partners of primary importance, both on a National and International level. In the perspective of supporting clients who decides to equip themself with a CCTV system, EL.MO. offers insights aimed at providing some indications, both regulatory and operational, to the interested parties.
The definition of Video Surveillance
The term video surveillance stands for the continuous acquisition of images, possibly associated with sounds, relating to identifiable people, which could also imply the simultaneous recording and/or subsequent storage of the detected data.
Having learned from this, it is clear that the activity in question must be fully regulated in order to prevent the filmed subject from being exposed to any privacy right violations.
The intervention of the Guarantor for the protection of personal data on the subject of Video Surveillance
In this regard, in recent weeks there has been a lot of discussion among the sectors' technicians regarding the publication by the Guarantor for the Protection of Personal Data on December 5th 2020 of some Frequently Asked Questions on the subject of video surveillance. These FAQs have the express aim to support the operators of this sector for the compliance in matter of protections imposed on the subject by the GDPR.
In this regard, it is important to point out that the Guarantor has not substantially innovated the regulations already in force, that followed the issue of the previous 2010 Measures as well as the most recent 3/2019 Guidelines. In fact, these regulations already issued the processing of personal data through video surveillance, being adopted by the European Data Protection Board (so-called EDPB) in the plenary assembly of July 10th 2019. The Guarantor limited itself to clarifying some fundamental points of the regulations.
As a premise, it should be noted that the 3/2019 Guidelines, proposed again in full by the Guarantor, already state that the GDPR does not apply in the case of video footage relating to unrecognizable subjects, either directly or indirectly. For the effect, it is natural that the protections of the aforementioned European Regulation do not apply in the event that fake cameras are installed or not connected to any system or the so-called Park Assist systems, designed to perform only the function of reading the number plates of entering and exiting cars.
Questions and answers:
d) What are the conservation times of the recorded images?
The Guarantor, in no way distancing from the regulations already in force, specifies that the recorded images cannot be kept longer than necessary for the purposes for which they were acquired [art. 5, paragraph 1, lett. c) and e), of the GDPR].
On the basis of the principle of accountability (Article 5, paragraph 2, of the GDPR), it is in fact up to each person who decides to employ a video surveillance system to identify the retention times of the images, taking into account the context and purpose of the processing, as well as the risk to the rights and liberties of individuals.
Depending on the needs to answer with the installation of the cameras (e.g. protection of the company's assets from theft and vandalism and security purposes), a maximum images conservation period must therefore be set. This period of time must not exceed the one indicated by the law (established in 24/48 hours), being able to keep such images for a longer period only in cases of particular and proven need (such as, for example, the closure of the business during the weekend and during holidays).
In any case, even in the presence of such proven and exceptional conservation needs, the data controller will not be able to keep the recorded images for a period exceeding 7 working days (except for the presence of ongoing investigations by the judicial police and after specific request of the Authorities to this effect).
At the end of the retention period, the Guarantor recommends to promptly deleted such images from the storage devices, preferably by activating automated technical or organizational measures for their deletion.
e) What is meant by "preventive impact assessment" pursuant to the GDPR and the installation of which video systems requires it?
However, the guarantor also specified that in some cases, it will also be necessary for the person who intends to install a video surveillance system to undertake an impact assessment, pursuant to art. 35 of the GDPR, that is an analysis of the technical characteristics of the system in order to verify whether the related data processing does not unduly and excessively affect the rights and liberties of the filmed individuals.
In particular, this caution will be adopted if the treatment expects "the use of new technologies, given the nature, object, context and purpose of the treatment, may present a high risk for individuals".
For this purpose, it is provided the example case of "integrated systems - both public and private - that integrate cameras between different subjects as well as intelligent systems, capable of analyzing and processing images, for example in order to automatically detect behaviors or anomalous events, report them, and potentially record them".
Finally, the Guarantor takes a position on large-scale systemic video surveillance of an area accessible to the public, stating that the installation of such systems certainly falls within the data processing that requires a preventive impact assessment, pursuant to art. 35 GDPR.
f) Is video surveillance also allowed in schools?
Also with regard to the possibility of installing a video surveillance system inside schools, the Guarantor does not deviate from the previous regulations, allowing such installation in compliance with particular precautions.
