The Precise Art of Videosurveillance - Episode 3
Some words of explanation from our Legal Counsels
EL.MO. S.p.a., has been operating in the Video Surveillance sector for over twenty years, boasting Partners of primary importance, both on a National and International level. In the perspective of supporting clients who decides to equip themself with a CCTV system, EL.MO. offers insights aimed at providing some indications, both regulatory and operational, to the interested parties.
The definition of Video Surveillance
The term video surveillance stands for the continuous acquisition of images, possibly associated with sounds, relating to identifiable people, which could also imply the simultaneous recording and/or subsequent storage of the detected data.
Having learned from this, it is clear that the activity in question must be fully regulated in order to prevent the filmed subject from being exposed to any privacy right violations.
The intervention of the Guarantor for the protection of personal data on the subject of Video Surveillance
In this regard, in recent weeks there has been a lot of discussion among the sectors' technicians regarding the publication by the Guarantor for the Protection of Personal Data on December 5th 2020 of some Frequently Asked Questions on the subject of video surveillance. These FAQs have the express aim to support the operators of this sector for the compliance in matter of protections imposed on the subject by the GDPR.
In this regard, it is important to point out that the Guarantor has not substantially innovated the regulations already in force, that followed the issue of the previous 2010 Measures as well as the most recent 3/2019 Guidelines. In fact, these regulations already issued the processing of personal data through video surveillance, being adopted by the European Data Protection Board (so-called EDPB) in the plenary assembly of July 10th 2019. The Guarantor limited itself to clarifying some fundamental points of the regulations.
As a premise, it should be noted that the 3/2019 Guidelines, proposed again in full by the Guarantor, already state that the GDPR does not apply in the case of video footage relating to unrecognizable subjects, either directly or indirectly. For the effect, it is natural that the protections of the aforementioned European Regulation do not apply in the event that fake cameras are installed or not connected to any system or the so-called Park Assist systems, designed to perform only the function of reading the number plates of entering and exiting cars.
Questions and answers:
g) What instructions exist regarding the installation of the video surveillance system in flat complex?
The Guarantor, on the basis of the guidelines already in force by the EDPB, allows the installation of a video surveillance system also within an apartment building.
To this end, it is simply necessary that the installation takes place following the issue by the condominium meetingof an assembly resolution, adopted with the consent of the majority of the thousandths present, and that the information and conservation obligations of the aforementioned images are respected [installation of the “Video Surveillance Area” sign and conservation of the images for the period indicated in the aforementioned letter. d)].
h) What are the guidelines regarding the installation of the so-called smart-cam cameras in your home?
On the basis of what has already been established by the EDPB, the Guarantor reiterated the correctness of the Guidelines published in July 2019, which states that the processing of data carried out through the use of cameras installed inside one's home does not fall within the scope of the GDPR and, therefore, the requirements must not be observed nor the limitations respected.
In any case, the adoption of the following precautions by the homeowner is recommended:
- inform any employees and/or collaborators who regularly spend time within the home (babysitter, cleaning personel and the like) that the smart-cams have been installed;
- avoid to monitor environments that damage the privacy and dignity of the person (e.g. bathrooms);
- protect the data collected through the adoption of appropriate security measures (especially if the devices are connected to the internet) and avoid their dissemination.
i) Can municipalities use video surveillance systems to control landfills of dangerous substances and "eco-pitches"?
As already specified by the EDPB within the 2019 Guidelines, Municipalities in monitoring the so-called eco-centres and landfills of hazardous substances must comply with the principles of necessity and data minimization, pursuant to art. 5 GDPR.
In other words, the Municipality will be able to install one or more cameras to check the methods of use of these areas, the type of waste discharged and the time of drop-off only if it is not possible, or proves ineffective, to use tools and alternative control systems.
In these cases, information obligations must be fulfilled by affixing appropriate signs (signs referred to the letter c above).
In any case, the Guarantor takes care instead to specify that it is not allowed for such monitoring to be carried out by private subjects.
j) What are the limitations to the processing of particular data by means of a video surveillance system?
The Guarantor, with respect to what is already stated by the GDPR, reiterates that every time data processing is put in place - therefore also through the use of a video surveillance system - the same may treat particular data only if one of the exceptions stated by art. 9 of the aforementioned Regulation8 (for example, think of the case of a hospital that installs a video camera to monitor the health conditions of a patient who processes particular categories of personal data).
In other words, the data controller who installs a video surveillance system capable of detecting data relating to this delicate category must in any case try to minimize the risk of acquiring videos that reveal other sensitive data, regardless of the purpose.
The Guarantor also specifies - and this by taking a specific position on the point, compared to what was in the past left to the interpretation of the operators of the sector - that the processing of particular categories of data requires reinforced and continuous supervision with regard to compliance with certain obligations, for example the high level of security of the system and the carrying out of a data protection impact assessment.
