EDPB Guidelines on processing personal data through video devices 3/2019

The sign should be placed so that people notice the surveillance before they walk into the covered zone, at roughly eye level. Camera positions need not be revealed so long as there is no doubt which areas are monitored and the context is unambiguous; people must be able to judge what a camera captures so they can avoid it or adapt their behaviour.

Reasonable expectations are judged objectively, by whether a neutral third party would expect monitoring in that situation. An employee at the workplace in most cases does not expect to be monitored by the employer; monitoring is not expected in private gardens, living areas, examination and treatment rooms, and it is an intense intrusion in sanitary or sauna facilities, where no surveillance should take place. People can also expect freedom from monitoring in publicly accessible areas used for rest, recovery and leisure or where they sit and talk (restaurant tables, parks, cinemas, fitness facilities). A sign announcing cameras does not change what people can objectively expect.

Facial recognition and other biometrics carry heightened risks and must respect lawfulness, necessity, proportionality and minimisation; the controller should first weigh the effect on fundamental rights and look at less intrusive means. Article 9 applies when three criteria meet: physical, physiological or behavioural characteristics, a specific technical processing, and the purpose of uniquely identifying a person. Classifying people by age or gender without templates to identify them is outside Article 9, but storing templates to recognise someone again (re-entry, repeat targeting) is inside it from the start. Biometric recognition that private organisations install for their own ends will in most cases need explicit consent from everyone concerned.

A DPIA is required where processing is likely to result in high risk, including large-scale systematic monitoring of areas open to the public (Article 35(3)(c)) and large-scale processing of special categories (Article 35(3)(b)); national DPIA lists must be consulted, and since typical surveillance purposes often call for one, many video surveillance cases will need a DPIA, whose outcome should drive the measures chosen. If high risk remains despite planned measures, the supervisory authority must be consulted before processing starts.

Footage may not be kept longer than the purpose needs, subject to any national storage periods. Since damage is usually noticed within a day or two, footage should in most cases be erased after a few days, ideally automatically, and the longer the period, especially beyond 72 hours, the more justification is needed. Where the controller stores footage, storage must be shown to be necessary and the period must be clearly defined for each purpose; retaining specific footage longer to pursue an identified incident remains possible.

Because of the imbalance of power between employer and employee, employers should in most cases not rely on consent for video processing, since staff consent will rarely be free. National law or collective agreements (works agreements included) may set specific rules for processing employees' data in the employment context under Article 88.