GDPR and camera systems

10 basic obligations when implementing a CCTV system

1. ✅ An internal regulation going over: 

    

   - The purpose of the camera system installation

   - Specs of the camera system including a plan of the camera locations

   - Information about the camera system administrator and his/her duties

   - The manner in which the persons concerned are informed of the monitoring of the premises

   - Method of data transmission to third parties

   - Safety measures
   

   -  Information on the handling of data subjects' rights (e.g. rights of access to personal data, right to rectification, erasure, objection to processing))

2. ✅ Balance test: you most likely want cameras to protect your property, health, etc. Not only does the installation have to be sufficiently justified, you have to do a balancing test (if you are processing on the basis of legitimate interest). In it, you have to explain that your interest is higher than the interest of the people you are recording. 
3. ✅ DPIA: In some cases, a DPIA, i.e. a data protection impact assessment, may be required. This is a comprehensive assessment of the risks arising from the processing and a proposal to eliminate them.
4. ✅ Keep a record of requests to see the footage. Atleast electronically.
5. ✅ Restrict access to only the most necessary persons and keep a list of such persons.
6. ✅ Anyone who comes into contact with the records should have an NDA. 
7. ✅ If your system will be stored, operated or otherwise provided by an external company, don't forget to have a processing contract ↗. 
8. ✅ Set the time period for keeping the footage. If it is a permanently guarded facility, give a maximum of 24 hours. In other cases, keep it in the order of days and justify. Of course, if you're investigating a theft, keep the records. 
9. ✅ Do not place cameras in toilets, changing rooms or other sensitive areas.
10. ✅ Inform. igns, banners. Let people know where they can find more details about rights ↗, storage times, beneficiaries etc.