System in use

Running video surveillance lawfully

The yardstick for private video surveillance is Art. 6(1)(f) GDPR and not section 4 BDSG. The assessment runs in two stages and mostly ends at the first. Where the camera is not necessary the balancing falls away, and demonstrating necessity is for the organisation doing the watching.

Three cameras, one reason from six years ago

There is a camera at the entrance, a second at the stockroom, a third above the till. They were bought after a break-in six years ago. A sign with a camera symbol hangs on the door. Why each camera hangs there and what it is meant to capture appears nowhere.

The assessment mostly ends at the first stage

What the balancing exercise has to contain and who owes it is the question most installations founder on. The yardstick is Art. 6(1)(f) GDPR, and the provision calls for two assessments one after the other.

Two stages, and the second rarely arrives

Necessity
Is there a legitimate interest, and is the camera necessary for it? It is necessary only where the reason is supported by facts and cannot be met just as effectively by a less intrusive measure.
Balancing
Do the legitimate interests override the interests of the data subjects? Under recital 47 GDPR it matters whether the processing is customary in the sector and whether the people concerned can reasonably expect it in that situation.
The order is the point
Video surveillance that is not necessary is unlawful without more. The Federal Administrative Court held that the balancing then falls away, because there is nothing to put on the scales.

3 von 3

What a balancing exercise has to contain follows from this.

Four entries per camera

The purpose

Specified and not general. Theft protection in the stockroom is a purpose, security is not. A camera serving several purposes needs a separate justification for each.

The facts establishing the risk

Incidents, police reports, loss records, the location of the premises. What is required are actual findings, and an incident years ago does not by itself establish a continuing risk.

The less intrusive measures considered

The entry that is missing most often. A lockable cabinet, a staffed counter, a structural change, access control. Only where none of these is equally effective is the camera necessary.

The outcome of the balancing

Only here does the balancing against the interests of data subjects follow. Anyone unable to supply the first three entries never reaches this one.

Without the third entry the balancing is not one but a justification.

The field of view is itself a subject of assessment

Which area may be captured is decided not by the camera’s field of view but by the purpose. Art. 5(1)(c) GDPR limits processing to what is necessary for the purpose, so the aiming of a camera is a decision in its own right.

Four areas and how they are treated

Regularly lawful	Merkmal	Regularly unlawful
Where risk is establishedThe area in which the loss would arise, and only that area.	Own entrance and till area	Without established risk
Only exceptionallyA narrow strip in front of your own entrance, in so far as technically unavoidable.	Public thoroughfare	Pavement and streetSafety in public space is a matter for the authorities and not for private parties.
NeverNot even in part, and not with a pan function that could reach it.	Neighbouring property	Any capture
A very narrow exceptionA till workstation, for instance, and then with the works council involved.	Workstations and break areas	Continuous monitoringStaff rooms, changing rooms and sanitary facilities in any event.

Aiming a camera is not an incidental question of installation. Under Art. 58(2)(d) GDPR a supervisory authority can order a camera to be aimed differently, and the Federal Administrative Court confirmed such an order as the milder measure compared with removal.

A sign informs and permits nothing

What a sign achieves is regularly overestimated. The Federal Administrative Court held that even clearly visible notices do not justify concluding that people entering thereby express their agreement. A sign is no substitute for a legal basis.

What it does have to achieve is set out in Art. 13 GDPR. The information has to be given at the time of collection, so before the area covered, and Art. 12(1) GDPR requires a concise, intelligible and easily accessible form.

What belongs on the sign and what beside it

On the sign: the camera symbol, the name of the controller, the purpose, the legal basis, the retention period and a pointer to the full text
On the sign: the contact details of the data protection officer, where one is appointed
Beside it, reachable on site: the full information under Art. 13 GDPR, for instance as a notice or via an address given on the sign
Before the area covered, not inside it: anyone who sees the sign only once they are being filmed was not informed in time

How we support you with video surveillance

An existing installation can be surveyed in a single pass. One row per camera with the purpose, the area covered, the retention period and the fact establishing the risk. Cameras without an entry in the last column are the working list. Where monitoring of publicly accessible areas is systematic and on a large scale, an impact assessment under Art. 35(3)(c) GDPR applies, and where workstations are captured, co-determination under section 87(1) no. 6 BetrVG.

Frequently asked questions

Does section 4 BDSG apply to businesses?

Under the case law of the Federal Administrative Court, no. The opening clauses in Art. 6(2) and (3) GDPR do not cover video surveillance by private controllers, so there is no room to apply section 4 BDSG to them. The yardstick is Art. 6(1)(f) GDPR.

Is a general need for security enough?

No. What is required is a risk situation going beyond ordinary everyday risk, and it has to follow from actual findings. Subjective fears and a feeling of insecurity do not suffice under the case law.

Do the rules only apply where images are recorded?

No. Observation in real time is already processing where the people shown are identifiable. The Federal Administrative Court decided this expressly for a camera-monitor system without any storage.

Is an impact assessment required?

For systematic monitoring of publicly accessible areas on a large scale, yes, Art. 35(3)(c) GDPR. A customer area is publicly accessible even where it is private property. The list of the competent supervisory authority applies alongside.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.