Senior Associate of Magnusson Latvia, Anna Bogdanova, assisted our client, a veterinary clinic, with aspects of video surveillance, including drafting a legitimate interest assessment, internal procedures for video surveillance, a notice to data subjects about video surveillance, and reviewing the signs used to inform data subjects about video surveillance.
Before implementing video surveillance, the controller must identify the process’s purpose and legal basis and carefully assess whether it is an appropriate mechanism to achieve the purpose. In particular, it should be assessed whether alternative solutions exist in practice that is less restrictive of the privacy of data subjects.
In practice, data controllers often invoke as a legal basis the legitimate interests referred to in Article 6(1)(f) of the GDPR (e.g. the prevention and detection of criminal offences concerning the protection of property). However, this legal basis can only be invoked if the controller’s legitimate interests override the data subject’s interests, rights and freedoms.
Accordingly, a balancing test (legitimate interests’ assessment) must be carried out to assess both parties’ interests (controller and data subject) before video surveillance occurs. It may analyse several aspects that help to ensure the lawfulness of the processing (e.g. position and angle of the video cameras, duration of storage, etc.).
Finally, to comply with the principle of transparency, the controller must inform data subjects about video surveillance and provide all the information referred to in Article 13 of the GDPR. The most important information should be provided in the information sign (first level), while the controller may provide additional information through other means (second level). For example, the second level of information may be provided by posting a notice on the premises and on the website informing about video surveillance.