Regulations on the use of video surveillance cameras

Regulations on the use of video surveillance cameras

Whenever we enter a business establishment or a public space, it is common to find yellow signs warning us of the use of video surveillance cameras. The use of these devices, intended to reinforce security and prevent accidents, has become increasingly widespread.

However, the use of such cameras necessarily involves the processing of personal data, which entails compliance with a series of legal obligations and respect for the fundamental rights of the individuals recorded.

Below, we analyze the current legal framework, compliance guidelines on data protection and the main limitations that must be considered when installing or using these systems.

Current regulations on video surveillance

Video surveillance in Spain is mainly regulated by the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons regarding the processing of personal data and on the free movement of such data, commonly known as the General Data Protection Regulation (GDPR).
• Organic Law 2/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
• In specific cases, sectoral regulations may also apply, such as Law 5/2014 of 4 April on Private Security.

In addition, the Spanish Data Protection Agency (AEPD) has issued guidelines and resolutions clarifying certain practical obligations, such as the placement of information signs, restrictions on the spaces subject to recording, or the definition of retention periods for images.

These rules set out the legal framework for the installation and use of cameras in both public and private spaces, defining the responsibilities and obligations of entities installing these recording systems.

Compliance with data processing requirements

According to the legislation, “personal data” means any information relating to identified or identifiable natural persons. More specifically, Article 5.1 of the implementing regulation of the former Data Protection Act (approved by Royal Decree 1270/2007, of 21 December) stated that personal data included “any numerical, alphabetical, graphic, photographic, acoustic, or any other type of information concerning identified or identifiable natural persons.”

Therefore, any recording capturing the image of an identified or identifiable individual constitutes personal data.
As a result, entities wishing to implement recording devices in their establishments will be deemed controllers of such data processing and must comply with several obligations under the applicable regulations, including:

• Complying with the principles of lawfulness, purpose limitation, and proportionality.
• Providing clear and visible notice of image recording.
• Adopting appropriate technical and organizational measures.
• Ensuring confidentiality of any third parties with access to the recorded images.
• Limiting the retention period of the images.
• Respecting and facilitating the rights of individuals.

Limitations on the use of security cameras

Although the use of cameras may seem appealing to enhance security and control in certain spaces, their installation is not unlimited and is restricted by fundamental rights such as privacy, data protection, and the right to one’s own image.

The main restrictions apply, for example, in private areas such as bathrooms, changing rooms, or rest areas, where individuals’ right to privacy prevails and recording is strictly prohibited.

Restrictions also apply to public spaces: private individuals and companies may not record public streets on a general basis; only incidental capture is permitted when strictly necessary for security purposes. Recording of public spaces is, in fact, an exclusive competence of law enforcement authorities.

In the workplace, cameras may be used for security and labor control purposes, but always respecting employees’ rights and in accordance with the principle of proportionality. The Workers’ Statute provides that “the employer may adopt any measures it deems most appropriate for monitoring and control in order to verify that the employee complies with his or her work obligations and duties […]”. Therefore, employees’ images may be captured even without their consent, as the processing is grounded in the employment relationship, provided they have been duly informed beforehand.

Finally, in domestic use, private cameras are permitted, but they may not capture images of third-party spaces such as sidewalks, neighbors’ entrances, or adjoining properties.

Considering the possible restrictions and the obligations to be met when installing a video surveillance system, the most advisable course of action is to seek specialized legal advice to ensure compliance with all regulatory requirements.