Real-time video surveillance

Real-time video surveillance

Technological developments are becoming faster and faster, and citizens often wonder what the data protection implications are in this respect. The use of video surveillance cameras in different environments is not without different considerations, but we must assess whether real-time video surveillance without image storage really involves the processing of personal data.

Legal keys to real-time video surveillance

The processing of personal data for video surveillance purposes is amply regulated in our legal system and, specifically, in Article 22 of the Organic Law on the Protection of Personal Data and the Guarantee of Digital Rights. Specifically, Article 22.1 establishes that “Natural or legal persons, public or private, may carry out the processing of images through camera or video camera systems for the purpose of preserving the security of persons and property, as well as of their installations”.

However, Article 22.3 establishes that “The data shall be deleted within a maximum period of one month from their capture, except when they have to be kept accrediting the commission of acts that threaten the integrity of persons, property or installations. In such a case, the images must be made available to the competent authority within a maximum period of seventy-two hours from when the existence of the recording became known“.

In this case, we must ask ourselves the following question: if there is no possibility to keep these images, are we really dealing with the processing of personal data?

Image recording vs. real-time video surveillance

Having indicated that not all video surveillance systems, as is well known, store and retain the images they obtain, but that some merely transmit them live, the question arises as to whether the data protection requirements and obligations also affect the latter.

The AEPD states that “The GDPR defines in Article 4.2. processing as “any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction” and that “(…) having regard to the above definition transposed from Article 4(2) of the GDPR, the AEPD states that the data protection requirements and obligations also apply to the latter. ) in accordance with the definition transcribed above, even if the images are not recorded, the reproduction in real time, as it collects them, implies data processing, and therefore, the subjection of such processing to the provisions of the GDPR“.

Obligations in the realisation of real-time video surveillance

Bearing in mind that real-time video surveillance, as the AEPD has made clear, involves the processing of personal data, even if there is no storage of the images reproduced, data controllers must assume a series of obligations provided for in the applicable regulations.

Principally, the data controller must inform data subjects about the processing to be carried out before proceeding with the processing and, among other aspects, must mark these cameras and notify the identity of the data controller, the possibility and form of exercising the data subjects’ rights and where to obtain further information in this respect.

This information shall be provided in a first layer of information and shall be expanded in an accessible manner for data subjects.

At Letslaw by RSM our team of data protection lawyers, can help you with the installation and processing of personal data through video surveillance cameras.