Operators of video surveillance systems will usually put up signs on monitored premises to draw attention to the fact that the movement of individuals on such premises is being recorded. In this article, we shall have a closer look at what constitutes best practice in terms of the visuals and contents of such warning signs and pictograms.
One general requirement for engaging in video surveillance is for data subjects (i.e, natural persons entering or staying in areas under surveillance) to be made aware of the fact that they are being monitored. The emphasis here is on transparency, and data subjects always ought to be informed about the fact that they are being recorded within the scope set out by the General Data Protection Regulation (“GDPR”).
Already in 2020, the European Data Protection Board (the “Board”) issued guidelines on the processing of personal data through video devices, in which it describes, among other things, what is best practice when it comes to informing data subjects via a multi-layered approach to communication.
As part of the information pertaining to the first layer (i.e., in the form of the warning sign), the data controller should generally convey the most important information from the point of view of data subjects, e.g. details of the purposes of processing, the identity of the controller, and the existence of the rights of the data subject, along with information on the greatest impact of the processing. This may include, for instance, the legitimate interests which are being pursued by processing the personal data through video devices. If the controller has appointed a data protection officer, their contact details should also be given as part of the first layer. Finally, the warning sign must also contain reference to the more detailed second layer of information.
In addition, the first-layer warning sign should also include all information which may surprise the data subject. The Board gives the example of the transmission of data to third parties, and the storage period. In the absence of such information, the data subject ought to be able to rely on the fact that only live surveillance is being carried out (without any data recording or transmission to third parties).
In this respect, we should also mention that the first-layer warning sign should ideally be furnished with the icon of a camera, so as to bring it home to data subjects that they are about to enter an area under video surveillance. This pictogram, along with the warning sign, ought to be installed in a clearly visible place, ideally on eye level. Data subjects should be able to infer from the warning sign which areas are under surveillance, so as to be able to adjust their behavior accordingly. The warning sign should be placed before the entrance to monitored premises, so that data subjects can familiarize themselves with the information on data processing before they enter such premises.
The second layer of information with which the controller discharges their information obligations should be a more detailed document explaining the processing of personal data in more depth. This document could e.g. be made available in the lobby or at the reception desk, from where the monitored areas can be entered. The Board notes that second-layer information ideally ought to be made available also online on a website, e.g. by placing a QR code on the first-layer warning sign.
As we have seen, the demands for keeping data subjects transparently informed are becoming ever more stringent. It is therefore highly advisable to properly label all monitored areas and to make sure that data subjects will be able to duly familiarize themselves with the process of video surveillance and what it entails before they even enter the premises under surveillance.
Source:
Summary by the Czech Office for Personal Data Protection of the Guidelines 3/2019 on processing of personal data through video devices
Guidelines 3/2019 of the European Data Protection Board on processing of personal data through video devices of 29.01.2020