Lawyer: Everything you need to know about video surveillance in Lithuania

"In order to ensure the safety of oneself and property, video surveillance systems are often installed in the premises and territories of companies or apartment buildings, but this way of processing personal data does not in all cases comply with the provisions of the General Data Protection Regulation (GDPR), - states the professional association of lawyers "NEWTON LAW" partner lawyer Asta Kederytė.

 

The lawyer notes that, first of all, it is important to remember that video surveillance is subject to general GDPR requirements, i.e. the principles of legality, fairness, transparency, purpose limitation, reduction of data volume, accuracy, limitation of storage duration and other principles established in Article 5 of the GDPR must be observed, and the collection of personal data must be based on at least one condition for the legal processing of personal data (usually video surveillance is motivated precisely pursuit of legitimate interests of oneself or third parties (GDPR Article 6 d. 1 f p.) This means that video surveillance must be based on established, clearly defined and legitimate purposes and not carried out in a way incompatible with these purposes.

 

However, even before starting video surveillance, it is very important to critically assess whether this measure is appropriate and necessary to achieve the intended goal. For example, in order to prevent criminal acts against property, it would first be worth considering the application of measures restricting the private life of data subjects on a smaller scale - fencing the property, installing security locks, updating lighting systems, using the services of security services, etc. Only when it is not possible to achieve the intended goal by alternative means, video surveillance systems should be used.

 

Lawyer A. Kederytė also points out that during video surveillance it is very important to assess the time of surveillance, the area, and decide whether to achieve the goal it is necessary to monitor the entire room or territory, or whether only a part is sufficient, as well as to decide whether it is necessary to preserve the video surveillance, and maybe just live video monitoring without recording is enough.

 

Access to video data should be granted only to those persons whose functions are necessary for the performance of personal data - a person authorized by the employer, the chairman of the association of owners of an apartment building, etc. The GDPR does not specify specific terms for the storage of personal data, therefore the general principle applies that the data must be stored in such a form that the identity of the data subjects can be determined no longer than is necessary for the purposes for which the personal data is processed.

 

The data controller has the obligation to inform the employees about the ongoing video surveillance in a signed form or in another way that proves the supply of the information. All information related to video surveillance must be provided to other persons in advance, even before entering the premises or territory where video surveillance is carried out, in an easy, accessible and concise manner, in clear and simple language (Art. 13, 14 GDPR).

 

However, given the abundance of this information and to avoid information fatigue, the data controller may use a multi-level approach. In this way, the essential information related to video surveillance should be provided in the information table (first level), and the rest should be found on the Internet or by contacting the specified contacts according to the link provided in this table (second level).

 

The warning sign should display the CCTV camera symbol, use the language of the country where the video surveillance is taking place, and use a clear and legible font. The information on the sign should be positioned in such a way that the data subject can easily recognize the circumstances of the surveillance (at approximately eye level) before entering the surveillance area.

 

"It should be noted that the mere hanging of an information board with the symbol of a video surveillance camera, without providing the specified information, is not adequate and GDPR-compliant information of data subjects," said the lawyer.

 

If it is intended to install video surveillance systems in the common rooms or territory of an apartment building, in addition to the above-mentioned requirements, it is also necessary to approve this decision by a majority of co-owners.

 

Finally, it is important to remember that during video surveillance, the data subject is given the right to access the data collected about him. After submitting a request for a copy of the video, such a request should be fulfilled in such a way as not to adversely affect the rights and freedoms of other persons (the copy should not show the faces of other data subjects, they should be blacked out, etc.).

 

In addition, the data subject can also object to the processing of personal data related to him on the basis of the GDPR. In this way, the processing of the objector's data should be stopped, except in cases where the data controller could prove that the image data is being processed for compelling legitimate reasons that override the data subject's interests, rights and liberties.

 

According to the lawyer, although video surveillance can help to prevent damage to health or property in time, it is necessary to ensure that such a method of processing personal data does not conflict with the requirements established by GDPR."