Watching the Watchers: GDPR’s Impact on Surveillance Systems!
A recent case involving the Deputy Ministry of Social Welfare in Cyprus has brought attention to the use of video surveillance (CCTV) systems that also record audio. A union of civil servants in Cyprus recently complained that cameras at the Ministry were capturing both video and sound, potentially infringing on employees’ privacy rights. The Ministry clarified that the audio recording was limited to the main entrance and was a mistake that has now been corrected.
This incident highlights the importance of understanding and applying GDPR principles, particularly those concerning lawfulness, purpose limitation, and data minimisation, when using video surveillance systems.
Lawfulness: The Foundation of GDPR
Under GDPR, any processing of personal data—including video and audio recording—must have a valid legal basis. Such processing of data is often based on the legal basis of Legitimate Interests where the recording serves a clear and necessary purpose, such as ensuring workplace security.
In this case, the lawfulness of the audio recording depends on whether the Ministry had a valid reason to record sound, and whether this was adequately communicated to those affected. Recording audio without a lawful basis violates GDPR, regardless of the scope or duration of the recording.
Purpose Limitation
The principle of purpose limitation requires organisations to collect data only for specific, legitimate purposes that are clearly defined beforehand. Any processing that falls outside these purposes is prohibited.
For example, if the stated purpose of the Ministry’s cameras was security, the inclusion of audio recording must be shown to be necessary for achieving that purpose. If video footage alone was sufficient, recording sound could exceed the intended purpose, breaching this principle.
Data Minimisation: Collecting Only What is Necessary
Data minimisation ensures that only the amount and type of personal data strictly required for a specific purpose are collected. For video surveillance systems, this means evaluating whether the inclusion of audio is truly necessary. In most cases, video footage alone is sufficient for security purposes.
Conclusion
The recent incident in Cyprus serves as a reminder of the strict obligations organisations face under GDPR when using surveillance systems with audio recording capabilities. Compliance hinges on adhering to the principles of lawfulness, purpose limitation, and data minimisation.
Should you require further information or assistance in GDPR Compliance, our team is ready to help!
Tel: +357 22 622 262, Email: info@paraschou.com.cy