The Personal Data Protection Authority is launching random on-site compliance inspections at businesses in the hospitality and entertainment sectors, focusing on the operation of closed-circuit television (CCTV) systems (CCTV), while also warning businesses about the strict restrictions governing the use of cameras.
According to an announcement by the Commissioner for the Protection of Personal Data, the main objective of the inspections is to assess the level of compliance of businesses with the General Data Protection Regulation (GDPR), with particular emphasis on the operation of video surveillance systems and adherence to the fundamental principles of personal data processing.
ΣΧΕΤΙΚΑ ΑΡΘΡΑ
The Authority notes that it receives daily inquiries and complaints regarding the legality of the operation of cameras and video surveillance systems in places such as restaurants and entertainment venues, reminding the public that image and audio data constitute personal data.
READ ALSO: Cameras Installed in Restaurant Restrooms: What Commissioner Christofidou Says About the Shocking Discovery
As noted in the announcement, regardless of whether the data is stored, the capture or recording of images and sound constitutes the processing of personal data and, to be lawful, must comply with the provisions of both the General Data Protection Regulation (GDPR) and national legislation.
The Authority states that the operation of CCTV systems is permitted for the purposes of protecting and securing private property, provided that the legitimate interest of the business outweighs the protection of the fundamental rights and freedoms of natural persons and that there is no less intrusive means of achieving the specificpurpose.
“As a general rule, audio recording is prohibited,” the Authority emphasizes.
Where Cameras Are Permitted
Among the areas where video recording may be permitted are the entrances and exits of buildings, the area outside elevators, with the camera focused exclusively on that area, card machines or cash registers, with the camera focused exclusively on that specific point, and parking lots.
Conversely, the Authority states that video recording is not permitted in areas such as hallways, the interior of elevators, waiting areas, restrooms, or the interior or exterior dining areas of cafes, restaurants, and other similar establishments.
It also notes that there are general restrictions on the operation of CCTV systems in the context of labor relations.
Furthermore, it refers to the monitoring of areas accessible to the general public.
As a general rule, the Authority notes, this type of processing potentially poses a high risk to the rights and freedoms of natural persons and, therefore, requires the conduct of a Data Protection Impact Assessment, in accordance with the relevant provisions of the GDPR.
At the same time, it notes that the operation of a CCTV system requires transparency and public notification, and for this reason, the posting of warning signs is mandatory.
“The signs must be placed before the entrance to the area being recorded, in conspicuous locations; they must be sufficient in number and clearly visible. They must, at a minimum, state that video recording is taking place, identify the data controller, and specify the purpose of the recording,” the announcement states.
The Authority notes that businesses are required to facilitate the public’s exercise of the rights granted by the GDPR, including, the right of access and the right to erasure of personal data, where applicable.
Source: CNA
