When is it allowed to use CCTV and what do you need to consider to make it legal?

Camera surveillance involves monitoring locations using surveillance cameras. This means that personal data is collected and therefore camera surveillance is a form of personal data processing. This is regulated in the Camera Surveillance Act (2018:1200), which supplements the General Data Protection Regulation(GDPR). The purpose of the Camera Surveillance Act is to fulfil the need for camera surveillance for legitimate purposes and to protect natural persons against unwarranted infringement of personal integrity in connection with such surveillance.

Do I need a licence for camera surveillance?

Section 7 of the Camera Surveillance Act states that camera surveillance of a place to which the public has access requires a licence if the surveillance is to be carried out by a public authority or by someone else performing a task of public interest. There are also a number of exceptions in Sections 9-10 of the Camera Surveillance Act for occasions when authorisation for camera surveillance is not required.

Private individuals who want to use camera surveillance themselves do not need to apply for a camera surveillance licence, as long as the camera surveillance complies with the requirements of the Camera Surveillance Act and the GDPR. It is what is captured on film that largely determines whether the surveillance is legal.

Companies wishing to use CCTV are not required to obtain a licence but must comply with the rules of the GDPR and the CCTV Act, unless they are performing a task of public interest in relation to the CCTV.

IMY is the supervisory authority responsible for monitoring compliance with the GDPR and the Camera Surveillance Act. Anyone who conducts camera surveillance must therefore comply with both the rules of the GDPR and the Camera Surveillance Act.

All camera surveillance, whether it requires authorisation under the Camera Surveillance Act or not, must comply with the requirements of the GDPR, which we will go through below.

Basic principles to follow

The controller needs to ensure that the surveillance complies with the basic principles of data processing. This means, among other things:

• lawfulness, fairness and transparency of processing - Article 5(1)(a) GDPR(lawfulness, fairness and transparency)
• the footage can only be used for the pre-determined purposes - Article 5(1)(b) GDPR (purpose limitation)
• no more than necessary to be captured by the camera - Article 5(1)(c) GDPR (data minimisation)
• that the material is not kept longer than necessary - Article 5(1)(e) GDPR (storage minimisation)
• the implementation of appropriate technical and organisational security measures - Article 5(1)(f) GDPR (appropriate security)
• the controller is responsible for compliance with the rules of the GDPR and must be able to demonstrate it - Article 5(2) GDPR (accountability)

Legal basis

A legal basis is required for processing to be lawful under the GDPR. In the case of CCTV, the legal basis may be that the processing is necessary for the performance of a task carried out in the public interest(Article 6(1)(e)), or that the need for the surveillance outweighs the interests or fundamental rights and freedoms of the data subjects after a balancing of interests(Article 6(1)(f)).

Things to consider for businesses planning camera surveillance (checklist):

The following points will be covered later in the post.

• Decide the purpose - why do you want to monitor?
• Identifying legal basis and balancing interests
• Customise the design of planned surveillance
• Limit the storage time
• Is there a licence requirement?
• Find out more about camera surveillance
• Protecting your data
• Show you're doing the right thing - document your personal data processing in your register
• Evaluate your camera surveillance regularly

Define the purpose - why do you want to monitor?

The purpose of surveillance can be, for example, for crime prevention or to prevent accidents. To determine whether the purposes are legitimate, you can determine the privacy interest and the surveillance interest and then balance them against each other.

Privacy concerns

Concerns the individuals who will be affected by camera surveillance. Here it is important to see what interest an individual has in not being camera monitored at the location in question.

The interest in surveillance

Concerns the controller and its needs for camera surveillance. The interests to be specifically considered are in brief:

• preventing, detecting or investigating crime
• prevent, avoid or detect disturbances to public order and security
• exercise control activities
• prevent, avoid or detect accidents or
• other similar purposes

Then weigh the interests against each other. If your assessment concludes that the interest in surveillance outweighs the interest in privacy for the processing of personal data after adaptations of the surveillance have been made to reduce the invasion of privacy, the surveillance is authorised. It is important to understand that this is a legal balancing act and that it is appropriate to seek expert advice. Contact us if you need support!

Customise your surveillance

Consider how you can customise the surveillance by reviewing the times at which the surveillance is carried out, the area to be covered, whether the surveillance should include audio and video or video only, whether masking of privacy-sensitive areas should be done, whether the material needs to be stored, and so on. If sound is included in the recording, the signage must contain special information about this (Section 15 of the Camera Surveillance Act).

Limit the storage time

The storage time of the recording must not be longer than necessary. Data must be deleted when it is no longer needed for the purpose. The retention period must also always be justified. If you want to store material for longer than 72 hours, a detailed justification is required. 1

Is there a licence requirement?

Public authorities and others performing a task of public interest must seek authorisation for CCTV. This applies if they are to carry out camera surveillance on a permanent or regular basis in a way that includes personal surveillance in a place to which the public has access.

However, the fact that surveillance is not subject to authorisation does not mean that it is automatically permitted; there are still requirements under the Camera Surveillance Act and GDPR that must be met.

If IMY initiates supervision against an operator that monitors places where the public does not have access, the person responsible for the surveillance must be able to demonstrate how it has made the assessment that the surveillance is legal and that it complies with other provisions of the GDPR.

Find out more about camera surveillance

Think about what information to provide and how to provide it. A sign stating the most important information and a reference to where in-depth information can be found must be clearly posted at the location, according to Section 15 of the Camera Surveillance Act. According to Articles 12 and 13 GDPR, the person conducting camera surveillance is obliged to provide certain information to those affected by the surveillance. The European Data Protection Board (EDPB) has produced an example of a sign that can be used to inform about camera surveillance. 2

Protecting your data

The material may need to be protected with encryption or other security solutions. This applies to both technical and organisational security measures. An example of organisational security measures is procedures for handling and restricting access to the film material.

Show you're doing it right - document your thinking

It is important to be able to show how you have planned your camera surveillance by documenting your assessments. This also makes it easier for those being monitored to obtain information. Documentation is also central to being able to show what trade-offs have been made, according to the principle of responsibility in the GDPR.

Evaluate your camera surveillance regularly

It is also important to continuously evaluate the need for camera surveillance to ensure that the legitimate basis still exists. If something has changed at the monitored location or if other circumstances have changed that affect camera surveillance, this needs to be addressed as soon as possible. 3

IMY's latest reviews of camera surveillance

Camera surveillance at fire stations

IMY's review of CCTV at a number of fire stations found that 24-hour surveillance of staff was excessive. The surveillance is said to have been carried out around the clock, even though it is only needed when an alarm is raised at the fire station in question. As the camera surveillance involved employees who were dependent on their employer, 24-hour surveillance was considered excessive. 4

CCTV in primary schools

The investigation was initiated after IMY received a complaint about a school that was using around 50 cameras for round-the-clock surveillance without informing students or parents about the surveillance. IMY's camera group has stated that children and adults who are in the school should have the right not to be monitored by cameras unless there is a surveillance interest that outweighs the privacy interest in the place. As it is also children who are being monitored, the privacy interest weighs heavily.

Since information must be provided to different target groups, such as children, it is also important to adapt the information to the different target groups so that the message reaches them clearly. IMY further noted that there is a legal basis for administering pupils' attendance at school, but that there is no explicit legal basis for performing the task through camera surveillance. 5

The facial recognition has been done by processing biometric personal data of children to uniquely identify their presence at school. Article 9(1) of the GDPR regulates that biometric personal data are so-called sensitive personal data. Biometric data means personal data collected through a specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which either enables or confirms the identification of that individual. This may include, for example, facial recognition or fingerprints.

If you are curious to read more about privacy-sensitive data, you can take a look here.

Executive summary

In summary, it is important to investigate whether authorisation is required for camera surveillance, to make careful assessments of the personal data processing that camera surveillance entails and to document how you intend to meet the requirements of the GDPR and any requirements in the Camera Surveillance Act. In addition, it is important not to forget to signpost properly!