Video Surveillance in the Company

In previous articles we talked about the impact of video surveillance systems on the video surveillance systems have on our lives and on this occasion we will address the implications of video surveillance in the company, from the point of view of compliance with the Personal Data Protection Regulation.

What is meant by a video surveillance system?

A video surveillance system may comprise a number of cameras and a recorder where the captured images are stored.

Imaging can be performed in several ways:

Real-time playback without image recording
Continuous image recording
Recording at the request of the person in charge (the company)
Recording in case of intrusion

Security cameras can capture video images or photos.

These systems can be private or provided by expert and authorized providers (such as Securitas Direct or Prosegur), which usually include an alarm reception system.

Comply with the RGPD and the LOPD-GDD

Regardless of the type of images (video or photos) and the mode of capturing images (in real time or recording), the installation of a video surveillance system in a company (whether business or professional) involves complying with several obligations established in the European(RGPD) and Spanish(LOPD-GDD) data protection regulations.

The following are some of these obligations:

Register of Treatment Activities

Prior to the implementation of video surveillance systems, the corresponding Register of Processing Activities shall be prepared.

The use of video surveillance systems that are limited to a mere reproduction or emission of images in real time, without being recorded or stored, also requires setting up the recording of processing activities.

Location of cameras:

The capture of images in areas intended for workers’ rest and other harmful areas such as changing rooms, bathrooms/sanitary facilities shall be avoided.

Images of public spaces may not be obtained for security purposes, an activity that is reserved exclusively to the Security Forces and Corps, except for partial and limited images that are essential for surveillance or impossible to avoid.

If steerable and/or zoom cameras are used, privacy masks must be installed to avoid capturing images of public roads, land and homes of third parties.

Location of monitors:

The monitors where the camera images are displayed shall be located in a restricted access area, so that they are not accessible to third parties.

Image preservation:

The images will be kept for a maximum period of one month from their capture, after which they will be deleted.

The images used to report crimes or infractions shall accompany the report and must be kept in order to be handed over to the Security Forces and Corps or to the Courts and Tribunals that may require them. They may not be used for any other purpose.

Duty of information:

In all cases, the existence of a video surveillance system must be reported. For this purpose, a sufficiently visible sign shall be placed at the entrances to the video-surveilled areas, clearly indicating the identity of the person responsible for the installation, to whom and where to contact to exercise the rights provided for in the data protection regulations, and where to obtain further information on the processing of personal data.

Access control:

Employees who have access to the images shall be informed of their security obligations (reserve, confidentiality and secrecy) and of their duty to maintain secrecy. These obligations will be included in the Data Protection Manual for Personnel and will be signed by all of them.

The recording system shall be located in a guarded or restricted access location. Access to the recorded images shall be restricted to authorized persons only, who shall enter a user code and password.

If the access to the images is done through Internet connection, it will be restricted with a user code and a password (or means that guarantees the identification and reliable authentication), which will be of exclusive knowledge of the person who can access such images.

Once the system is installed, it is recommended to change the strong password.

If this service is outsourced, it will be to expert and authorized suppliers for this purpose, with whom the corresponding contract will be signed. processor contract will be signed..

Labor control:

When the cameras are to be used for the purpose of labor control as provided for in Article 20.3 of the Workers’ Statute, all personnel and union representatives shall be informed in writing of the control measures established, expressly indicating the purpose of labor control of the images captured by the cameras. This information shall be included in the Data Protection Clauses and Manuals to be signed by the employees. This documentation shall be delivered personally, and shall never be sent to workers’ private addresses or calls to their private cell phones.

The Workers’ Statute empowers the employer to adopt the measures it deems most appropriate to verify the employee’s compliance with his or her labor obligations and duties, which must take due consideration of human dignity and take into account the actual capacity of workers with disabilities.

Video surveillance systems for business control shall only be adopted when there is a relationship of proportionality between the purpose pursued and the way in which the images are processed and there is no other more suitable measure.

The right to privacy and self-image of employees shall be taken into account. Private conversations shall not be recorded.

Image rights:

In order to comply with the interested parties’ right of access, a recent photograph and the National Identity Document of the interested party will be requested, as well as details of the date and time to which the right of access refers.

The data subject shall not be provided with direct access to camera images in which images of third parties are displayed. If it is not possible for the data subject to view the images without showing images of third parties, a document confirming or denying the existence of images of the data subject shall be provided to the data subject.

Other rights other rights established in the Personal Data Protection Regulations, in due time and form.

Handing over of images to the Security Forces and Corps

The request for images by the Security Forces and Corps will be made within the framework of judicial or police actions and the request to the company will be the document that will justify the transfer of data to them or to the Courts and Tribunals that require it.

Expert help to comply with the RGPD and the LOPD-GDD

What is detailed above is part of the obligations, but Business Adapter® data protection will integrate what is exposed and remaining in the Security Policies of your entity.

We will also be able to elaborate your company:

Treatment Activity Record(RAT)
Data protection manuals for personnel
Video Surveillance Signs

[su_button url=”https://businessadapter.es/contacto” target=”blank” background=”#f6f903″ color=”#181818″ size=”7″ center=”yes” icon_color=”#000000″]Ask for help. It will be a pleasure to assist you [/su_button]