GDPR - Guidelines on processing of personal data through video devices
In July 2019, the European Data Protection Board (hereinafter referred to as 'the Board') issued Guidelines 3/2019 on the processing of personal data via video equipment (hereinafter referred to as 'the Guidelines')[1]. The Guidelines explain and specify the privacy requirements for video devices as imposed by the General Data Protection Regulation (GDPR) (hereinafter referred to as the 'GDPR Regulation').
At this time, only the Guidelines in the version for public consultation are available, to which it was possible to send comments Therefore, we are still expecting the final version of the Guidelines, but at the moment we are bringing you an initial outline.
In the introduction, the Guidelines determinate the scope of the GDPR in the field of video devices. Furthermore, the Guidelines specify under which circumstances the processing of the camera recordings is legal and under which is not. They also specify the rules for granting of subject’s consent to the personal data processing in the case of monitoring (e.g. in the work environment). The Guidelines also deal with the categorization of processed personal data and evaluation criteria related to the video devices.
Quite broadly, the Board focused its attention on the data subject’s rights and the responsibilities of the obliged subjects (especially controllers and the processors). Within this section, the Guidelines describe the technical requirements for the video devices, the deadlines for storing and deleting of the video records or personal data, the disclosure obligation, security requirements etc. The conclusion is devoted to the obligation of obliged subjects to assess the impact on the protection of personal data. It is also worth mentioning that the Guidelines are abundantly supplemented by practical examples.
We will follow further developments for you.