Taking Videos and GDPR Implications: General Rules

The use of CCTV for image capture in Cyprus is permissible only when no less intrusive means are available to achieve the intended purpose. It is crucial that these systems are not used to monitor personal behavior, contacts, or performance of individuals. The Commissioner’s recent guidance (24/04/2024) reinforces that employee consent in that respect is not valid due to the inherent power imbalance between employers and employees.

Under Article 6 of the GDPR, data processing is lawful only if at least one of the following conditions is met:

• The data subject has given consent for specific purposes.
• Processing is necessary for the performance of a contract with the data subject.
• Processing is required for compliance with a legal obligation.
• Processing is necessary to protect the vital interests of the data subject or another person.
• Processing is necessary for performing a task in the public interest or exercising official authority.
• Processing is necessary for the legitimate interests of the controller or a third party, provided these interests do not override the rights and freedoms of the data subject, especially if the data subject is a child.

Taking Videos and GDPR Implications: Dash Cams

In Cyprus, there is currently no specific legislative framework governing the use of dash cams. According to the Commissioner’s instructions (09/09/2019), the legal basis for processing (including collection, use, storage, and sharing) images and/or audio from dash cams is the prior consent of the affected individuals. Without this consent, such processing violates GDPR principles of legality, purpose limitation, and data minimization. This is because it lacks a legal basis, is not collected for specified lawful purposes, and involves excessive data collection.

The primary concern with dash cams is that they often record footage in public spaces where individuals may not be aware that they are being recorded. This raises significant privacy issues, especially when the recorded data includes other individuals who have not consented to being recorded. Therefore, it is crucial to obtain explicit consent from all parties involved or ensure that the use of dash cams adheres to the principles of necessity and proportionality as required by GDPR.

Taking Videos and GDPR Implications: CCTV in Public Spaces

The legality of using CCTV in businesses and shops in Cyprus hinges on compliance with GDPR and Law 125(I)/2018. According to the Commissioner’s guidance, it is permissible to use CCTV at:

• Building entrances/exits
• Outside elevators (focused solely on the elevator)
• Above card/cash machines
• Parking lots

However, it is not permissible to use CCTV in:

• Corridors
• Inside elevators
• Waiting areas
• Restrooms
• Dining areas in cafes or restaurants

To ensure compliance, warning signs must be prominently displayed to inform individuals that they are being recorded. These signs should indicate the presence of CCTV, identify the data controller, and state the purpose of the recording. Additionally, data subjects have the right to access their recorded data. The retention period for recorded data should be limited to what is necessary for the stated purpose. In cases where CCTV installation poses a high risk to individual rights and freedoms, a Data Protection Impact Assessment (DPIA) is required before implementation (see below).

Taking Videos and GDPR Implications: CCTV in Private Premises

The installation of CCTV in private premises, such as homes or apartment buildings, for personal or domestic activities does not fall under personal data protection laws in Cyprus, provided the surveillance does not extend beyond the private space’s perimeter.

In apartment buildings, it is essential to ensure that CCTV use by one tenant does not infringe on the privacy of others within the building. In private premises, the primary purpose of CCTV is usually for security. It is important to balance the need for security with the privacy rights of individuals. This means ensuring that the surveillance system is focused only on the private property and does not capture footage beyond its boundaries.

Taking Videos and GDPR Implications: Recording of Sound

Recording audio data (conversations) is highly invasive and generally prohibited. Individuals have reasonable expectations that their conversations will not be recorded. The Commissioner has determined that recording both image and sound is excessive for achieving the stated purposes of the controller. This decision is consistent with those of other European Data Protection Authorities.

Audio recording is considered more intrusive than video recording because it captures private conversations that individuals expect to remain confidential. Therefore, the general rule is to avoid recording sound.

Taking Videos and GDPR Implications: Conducting a DPIA

A Data Protection Impact Assessment (DPIA) is mandatory under the GDPR for projects likely to involve a high risk to personal data. This assessment identifies and minimizes risks to individuals' rights and freedoms. It should be completed before starting any data processing activity, ideally during the planning stages. Consultation with key stakeholders is essential throughout the DPIA process.

According to GDPR regulations, a DPIA must be conducted whenever a type of processing, particularly one involving new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. The DPIA helps organizations understand the potential impacts of their data processing activities and implement measures to mitigate those risks.

Taking Videos and GDPR Implications: Best Practices

To ensure GDPR compliance when using video surveillance in Cyprus, organizations should follow these best practices:

1. Ensure that people are aware they are being recorded by posting visible signs indicating the presence of CCTV. The signs should briefly explain the reason for the recording, identify the data controller, and provide contact information for further inquiries.
2. As recording audio is highly invasive, it is generally prohibited.
3. Store recorded footage in a secure location and restrict access to authorized personnel only. Implement robust security measures to protect the data from unauthorized access, alteration, or deletion.
4. Keep recorded data for a period that is reasonable and necessary for the purpose it serves. Establish clear policies for data retention and ensure that data is deleted once it is no longer needed.
5. Enable individuals to exercise their rights under GDPR, such as the right to access their data, request rectification, and seek erasure. Ensure that procedures are in place to handle such requests promptly and efficiently.
6. Regularly review and assess your video surveillance practices to ensure ongoing compliance with GDPR. This includes updating your DPIA as needed and addressing any new risks that may arise.
7. If your organization has a Data Protection Officer (DPO), involve them in all stages of planning and implementing video surveillance systems. The DPO can provide valuable guidance on compliance and help ensure that privacy risks are adequately addressed.

Taking Videos and GDPR Implications: Conclusion

Video surveillance in Cyprus must comply with the stringent requirements of the GDPR and national legislation. This includes ensuring that the video surveillance is necessary and proportionate. Organizations must be transparent about their surveillance practices, protect the privacy rights of individuals, and implement robust security measures to safeguard personal data.