The installation of video surveillance systems is constantly increasing every year. Through video surveillance, personal data is processed, i.e. data relating to an identified person or a person who can be identified, directly or indirectly, especially on the basis of one or more features specific to his physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. As the number of installed cameras increases, so does the freedom of movement and behavior of people and their privacy. Particular attention should be paid to the video surveillance of workplaces.
Before starting the process of establishing a video surveillance system, the controller is obliged to make an analysis of the purpose, that is, the goals for which the video surveillance is being set up . The analysis contains the reasons for setting up the video surveillance with an explanation of the need to fulfill the purpose, i.e. the goals in accordance with the provisions of the Law on the Protection of Personal Data, as well as a description of the immovable and movable objects, i.e. the space that will be protected by the installation of the video surveillance.
The controller can carry out video surveillance in his official or business premises if it is necessary for:
- protection of human life and health
- protection of property
- protection of the life and health of employees due to the nature of the work or
- providing control over entry and exit from official or business premises for security purposes only
The controller can perform video surveillance only on the space that is sufficient to fulfill the objectives for which it was set . This means that if video surveillance is installed for the purpose of property protection or control over entry and exit from the official or business premises only for security purposes, the goal will be achieved by placing the cameras only at the entrances of the building, and not in the corridors, meeting rooms meetings, offices, classrooms, halls, etc. Whenever video surveillance is installed, the right to privacy of employees, customers, pupils, students, patients, buyers and other categories of personal data subjects should be respected.
The employer must respect the principle of proportionality in relation to the purpose for which the video surveillance is installed. Employees have the right to know where and when they are recorded, that is, the controller must inform them about video surveillance in official or business premises.
It is forbidden to carry out video surveillance in wardrobes, changing rooms, sanitary units and other similar rooms.
The subject of personal data should be informed when and which data are processed for him. Accordingly, the objects that are under video surveillance should be marked with a notice that video surveillance is being carried out . The notification should be clear, placed in a visible place and displayed in a way that will allow the subjects of personal data to know that video surveillance is being carried out. The notification should contain information that video surveillance is being carried out, about who is doing the video surveillance (controller’s name), how information can be obtained about where and for how long the recordings from the video surveillance system are kept.
The controller is obliged to periodically evaluate the results achieved by the video surveillance system every two years, and in particular for:
- the further need to use the video surveillance system
- the purpose, i.e. the purposes for performing video surveillance and
- the possible technical solutions for replacing the video surveillance system
From the performed periodic assessment, the controller is obliged to prepare a report as an integral part of the documentation for the establishment of the video surveillance system.
The recordings made during video surveillance are kept until the objectives for which it is carried out are fulfilled, but not longer than 30 days , unless a longer period is provided by another law. Video surveillance recordings can be kept longer than the specified period if another law provides for a longer period that includes protective measures and other measures to protect the rights and freedoms of the subjects of the personal data, but not longer until the purpose is fulfilled, i.e. the goals. Also, video surveillance recordings can be kept for longer than 30 days, when it is necessary to realize the controller’s legitimate interest in conducting appropriate procedures in accordance with the law, for which the controller establishes internal rules for the method of storing and deleting the recordings.
The recordings made by video surveillance can be given to users only in accordance with the rules established in the Law on Personal Data Protection.
In cases where the controller performs processing of personal data using systematic observation (monitoring) of a publicly available space on a large scale, he is obliged to perform an assessment of the impact on the protection of personal data.
The controller is obliged to arrange the method of performing video surveillance with a special act (Regulations on the method of performing video surveillance).
In the act on the method of conducting video surveillance, the controller must determine the technical and organizational measures to ensure the security of the processing of personal data through the system for conducting video surveillance, in accordance with the provisions of The regulation on the security of personal data processing, giving a description of the technical and organizational measures taken. The controller should apply technical measures in order to prevent remote access to the video surveillance system.
In the act on the method of performing video surveillance, the controller also prescribes the method of exercising the rights of the subjects of personal data whose data is processed through the video surveillance system, i.e. the method of providing transparent information, communication and ways of exercising the rights of the subject of personal data, information and access to personal data, exercise of the right to correction and deletion, exercise of the right to object and automated adoption of individual decisions, in accordance with the Law on Protection of Personal Data.
In order to exercise the rights of the subjects of personal data, the controller adopts and publishes a Privacy Statement, which is an integral part of the act on the way of performing video surveillance of the controller.
