NEW GUIDELINES 3/2019 ON THE PROCESSING OF PERSONAL DATA THROUGH VIDEO DEVICES
On January 29, 2020, the European Data Protection Board (EDPB) adopted new guidelines on the processing of personal data with video cameras. The EDPB gives direction to what is and what is not permitted under the GDPR. The EDPB also provides advice that you should pay attention to when using cameras. The most striking aspects of these guidelines are the handling of special personal data (including biometrics) and the notice on requirements for camera use. Let’s briefly discuss the new guidelines:
What is in Guidelines 3/2019 (Link)?
The EDPB states in the introduction that video surveillance should not become standard. If less radical means are available to achieve the underlying objective, camera use must be dispensed with. Otherwise, according to the EDPB, we risk privacy inflation: “a change in cultural norms that leads to the acceptance of a lack of privacy as a general principle.” In short, camera must be used with caution.
After the introduction, the EDPB briefly discuss the scope of application and the exception for household use. The legitimate interest of camera use is then described, and the advisory body briefly considers the balancing of interests that must always be made. This all sounds familiar but hang on…
Processing Special Categories of Data (And Biometrics) under the Guidelines
It becomes more exciting in Chapter 5. This concerns the processing of special categories of personal data. The basic principle of the GDPR is that these processing operations are prohibited unless…. The EDPB takes a clear position: video surveillance is not always considered as the processing of special categories of personal data. To give an example: video images that show a person involved in glasses or in a wheelchair are not considered to be special personal data in themselves. This is different if the images are used for the purpose of collecting special personal data, such as monitoring someone’s health.
This also applies to biometric data. The Guidelines state that: “the video footage of an individual cannot be considered as biometric data under Article 9 if it has not been specifically processed technically in order to contribute to the identification of an individual.” An interesting example that is mentioned here is the distinction between certain categories of people. According to the EDPB, if a retailer with a camera tries to tune his ads to specific target groups (men, women, the elderly), this is not the processing of biometric data.
Transparency and Information Obligation: two steps required under the new camera directive
Chapter 7 of the guidelines deals with an important subject for practice, namely transparency and information obligations with regard to camera use. The EDPB recommends a so-called “layered approach”. This means that the most important information must be displayed on a warning sign. That is the first layer. Further details can then be given with a second layer, such as a website. That system is not new in itself, but quite a few requirements are set for the content of the “first layer”.
The warning sign must be at eye level and must contain the most important information. This concerns “the details of the purposes of the processing, the identity of the controller, and the existence of the rights of the data subject, together with information about the greatest consequences of the processing. (…). It must also refer to the more detailed second information layer and where and how to find it. ”A good example of this is included in the guidelines (click to zoom the image):
Note: this example goes (much) further than the usual warning sign on which only an image of a camera is shown.
Further details must also be included in the second layer, such as a website or physical information sheet in a central location.
