Camera surveillance on the street, in shops, businesses, homes and other locations is now a normal phenomenon.
Most of the time, the CCTV is announced, but sometimes it takes place in secret.
However, the law sets limits here.
Filming or photographing in a place accessible to the public is allowed, but the presence of cameras must be clearly communicated.
In confined spaces – such as at work – people may not be filmed.
This is only allowed if there is a good reason and no suitable alternative measure can be devised.
But even then, it must be announced explicitly.

Mandatory warning in case of camera surveillance

Filming in a public space without notice is prohibited and therefore punishable.
Public space includes all spaces open to the public, including private property such as shops, catering establishments, company car parks, casinos and swimming pools.
Visitors or passers-by of these open spaces must be able to know that they can be filmed.
Signs are often placed at the entrance announcing the camera surveillance.
Nowadays, many shops also install a confrontation monitor, directly after the entrance, on which the camera images are visible.
Others mount a camera that is clearly visible to every passer-by.
That, too, is enough to serve as an announcement.
Another way to communicate the camera surveillance is to communicate this on an invitation or ticket.

Data processing in camera surveillance

When camera surveillance is used, personal data is regularly processed.
Processing of personal data falls under the General Data Protection Regulation (GDPR).
The supervisory authority in the Netherlands is the Dutch Data Protection Authority.
Organisations no longer have to report the processing of personal data to the Dutch Data Protection Authority, but have a documentation obligation.
This means that, at the request of the Dutch Data Protection Authority, organisations must be able to demonstrate with documents (a register of processing operations) that they comply with the privacy regulations.
In addition, the Authority asks for the risks of said data processing to be identified and for appropriate measures to be taken.

Mandatory keeping of records (even if you already have an existing camera system!) As the owner of a camera system, you are obliged to keep a register of all activities in which personal data is processed since the introduction of the GDPR.
In any case, the following must be included in this register:

  • Contact details of the processing party
  • Purpose(s) of the processing of the personal data
  • A description of the category of persons whose personal data is processed (data subjects)
  • Recipients of personal data (third parties)
  • The period for which the data will be stored and deleted
  • A (general) description of security measures taken

Camera surveillance in confined spaces

Stricter rules apply to photography or filming in areas that are not ‘accessible to the public’, such as a house, garden or office.
Here, people expect to have privacy.
Filming or photography is prohibited unless this has been announced and no suitable alternative can be devised.
It doesn’t matter if the camera is hung up somewhere or held by someone.
The possession of a photograph or film that has been made in this prohibited way is therefore also prohibited.
A workplace is such a closed environment where filming or photography is not allowed.
The employer must inform employees about camera surveillance, for example via the company regulations or posted signs.

Hidden cameras

Only in very exceptional cases may hidden cameras be used.
Most of the time, these aim to catch employees in irregularities.
Three important criteria apply:

  1. The employer may only specifically film those employees who may be involved.
    So don’t preventively everyone.
  2. The employer must have notified in advance that hidden cameras may be used.
    He doesn’t have to say when they will be installed or where they will be hung.
  3. The use of hidden cameras must be proportionate.
    There should be no other options (such as detection gates at the staff exit) to deal with the irregularities.

The law is strict here, because surveillance with a hidden camera is a serious invasion of privacy.
You must therefore be able to show that you really have no choice but to introduce this far-reaching measure.
But even with ‘normal’ camera surveillance, the following applies: stick to the rules and make sure that you do not commit a crime yourself.

Use as evidence What if illegally obtained images show a crime (e.g. a burglary or theft)?
Many people think that these images are then unusable.
This is incorrect.
The Dutch police may simply use such images in the investigation of criminal offences, and an employer can also use such images in, for example, a dismissal procedure.
However, the creator of the images does run the risk of a fine or even imprisonment.
The police themselves, as a government agency, are not allowed to use images that have been unlawfully obtained by self-installed cameras.
This also applies to recordings from cameras that have been installed by citizens or a company at the request of the police.
Stricter rules apply to government organisations in this respect.

Whitepaper AVG