Guidelines 3/2019 on processing of personal data through video devices

What it covers

These guidelines apply GDPR requirements to the processing of personal data through video devices, covering scope and the household exemption, lawful bases including legitimate interest and consent, disclosure of footage to third parties and law enforcement, processing of biometric data captured by cameras, data subject rights, layered transparency notices, storage periods and technical and organisational measures.

Why it matters

It is the primary reference for organisations deploying CCTV or smart camera systems to determine lawful basis, transparency and safeguards, including for biometric analytics such as facial recognition.

Refer to it when

• designing or auditing a CCTV or video surveillance deployment
• assessing whether the household exemption applies to a home camera
• evaluating the legal basis for smart cameras using biometric analytics
• drafting layered privacy notices for camera-monitored areas
• responding to erasure or objection requests concerning recorded footage

Questions this document addresses

• When does the household exemption apply to video surveillance?
• What legitimate interest balancing test applies to CCTV deployment?
• When does video-derived biometric data become a special category of data?
• What must the first and second layer of video surveillance notices contain?
• When is a DPIA required for a video surveillance system?

Topics

• Video surveillance
• Lawful basis
• Transparency
• Data subject rights
• Data protection by design