New methodology on CCTV systems brings clarity on the processing of personal data
In early February, the Office for Personal Data Protection published a new methodology on CCTV systemswhich aims to contribute to a clearer interpretation of certain obligations in the area of processing of personal data by CCTV systems (including photo traps). We will describe how to proceed if you are setting up a CCTV system.
First of all, it is necessary to determine whether personal data is being processed by means of the image size level (as defined by the standard ČSN EN 6267-4 Surveillance systems for use in security applications). If the figure in the frame occupies more than 25% of the image height, or if less than 40 mm of the real height of the figure per pixel (the values are derived from the PAL system), personal data is being processed. In such a case, a so-called four-step balance test must be performed, which must be included in the documentation of the camera system.
Balance test
First step – the real threat criterion
The first step is to describe the existence of a real threat that the proposed solution options are intended to prevent. This can be demonstrated, for example, by statistical data on incidents in the monitored area (accidents, thefts), the statistical frequency of imminent danger in similar types of objects (robbery of petrol stations) or incidents involving public transport (on certain routes, at certain times, etc.). The existence of a reason is regularly assessed.
Second step – the need criterion
The second step is to assess the achievement of the purpose by other means (the criterion of necessity). The options under consideration are compared, specifically taking into account how they interfere with privacy, the extent to which they secure the defined purpose and their costs and benefits. In the case of CCTV options, the following are typically considered:
the use of means other than camera systems (e.g. dummy cameras, speed cameras),
taking into account the existing variant,
the number and location of cameras (what is the necessary number),
the setting of the cameras (rotation of the camera, blurring of part of the frame if it captures e.g.
The individual options are compared with the existing solution and the result is a ranking of the options in terms of costs, benefits and privacy intrusion. The best option is selected.
Third step – suitability criterion
The third step assesses whether it is necessary and beneficial (appropriateness criterion). Three analyses are carried out – (a) non-financial benefits, (b) financial benefits and damages, and (c) payback of the solution. Should any of the analyses end up with a negative result, the implementation is not beneficial and such an option is not suitable – then another option is assessed.
Step 4 – Measurement criterion
The final step is to assess proportionality (the balancing criterion), i.e. whether the public interest outweighs the infringement of the rights, freedoms and interests of the data subject.
The process of the balancing test sounds very complex, but in principle it is “only” about determining the purpose of the measure and justifying which option and why it is the most appropriate (or that such a placement of cameras best achieves the stated purpose).
This article is for informational purposes only and does not constitute legal advice or guidance for any particular case.
If you would like more information in this regard, please do not hesitate to contact us.