Municipal authorities must conduct a Data Protection Impact Assessment (DPIA) and submit it to the Commissioner for Personal Data Protection for prior consultation and approval before installing CCTV cameras in parks and other public spaces, Data Protection Commissioner Maria Christofidou has said.
In a statement on Monday, issued amid public discussion over the installation of video surveillance systems by municipal authorities, Christofidou clarified the rules governing CCTV cameras in public areas.
CCTV use must be necessary and proportionate
The Commissioner said the installation of CCTV cameras in public spaces falls within municipalities’ responsibilities for security and civil protection.
Under the Municipalities Law, such systems may be used to prevent vandalism, fires and environmental risks, provided that municipalities comply with the General Data Protection Regulation (GDPR) and applicable national legislation.
The installation and operation of CCTV cameras can constitute a legitimate measure, provided they are necessary and proportionate to the specific purpose and include appropriate safeguards for personal data protection.
As part of the DPIA, municipalities must assess, among other issues, whether the intended objective could be achieved effectively through less intrusive means.
Limits on camera coverage and data retention
Where CCTV cameras are deemed necessary, their recording range should be limited to what is strictly required.
This is intended to minimise, as far as possible, the unjustified recording of people or areas unrelated to the stated purpose.
The retention period for recorded material, the people authorised to access it, and the technical and organisational security measures must also be determined according to the specific purpose and circumstances of each case.
Citizens must be informed
The Commissioner stressed that citizens must receive appropriate information about the operation of CCTV systems and the processing of their personal data.
Several DPIAs submitted by municipal authorities are currently under assessment by the Commissioner as part of the prior consultation process.
Christofidou called on municipalities planning to install CCTV cameras to carry out the required DPIA and submit it to the Commissioner in line with their obligations under the GDPR.
She concluded that personal data protection does not prevent the installation of such systems, but requires them to be designed and operated lawfully, necessarily and proportionately, while respecting citizens’ fundamental rights.
Also read: New rules introduced for work on digital platforms
For more videos and updates, check out our YouTube channel
