Municipalities may install CCTV systems in parks and other public spaces to prevent vandalism, fires and environmental risks, provided their use is necessary, proportionate and compliant with data protection law.
Commissioner for Personal Data Protection Maria Christofidou said municipal authorities must first carry out a data protection impact assessment (DPIA) and submit it to the Data Protection Authority for prior consultation and approval.
Legal basis for CCTV systems
In a statement on Monday, issued amid public debate over the installation of surveillance systems by municipalities, Christofidou clarified that CCTV in public spaces falls within their responsibilities for security and civil protection.
Under the Municipalities Law, CCTV may be used to prevent vandalism, fires and environmental risks, provided the General Data Protection Regulation and applicable national legislation are observed.
The installation and operation of CCTV may therefore constitute a legitimate measure, but only when it is necessary and proportionate to the intended purpose and accompanied by appropriate safeguards for personal data.
Less intrusive measures must be considered
As part of the DPIA, municipal authorities must assess whether the intended objective could be achieved effectively through less intrusive measures.
Where CCTV is considered necessary, the cameras’ field of view must be limited to what is strictly required. Unjustified recording of individuals or areas unrelated to the intended purpose should be avoided wherever possible.
The period for which footage is retained, the people authorised to access it, and the technical and organisational security measures applied must be determined according to the purpose and circumstances of each case.
Municipalities must inform the public
Municipalities must also ensure that citizens are properly informed about the operation of CCTV systems and the processing of their personal data.
Christofidou said DPIAs submitted by municipal authorities are currently being assessed by her office as part of the prior consultation process.
She called on municipalities planning to install CCTV systems to conduct and submit the required assessment in accordance with their obligations under the GDPR.
The commissioner stressed that protecting personal data does not prevent the installation of such systems. However, they must be designed and operated lawfully, necessarily and proportionately, while respecting citizens’ fundamental rights.
Source: CNA
