The use of video surveillance systems in buildings and outdoor areas, both by public bodies and private individuals, is nowadays very widespread: for example, banks, hotels, shops, etc., install video surveillance systems in order to protect their customers, their staff and their premises. Video surveillance is undoubtedly a preventive measure, especially if it is implemented with the right design. On the other hand, however, it has an impact on the behaviour of individuals, as someone who knows that he or she is being monitored may adjust his or her behaviour and may even be subject to psychological pressure. It is therefore necessary, in order to safeguard the fundamental right to the protection of personal data and privacy, to ensure that the above-mentioned systems operate correctly and not abusively: in other words, these systems should be used only when absolutely necessary and only when the intended purpose cannot be achieved by milder means (principle of proportionality – Article 4 of Law no.
In recent years, the Authority has received a significant number of questions and complaints about the legality of video surveillance systems and has examined many cases of their operation.
What we mean by video surveillance systems
Video surveillance systems are those systems that are permanently installed in a room and have the ability to capture and/or transmit images and/or sound to projection screens or recording machines (where cameras can be connected to the screen or recording machine either directly or via network/internet). The most common case of a system is closed circuit television. As long as a video surveillance system receives images of persons (regardless of whether the system is in permanent operation or not), personal data is processed. It should be noted in particular that even the mere taking of an image, without recording, also constitutes processing of personal data (and therefore does not exempt the controller of such processing from its obligations towards the Authority, as described below in the section ‘Information on controllers’). Please note that hand-held cameras, cameras, mobile phone devices, and intercoms/door phones that are activated by the action of the entrant and do not record are not considered video surveillance systems: therefore, the content of this section on video surveillance systems does not cover photography/videotaping carried out with these systems. What about surveillance cameras in public places or on pavements? Is it legal to install and operate them? Are you aware that you can ask a shop that has a camera on the outside of its premises to show you the image it recorded or find out exactly which premises it is monitoring and why? These are just a few of the questions that may be on the minds of citizens or which may arise from the ever-increasing number of electronic video and audio recording systems that are also used in our country, either by businesses or individuals. Surveillance cameras are not allowed in shops or houses that ‘see’ on pavements and other public areas, cameras in entertainment-dining establishments that ‘see’ customers, cameras in changing rooms, cameras that monitor employees, etc. are not allowed. The Data Protection Authority handles thousands of cases every year, concerning this issue, while answering to anyone who is interested, around the existing case law. It is noteworthy that in 2014 alone, the total number of handled cases of appeals/complaints, queries and notifications of files and processing by the Authority amounted to 3,015, showing a significant increase of about 20% compared to the corresponding number of the previous year. In 202 cases, the examination of the cases was concluded with a decision by the Plenary or the Division. The Authority also issued 5 opinions in 2014.
Read below, the 5 questions and the answers given by the Data Protection Authority
These are 2 different cases. a) Video surveillance systems used for the protection of persons and property (i.e. security) are regulated by Directive 1/2011 of the Authority. As to the number of systems not declared to the Authority, there is no estimate. It should be noted that the notification system has been found (at EU level) to be ineffective and is being phased out with the new General Data Protection Regulation which is expected to be implemented across the EU in about 2 years. Instead, other solutions are preferred, such as more complete written documentation and prior consultation with the Authority in case of critical processing. b) The chat recording systems operate on the basis of the provision of Art. 4 par. 3 of Law no. 3471/2006 (“The recording of conversations and related traffic data is permitted when carried out in the course of a legitimate business practice for the purpose of providing evidence of a commercial transaction or other communication of a business nature, provided that both parties, after prior notification of the purpose of the recording, give their consent…”). In the typical case, the recording of conversations between customers/suppliers and companies does not require notification to the Authority (see Art. 7A of Law 2472/19
2) Especially in recent years, there has been an overabundance of cameras placed in public and public places, such as sidewalks, entrances to apartment buildings, porches, shops and even entertainment centres. Is it legal to install and use them? Does the Authority receive frequent complaints – reports of possible infringements of the legislation?
Their use for the protection of persons and property may be lawful under certain conditions, depending on the specific circumstances. See. and art. 6, 15, 19 of the Authority’s Directive 1/2011. The installation of cameras in public places is, in principle, only allowed by public authorities, for the purposes and under the conditions specified in Article 14 of the
ν. (e.g. prevention and/or prosecution of serious crime, national security, traffic regulation). It should be noted in particular that, as a general rule, the installation of cameras in a public place by a private person for the purpose of protecting persons and property is not allowed (such installation may be allowed only in exceptional cases and under specific conditions – see Article 6 of Directive 1/2011). The Authority receives several such complaints. An examination of the complaints submitted reveals that the majority of them relate to complaints about the installation of video surveillance systems by neighbours, in single-family houses and apartment buildings. In many of these cases the parties involved have other types of disputes between themselves. The second important category of cases concerns complaints about the use of video surveillance systems in workplaces.
3) If a citizen notices a camera in the area where he or she is moving and believes it is being recorded, does he or she have the right to ask the owner of the camera if he or she has a permit, or if he or she has notified the Authority of its use? Can he or she ask to see the contents of the videos being recorded, and is the owner required to show them?
Yes. Personal data legislation provides for the right of access, which is exactly the case. See Article 13 of Directive 1/2011. Special note that no authorisation from the Authority is required to operate cameras, only notification. Permits are only issued for sensitive personal data (which, as a rule, does not include a person’s image).
4) In recent years, electronic news media such as websites, web-tv, where journalists and photographers, as in the “traditional” media, record photos and videos in public places to cover reports on various issues, have increased significantly. Does the issue of personal data arise with persons appearing in such material? Does a citizen who believes he or she was recorded and does not wish to do so have the right to review the material or request that the material be deleted?
The use of image capture systems for purposes other than the protection of persons and property is treated differently (not by Directive 1/2011) and depending on the intended purpose. Even if personal data is at stake, rights such as freedom of the press and public information (in the case of journalists) must be weighed against each other. Of course, citizens retain the right to request that their image not be included in such downloads, but this should be weighed in the first instance by the data controller (journalist – newspaper).
5) Telephone conversations and recording – Private companies such as banks, collection agencies, telephone companies, etc., often call citizens stating that their call is being recorded. Can the citizen refuse the recording? When a citizen calls such a company and hears a recorded message that the call is being recorded, before even speaking to a company representative, is it legal? Does a citizen have the right to record his or her phone calls by informing the person on the other end of the line?
As mentioned in question 1, this is specifically regulated by Art. 4 par. 3 of Law no. 3471/2006, while there is a special regulation for debtors’ information companies, which are obliged by law to record their conversations. In other cases (except for debtor companies) it is important to note that a) recording is only allowed to prove a transaction or a communication of a business nature (this may include calls to satisfy an existing customer relationship, e.g. for questions to the support department of a company) and b) there must be notification prior to recording. If someone does not consent to the recording of the call, they simply hang up the phone, but should contact the company in another way (in person) if it is a transaction. However, if a conversation is recorded that does not concern business communication, then it may be an unlawful action, so the citizen can object (right to object – Art. 2472/1997) and, if not satisfied, may appeal to the Authority. As far as the registration on the part of the citizen is concerned, exactly the same applies. However, an easy tool for the citizen is to exercise the right of access (Article 13 of Law 2472/1997) to find out from the recording company what it has recorded about him/her and possibly request a copy.
Operation of video surveillance systems for the protection of persons and property
In order to regulate the use of video surveillance systems for the protection of persons and property, the Authority issued the Directive 1/2011 (which replaced the previous relevant Directive 1122/2000), concerning the operation of such systems installed by all types of public bodies or natural or legal persons in premises managed by them. The same directive also regulates the use of video surveillance systems for the purpose of providing health services (in this case, which is essentially a specific case of protection of persons, only natural or legal persons active in the health sector and bound by a special professional secrecy – e.g. doctors, nursing staff). Consequently, with this Directive, everyone can now know what conditions must be met in order for these systems installed for these purposes to operate legally. It is expressly noted that the operation of video surveillance systems for purposes such as monitoring workers for the purpose of their control/evaluation or for the purpose of training them is not permitted.
Frequently Asked Questions about Video Surveillance Systems
1. I want to install a video surveillance system. Am I obliged to submit a notification to the Authority?
Yes, under the article 6 of Law no. 2472/1997 (unless the system is receiving and/or recording an image from your exclusively private, non-working place – e.g. inside your home – in which case you do not need to submit a notification). Failure to notify may result in both administrative and criminal penalties, as provided for in Articles 20 and 22 of the Act. 2472/1997. You must also notify the Authority of any changes to your system (e.g. addition/removal/relocation of cameras).
2. I want to install cameras in my house for security reasons. Is it allowed and under what conditions?
If the cameras are only recording your private space, then the personal data legislation does not apply, so you do not have any obligations under it (e.g. you do not have to submit a notification). However, please note that it is prohibited to take a picture from outside public space (e.g. a street or pavement), as well as from neighbouring buildings (see also Article 3 of Directive 1/2011). Attention! Any other non-domestic use of the recorded material, except for transmission to the competent authorities (e.g. Police, Courts) in the event of an incident, entails the application of personal data legislation and is in principle not allowed. Taking images of side streets or pavements can only be justified in exceptional cases, i.e. where there has been a previous dangerous attack on life and property and there are now reasonable grounds to suspect that more may take place. In such cases, the recording must be limited to the strictly necessary incidental space – see Article 6 of Directive 1/2011. Moreover, in this case, you are considered a controller, therefore, with regard to external cameras you have all the relevant obligations (e.g. notification, information sign, satisfaction of access and objection rights).
3. I live in an apartment in a block of flats and I want to install cameras for security reasons. Where are they allowed? Can I install a camera to monitor the area in front of my front door?
A) You can place cameras that take a picture inside your apartment (but under no circumstances can they take a picture outside your private space – e.g. a camera on the balcony that takes a picture of a public street is not allowed). B) You can install a camera that monitors the absolutely necessary area of your entrance, without recording any images or sound (e.g. to see who rings your doorbell). C) You can install a camera with image recording (in no case audio) and considered as a domestic use (so, as in case B, it will not fall under the personal data legislation), when it is technically feasible to limit the camera’s range to the absolutely necessary space in front of your apartment entrance door, without affecting other apartments in any way. In this case: C1) no image should be taken from other public areas and C2) depending on the positioning of the entrances to the floor apartments and the lift, the entrance to other apartments or the passage to them should not be affected (monitored, even if only incidentally). In the above three cases, the use of cameras is considered as domestic and does not fall under the personal data legislation. For details, see the opinion 5/2017 and read the next question. You can also install a camera in a shared parking space for surveillance of your vehicle if your apartment building does not have such a system. However, for this, the other tenants must be consulted, the camera must focus exclusively on your vehicle and you must place clearly visible signs (see in detail article 15(4) of Directive 1/2011). For this treatment, you must submit a notification to the Authority.
4. The positioning of the doors of the apartments on the floor where I live is such that some residents may pass in front of the door of my apartment. How can I install a camera with image recording to control my entrance?
In this case, before proceeding with the installation of a camera, you should obtain the consent of the floor occupants living in the affected apartments, after providing them with all relevant information on how you intend to operate the camera. In principle, the apartments on the same floor as yours are considered to be affected, except for those to which access, due to the positioning of the doors, does not require passage through the monitored area of the entrance to your apartment. When unanimity cannot be reached, the procedure of Art. 15 par. 1 of Directive 1/2011, i.e. there must be a prior agreement of 2/3 of the occupants of the affected apartments on the floor. One vote per occupied (or used) affected apartment is taken into account for the formation of the consent. In the above case, you are considered a controller for the installation of the camera and therefore have all the obligations under the Act. 2472/1997 and Directive 1/2011, such as submitting a notification to the Authority, satisfying the rights of information, access and objection of the data subjects, respect of privacy and security of processing. Example: In the following floor plan of a corridor, the occupant of apartment A, who wishes to install a camera at his entrance, must obtain the consent of the occupants located in the apartments in orange (B and F).
The door of compartment B is completely adjacent to that of A, and it is extremely difficult for people entering compartment B not to get a picture. Anyone wishing to enter compartment F must necessarily pass in front of compartment A. Conversely, to enter compartments C, D and E, one does not have to pass through A.
5. If I have a shop or office on a floor of a block of flats, can I install a camera to monitor my entrance?
The same applies as in question 4 for residences, noting that in this case the personal data legislation always applies and you are always considered a data controller. Therefore, you can install, a camera without image recording or a camera with recording (always without sound) when you are limited to the absolutely necessary space of your own entrance and no other apartments are affected. If other apartments are affected, you must obtain the consent of their occupants as described above.
6. Is unanimous consent of the residents required for the installation of a video surveillance system in common areas of a condominium?
According to Directive 1/2011, a decision is required by the body responsible for the management of the building (e.g. General Assembly of owners, as defined in the regulations of the building, with percentages per property, etc.). If the regulations of the block of flats already provide for the installation of the video surveillance system, then simply follow what is laid down in the regulations.
If the regulations do not provide for the installation, in addition to the decision of the competent body, the following is required a co-decision of 2/3 of the residents. This means that the tenants will only express an opinion on whether or not they want the video surveillance system to operate. It should be noted that each (occupied) apartment is entitled to one vote. In the case of a positive opinion, the General Assembly of the block of flats is given the opportunity to decide on the installation. Examples. Then a video surveillance system cannot be installed.
b) The general assembly of the apartment building votes 55% in favour of the installation, and more than 2/3 of the residents want the installation. In this case, a video surveillance system can be installed (as long as in the regulations decisions on such matters are taken by a majority of 50% + 1).
7. I have a commercial shop. Where can I place cameras?
You can place cameras at entry/exit points (but without taking a picture of a public place), at cash registers and cash boxes, in warehouses, as well as in parking lots and electrical installations. For very large shops or where goods of high value are handled, cameras can also be installed in areas where customers are moving around, provided that this is absolutely necessary in this case, the angle of view should be such that it focuses as little as possible on people, and shots from as wide an angle of view as possible should be preferred. (see also Article 19 of Directive 1/2011). In any case, it is not allowed to place cameras in areas where staff are working and customers do not have access, or in offices of employees (see also Article 7 of Directive 1/2011).
8. I have a restaurant/bar. Where can I place cameras and where can I not?
The same applies as in the above question. In particular, however, please note that you are not allowed to record places of assembly or recreation/entertainment (tables, seats, dance floor). Regarding the bar, camera is only allowed above the cash register and focus on it. It is also prohibited to place cameras in the kitchen or other areas where only employees move around (see also Article 19 of Directive 1/2011).
9. What is considered a public space? Are cameras allowed in such places?
Public spaces are those that are intended for public use according to the current urban planning legislation and the Civil Code, e.g. roads, squares, groves, parks, seashore, beach, harbours, lakes and rivers, public forests. Furthermore, any other area which is open and freely accessible to an unspecified number of persons and which has been put into common use in any legal way (e.g. building permit) is also considered a public area. The latter may include large shopping centres, special parks, recreational areas, etc. Finally, public spaces also include public transport passenger stations, such as metro stations, airport passenger buildings, etc., i.e. spaces which are accessible to an unlimited number of people, but which may also be closed and access to which is controlled. The installation of cameras in public places is, in principle, permitted only by public authorities, for the purposes and under the conditions specified in Article 14 of
ν. 3917/2011 . It is particularly noted that, as a general rule, the installation of cameras in a public place by a private person for the purpose of protecting persons and property is not allowed (such installation may be allowed only in exceptional cases and under specific conditions – see Article 6 of Directive 1/2011).
10. Can I place cameras outside my business in a public place?
No – it is not allowed to take an image from side streets and/or sidewalks (see also the previous question). Only in exceptional circumstances may such a capture be allowed due to the “nature” of the site (e.g. government buildings, large hotels, bank ATM machines) or where incidents have occurred in the past. In these cases, the capture must be limited to the strictly necessary side space; see Article 6 of Directive 1/2011.
11. Under what conditions are cameras allowed in schools/school complexes?
The installation of a video surveillance system in schools should be done with great care and under very strict conditions. A decision on this should be taken by the competent school governing body, after taking into account the opinion of representatives of the teaching staff and the parents’ and pupils’ associations. The system is not allowed to operate at times when the school is in session, and everyone (pupils and members of the educational community) must be fully aware of this so that they know they are not being monitored. The data must be deleted on the next working day (provided there has been no incident) and in any case its operation must be evaluated at regular intervals (no longer than one year) pupils, parents, teachers and other staff must be able to access the data relating to the evaluation (see also Article 18 of Directive 1/2011). It is understood that the installation of cameras in classrooms cannot be justified.
12. I am an employee and my employer has installed cameras with which he can monitor the staff. What should I do?
First of all, it should be noted that, in any case, you can exercise for a video surveillance system the rights of access and objection to which the employer is obliged under the ν. 2472/1997 reply to you in writing. If the person responsible does not reply or if the reply is not satisfactory, you can appeal to the Authority (and submit any reply from the person responsible at the same time). As long as the cameras are operated for the control/monitoring of staff, the processing is unlawful (see in particular Article 7 of Directive 1/2011) and you must lodge a complaint with the Authority, either through a collective body or individually. Please note that, since the complainant may be entitled to access the data in the complaint, including the complainant’s details (see in this respect the 73/2010 of the Authority, which explicitly specifies cases where such access is not allowed), it seems more appropriate to submit a complaint through a collective body. It is also noted that, due to the employee-employer dependency relationship, the weight of any consent of employees to such processing is weakened, as it is very difficult to ensure that such consent is free (see also in this respect Opinion 8/2001 of the Article 29 Working Party of the Commission of the European Communities on the processing of personal data in the employment relationship). Therefore, any written consent of the employees provided by the employer to the operation of the system cannot in itself constitute a basis for lawful processing.
13. I have a private practice in an apartment building. Where can I place cameras for security reasons and where can I not?
You cannot install cameras outside your surgery (e.g. to monitor the corridor or the entrance of the building), because in these places only the competent management body of the building (e.g. the General Assembly) is responsible for installing cameras and the provisions of Article 15 of the Directive apply. For the control of the entrance to the apartment where your practice is located, see question 5 and related questions 3 and 4. As a reminder, you are not allowed to have a camera in the lounge (waiting area) (see also Article 20 of Directive 1/2011). A camera can be placed, for example, inside the entrance to the surgery area.
14. How long am I allowed to keep the data recorded by the video surveillance system?
Data should be kept for the shortest possible time. In any case, they may not be kept for more than 15 days, except in exceptional cases. In particular for blocks of flats, they must be kept for a maximum of 48 hours, and for school complexes etc. until the next working day. Banks and financial institutions may keep them for up to 45 days. The retention period may be extended if there is an incident and the material can be used as evidence. (see Article 8 of Directive 1/2011 for a more detailed description, as well as the corresponding article of the Specific Part of the Directive depending on the category of controller).
15. I’m thinking of installing fake cameras or cameras that don’t record but just take a picture. Do I have to take any action against the Authority?
Fake cameras do not process personal data and therefore you have no obligation to the Authority (not even the obligation to submit a notification). It should be noted, however, that such a closed-circuit television-like system, although not functioning, may create a belief among citizens that personal data processing is taking place. The citizen’s feeling that he or she is very likely to be under surveillance influences his or her behaviour, so the installation of such a system may violate the constitutionally guaranteed right to the free development of the individual’s personality (Article 5 § 1 S). In the case where the cameras take a picture then, even if they do not record/store data, personal data processing (even if in a milder form than recording) is taking place, in which case all the above-mentioned conditions of lawfulness apply.
16.Can I place web cameras to display images on various websites for advertising purposes?
For the promotion of a place or a business it is not necessary to use images where the faces are recognizable. You should ensure that: a) either the cameras are positioned in such a way that it is not possible to identify faces or car number plates (in which case no personal data is processed) b) or that appropriate measures, such as blurring techniques, are taken if the image always includes faces, so that they are not identifiable. In this case, personal data is being processed and you must submit a notification You must be very careful to ensure that the image displayed does not identify persons and/or car number plates, as this would constitute unlawful processing of personal data (unless you have the explicit consent of all those whose data you are processing, which is impossible in most cases).
17. I observe (e.g. in a shop or a café) cameras, which I do not know if they are legal and I do not know exactly if and what they record. What should I do?
You can exercise your right of access to the company that has installed the cameras, i.e. to ask it to provide you with a copy of the video footage it has recorded of you or, alternatively, to simply show you a relevant video footage. Please note that the controller is obliged, under the article 12 of Law no. 2472/1997 , to respond to your request (in essence, to describe in full the type of processing carried out and its characteristics): if it does not respond or if its response is unsatisfactory, then you can take the matter to the Authority (see. If you are not satisfied, you can appeal to the Authority (see also Article 13 of Directive 1/2011 for more detailed information on the procedure). You can also further exercise the right of opposition (as also indicated in Article 13 of Directive 1/2011). In particular, as regards the right of objection, it is noted that the controller must, if he/she finds that the request should be granted, adapt the system accordingly in order to avoid similar processing in the future. In any case, you should be aware that cameras are not allowed to record tables, seats, bars, etc.
18, My neighbour has put a camera and I think it is recording my house. What can I do?
You can, if you consider that the camera is not focused on an exclusively private area, exercise your right of access to the person who has installed the camera, i.e. ask for a copy of the video footage or, alternatively, simply show you a clip of the video footage (if you have passed through a point that you consider to be part of the camera’s field of view). Note that he is obliged, under Article 12 of Law No. 2472/1997, to reply to you: if he does not reply or if his reply is unsatisfactory, you can appeal to the Authority (see also Article 13 of Directive 1/2011) – submitting both the request you have made and his reply at the same time. Also, if the camera ends up recording your own or public space (e.g. the street outside your house), you can exercise your right to object (as also mentioned in Article 13 of Directive 1/2011): if he does not answer you or if his answer is not satisfactory and he does not adapt the camera properly, then you can appeal to the Authority (see also Article 13 of Directive 1/2011) – by submitting both the request you made and his answer. In any case, even if he replies that the camera is for his personal use and that he is not recording you (in which case, if this is indeed the case, Law no. 2472/1997 on the protection of personal data), you can exercise your legal rights under the general provisions of the law on the protection of personality (see in particular Article 3(3) of Directive 1/2011).
