"Smile, you’re on CCTV... and read on for our full privacy notice!" – EDPB adopts new CCTV guidance

The UK is widely seen as a world leader in CCTV, driven by decades of increasing expenditure (both public and private) on the installation and development of video surveillance systems. The British Security Industry Association estimated that there are up to 5.9 million CCTV cameras in the UK, and others have calculated that the average person in a UK city is captured by 70 cameras per day.

Whatever the precise figures, there is no doubt that the intensive use of CCTV is becoming the norm, and that new and exciting technologies are rapidly increasing the amount of personal information that can be gleaned from video footage. It is against the backdrop of widely publicised privacy concerns, both in the UK and Europe, that the European Data Protection Board (EDPB) has adopted detailed new guidelines on the use of video devices.

What does the EDPB have to say? 

The EDPB’s position on video surveillance technology is crystal clear: because of the impact of cameras on citizens’ day-to-day behaviour, and the way in which new technologies can transform ordinary video cameras into (very) smart cameras, the data protection implications of its use are "massive".  

Whether it is advanced surveillance systems covering large public areas for security purposes, facial detection and/or recognition cameras being used to personalise public advertising, or complex biometric technologies used to track criminals, the EDPB highlights that preserving individuals’ privacy is becoming increasingly important. In response, their guidelines set out ways to achieve legally compliant surveillance systems, focusing on: possible lawful processing grounds; dealing with special category data; and individuals’ GDPR rights in respect of their personal data.

What should users of video camera technology be doing?

One of the most interesting parts of the guidelines focuses on the provision of transparency information (i.e. privacy notices) to individuals who are being filmed. Satisfying the EDPB’s desire for detailed, layered, easily visible, intelligible, clearly readable, eye-level transparency information will certainly be challenging for many - not least because a privacy notice’s first layer (the so-called "warning sign") should enable an individual to "recognise the circumstance of the surveillance before entering a monitored area".

Users of video camera technology should be reviewing their privacy notices, as well as extending their documented rationale for the surveillance, to take account of the EDPB’s recommendations. At the very least they should be considering updates to existing CCTV signage to ensure that basic information suggested by the EDPB (e.g. name of responsible organisation, purposes of surveillance, direction towards further privacy information) is clearly displayed.