DATA PROTECTION
Italian Data Protection Authority: new FAQ on videosurveillance issued.
Can the employer install a video surveillance system in the workplace? Do I need to have authorization from the Guarantor to install the cameras? How is the information notice provided to the interested parties? What are the storage times, if any, of the recorded images? You can use home surveillance cameras c.d. smart cam?
These are some of the questions answered by the Faq developed by the Italian Data Protection Authority on issues concerning the processing of personal data in the context of the installation of video surveillance systems by public and private entities. The clarifications became necessary due to the new provisions introduced by Regulation 2016/679, in the light of which the validity of the provision of the Guarantor on the matter must be assessed, which dates back to 2010 and contains provisions that are partially outdated. The Faq also take into account the Guidelines recently adopted on the subject of video surveillance by the European Data Protection Committee (EDPB) and contain a simplified information model drawn up precisely on the basis of the example proposed by the EDPB. The Faq, available from today on the Authority's website www.garanteprivacy.it, contain general information inspired by the answers given to complaints, reports, queries received by the Office in this period.
The Italian Data protection Authority has clarified, for example, that the video surveillance activity must be carried out in compliance with the principle of data minimization regarding the choice of shooting methods and the location of the plant, and that the data processed must in any case be relevant and not excessive. with respect to the purposes pursued. On the basis of the principle of accountability, then, it is up to the data controller (a company, a public administration, a professional, a condominium ...) to evaluate the lawfulness and proportionality of the processing, taking into account the context and purposes of the same, as well as risk to the rights and freedoms of individuals. The data controller must also assess whether the conditions are met for carrying out an impact assessment on data protection before starting the processing.
Regarding the information to interested parties, the Authority clarified that a simplified model (for example a simple sign) can be used containing the most important information and placed before entering the supervised area, so that interested parties can understand which area is covered by a camera. Of particular importance, finally, the indications on the times of any retention of the recorded images: unless specific legal provisions provide for certain durations, the retention times must necessarily be identified by the data controller based on the context and purpose of the processing, as well as the risk to the rights and freedoms of individuals. In this regard, the Authority underlined that personal data should be - in most cases (for example if video surveillance is used to detect vandalism) - deleted after a few days and that the longer the envisaged retention period, the more argued. it must be the analysis referred to the legitimacy of the purpose and the need for conservation.
(Source: Web site garanteprivacy.it – Author and Ownership of the contents: Italian Data Protection Authority).
These are some of the questions answered by the Faq developed by the Italian Data Protection Authority on issues concerning the processing of personal data in the context of the installation of video surveillance systems by public and private entities. The clarifications became necessary due to the new provisions introduced by Regulation 2016/679, in the light of which the validity of the provision of the Guarantor on the matter must be assessed, which dates back to 2010 and contains provisions that are partially outdated. The Faq also take into account the Guidelines recently adopted on the subject of video surveillance by the European Data Protection Committee (EDPB) and contain a simplified information model drawn up precisely on the basis of the example proposed by the EDPB. The Faq, available from today on the Authority's website www.garanteprivacy.it, contain general information inspired by the answers given to complaints, reports, queries received by the Office in this period.
The Italian Data protection Authority has clarified, for example, that the video surveillance activity must be carried out in compliance with the principle of data minimization regarding the choice of shooting methods and the location of the plant, and that the data processed must in any case be relevant and not excessive. with respect to the purposes pursued. On the basis of the principle of accountability, then, it is up to the data controller (a company, a public administration, a professional, a condominium ...) to evaluate the lawfulness and proportionality of the processing, taking into account the context and purposes of the same, as well as risk to the rights and freedoms of individuals. The data controller must also assess whether the conditions are met for carrying out an impact assessment on data protection before starting the processing.
Regarding the information to interested parties, the Authority clarified that a simplified model (for example a simple sign) can be used containing the most important information and placed before entering the supervised area, so that interested parties can understand which area is covered by a camera. Of particular importance, finally, the indications on the times of any retention of the recorded images: unless specific legal provisions provide for certain durations, the retention times must necessarily be identified by the data controller based on the context and purpose of the processing, as well as the risk to the rights and freedoms of individuals. In this regard, the Authority underlined that personal data should be - in most cases (for example if video surveillance is used to detect vandalism) - deleted after a few days and that the longer the envisaged retention period, the more argued. it must be the analysis referred to the legitimacy of the purpose and the need for conservation.
(Source: Web site garanteprivacy.it – Author and Ownership of the contents: Italian Data Protection Authority).
