Municipal Authorities are obliged to carry out a Data Protection Impact Assessment (DPIA) and submit it to the Personal Data Protection Authority for prior consultation and approval, before the installation of Closed Circuit Video Surveillance (CCB) in parks and other public spaces, points out the Commissioner for Personal Data Protection, Maria Christofidou.
In an announcement on Monday, on the occasion of the public debate on the installation of video surveillance systems by Municipal Authorities, the Commissioner for Personal Data Protection clarifies that the installation of CCTV in public spaces falls within the area of security and civil protection responsibilities of the Municipalities and is allowed, according to the Municipalities Law, for the purposes of vandalism, fire and environmental hazards prevention, provided that the General Data Protection Regulation (GDPR) and the applicable national legislation are complied with.
The installation and operation of a CCP can be a legitimate measure, provided that it is necessary and proportionate to the specific purpose and is implemented with appropriate safeguards for the protection of personal data, it states.
The Commissioner notes that, in the context of the DPIA, it should be examined, inter alia, whether the intended objective can be effectively achieved by less intrusive means.
It also points out that where the installation of a CCTV is deemed necessary, the recording range of the cameras should be limited to what is absolutely necessary, in order to avoid, to the extent possible, the unjustified recording of persons or places that are not related to the intended purpose.
At the same time, the retention period of the material, the persons who have access to it, as well as the technical and organizational security measures should be determined based on the specific purpose and circumstances of each case.
According to the Commissioner, it should be ensured that citizens are properly informed about the functioning of CBPs and the processing of their data.
As it states, Data Protection Impact Assessments submitted by Municipal Authorities are currently under evaluation, in the context of the previous consultation.
Furthermore, it calls on the Municipal Authorities that intend to install a CCVP to proceed with the conduct of the DPIA and its submission to the Authority, in accordance with the obligations arising from the GDPR.
It notes, finally, that the protection of personal data is not an obstacle to the installation of such systems, but requires that they be designed and implemented in a lawful, necessary and proportionate manner, with respect for the fundamental rights of citizens.
