The Office for Personal Data Protection (hereinafter “Office”), as the competent authority pursuant to Act No. 101/2000 Coll., on the Protection of Personal Data and on amendments to certain acts (hereinafter “Act”), and Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter “Directive”), is charged with the supervision of the protection of personal data, especially for the processing thereof.
Recently there has been an increasing number of cases where camera systems are installed in various places for various purposes. If a recording is taken from those camera systems (a camera system with recording, hereinafter “camera system”), that involves, in accordance with documents published earlier by the Office, the processing of personal data in the sense of Article 4 (e) of the Act and the Office therefore has the power to supervise that processing. The Office has in the past published positions to elucidate the interpretation of the Act, and they serve as guidelines for those potential controllers and processors of personal data in the sense of Article 4 (j) and (k) of the Act. 1
As some of the owners and tenants of apartment buildings wish to install camera systems in apartment buildings, and as the Office has received a number of complaints from citizens concerning those camera systems, the Office considers it necessary to express its opinion on the matter and to outline its views on the key rules for operating such systems. As can be judged e.g. from notification received of the processing of personal data, among camera system operators the dominant opinions are quite evidently at odds with the fundamental duties of the controller under the Act.
The most common and most serious problems and shortcomings the Office has encountered concern the incorrect evaluation of the ratio between the values that are to be protected by a camera system and the values on which the camera system encroaches. Another fundamental problem is the insufficient use of other resources that can satisfy the purpose the controller intends more effectively, and the incorrect (in most cases excessively narrow) interpretation of the concept of privacy, and related to that is an insufficient awareness of the connection between installing a camera and the intrusion on privacy that installing the camera represents.
From its earlier positions and the work of the Office it must be recalled that in general and in view of their special nature camera systems can only be used if all less intrusive alternatives have failed, or if it is certain that they would be unable to satisfy the purpose specified. The reason for that is the fact that a camera system is a device that interferes with fundamental human rights: the right to privacy and the right to private and family life. Those rights are protected by Article 10 of the Charter of Fundamental Rights and Basic Freedoms and by Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms. A camera system and the related intrusion on privacy can only be considered a relevant reason, or relevant means to achieve the controller’s objective, if it involves the greater protection of another fundamental right or freedom. For priority to be given to protecting another constitutional right over the protection of privacy it is necessary to proceed according to the “guide” presented in Czech Constitutional Court Judgement Pl. US 4/94, i.e. to assess whether in a given situation the protection of another fundamental right or freedom is so important (justified) and that right is so threatened that it is necessary to accept interference with privacy and thereby to derogate to some extent the fundamental human right to private and family life.
From the forgoing, it emerges that the following issues:
are crucial for the Office when deciding on the legitimacy of using a camera system.
When installing a camera system it must be stressed that different approaches must be taken to the way in which the individual spaces monitored are used, taking account of the degree of privacy people enjoy in those spaces. In particular, it is possible to distinguish between spaces such as cellars, attics, letterboxes and façades, and spaces such as the front door, corridors, elevators, etc. It is indisputably the case that the degree of privacy the occupants of a building enjoy in those spaces varies.
The correct interpretation of the concept of privacy is also important. In the Office’s opinion the concept of privacy is currently perceived too narrowly by the public, which is undoubtedly related to the contemporary lifestyle, the omnipresent media and the rapid development of information technologies. The concept of privacy, and private and family life, does not apply only to spaces such as bathrooms, toilets, or entire apartments or buildings. Privacy also means a certain sphere of integrity for the individual and his or her relatives that surround the individual wherever he or she may be. In a space in the immediate vicinity, such as the apartment building an individual lives in and spends the greater part of his or her life in, the degree of privacy is undoubtedly greater. 2
The European Court for Human Rights has stated on privacy that “Respect for private life must also comprise to a certain degree the right to establish and develop relationships with other human beings.” 3 It can be deduced that if a space where a person enjoys privacy includes the workplace, then that statement applies all the more to the place of residence.
The provisions of Article 5 paragraph 1 (a), (e) and paragraph 2, Article 10, Article 11 paragraphs 1 and 5, Article 13 and Article 16 of the Act are particularly relevant to the installation of camera systems.
Article 5 paragraph 1 (a)
One of the controller’s main obligations is to specify the purpose for which personal data are to be processed. 4
Article 5 paragraph 1 (e)
According to this provision the controller is obliged to preserve personal data only for a period of time that is necessary for the purpose of their processing. The period over which a record may be preserved must be specified so that it does not exceed the time required for an incident recorded by the camera to be investigated and other essential information obtained, e.g. if required to transfer a case to the relevant authorities for investigation. In view of the situation in apartment buildings and places where the Office accepts cameras, the period for preserving a recording from a camera system is considered to be approximately seven days, and in justified cases that period can be extended as appropriate.
Article 5 paragraphs 2, 4 and Article 10
According to Article 5 paragraph 2 of the Act the controller may process personal data only with the consent of data subject. Without such consent, the controller may process data only in the cases listed in Article 5 paragraph 2 (a) to (g) of the Act.
For the installation of camera systems in residential buildings there is most often discussion of processing personal data with the consent of the data subject, or processing data without the consent of the data subject on the basis of the exemption listed in Article 5 paragraph 2 (e) of the Act, i.e. with reference to the protection of the rights and legitimate interests of the controller, the recipient or another person concerned.
In connection with the option of applying the aforementioned exemption, which allows personal data to be processed without the consent of the data subject, it is necessary to express the Office’s opinion on the installation of cameras and the related potential intrusion on privacy, and on the purposes that camera systems in apartment buildings are intended to serve.
From the Office’s supervisory work to date it emerges that the purpose (reason) for installing camera systems in apartment buildings most frequently given is the protection of property, the prevention of vandalism, restricting access by undesirable persons and the protection of life and health.
It must be considered whether the protection of life and health, or of property, is of greater value than the protection of privacy and private and family life. That assessment must be applied comprehensively in each individual case. It must be remembered that in the case of a camera system it is necessary to ask whether it can truly protect those values and whether there are other means that would protect them more effectively, or similarly and yet would not present an intrusion on privacy.
In an apartment building there are fundamentally two different kinds of spaces. This distinction leads to the need for the consent of the building’s occupants to the operation of a camera system, or the use of the exemption under Article 5 paragraph 2 (e) of the Act.
Regarding the consent of the data subjects to the processing of personal data, i.e. with the installation of a camera system and the obtaining of a recording from it, it is important that a number of statutory conditions apply. In particular that concerns the conditions listed in Article 4 (n) of the Act (it must be the free and informed manifestation of will of the data subject) and Article 5 paragraph 4 of the Act (it must be a matter of informed consent). If those statutory conditions are not met when requesting consent, such consent may be regarded as an invalid legal act.
With regard to the issue of consent to the processing of personal data by a camera system, it is essential to point to the potential risks of that option. Firstly it is essential that consent be provided at all times by all the specified occupants, which presents problems where there are frequent changes in apartments’ tenants or owners, etc. Secondly it must be mentioned that a data subject can withdraw his or her consent to the processing of personal data at any time. In view of those facts, it is recommended that processing personal data with consent be only realistically considered for apartment buildings with a small number of apartments.
In connection with the controller’s aforementioned duty of disclosure, if the consent of the data subject is obtained the controller is obliged, according not only to Article 5 paragraph 4 but especially to Article 11 paragraph 1 of the Act, to always inform the data subject when collecting personal data of the scope and purpose of processing the personal data, who will process the personal data and how, and who the personal data will be made available to, if that information is not already known to the subject (e.g. they were provided when obtaining the data subject’s consent as a manifestation of his or her informed will). The controller must also inform the data subject of the right to access the personal data, the right to have the personal data corrected, and other rights as set out in Article 21 of the Act.
In processing conducted on the basis of an exemption pursuant to Article 5 paragraph 2 (e) of the Act the duty of disclosure need not always be discharged before processing is commenced; however on the basis of Article 11 paragraph 5 of the Act the controller is in such a situation obliged to inform the data subject of the processing of his or her personal data without undue delay. For a camera system in an apartment building, various situations may arise for the controller in relation to different groups of monitored persons, i.e. data subjects, and accordingly different levels of information for those groups of persons.
It is necessary to meet the duty to inform the occupants, e.g. by means of a meeting for the owners of the apartments, and subsequently to display or distribute the minutes from the meeting to all occupants before processing commences, and to the full extent required by law, as the data subjects are already known to the controller, who can therefore inform them without undue delay before the collecting of data commences.
For other data subjects who enter the apartment building irregularly, i.e. at unpredictable intervals, the controller is obliged to discharge the information duty by e.g. placing information panels at the entrances to the monitored spaces. Such an information panel must include the information that the space is monitored by a camera system, it must list the controller or operator of the camera system, or the contact person, or information on where the data subject will be provided with information on processing in the extent required by law (i.e. where the data subject can receive further information on the camera system in written form).
It is also necessary to discuss the obligations of persons in securing personal data. The Act obliges the controller and processor to adopt measures preventing unauthorised or accidental access to personal data, its alteration, destruction or loss, unauthorised transmission, other unauthorised processing, as well as other misuse. This obligation shall remain valid after terminating personal data processing. The controller or the processor is obliged to develop and document the technical and organisational measures adopted and implemented to ensure the protection of personal data in accordance with the law and other legal regulations; see Article 13 of the Act for details.
Measures in the above sense can mean the secure locating of the recording equipment and also the internal security of the equipment, such as passwords, and a specification of the persons who have access to the equipment and know the passwords, and other resources required to bypass security, and also the securing of devices used to transfer images or data.
There are often cases where controllers want to install equipment to make a recording from a camera system in the apartment of a member of a housing association or an association of apartment owners on his or her personal computer without adequate computer security, or to install that equipment in any other similar manner that does not satisfy the statutory conditions for securing the processed data. Regarding such an intention it can be stated that on the basis of the preceding that the Office presumes that by placing the recording equipment in a separate and secure room, if there is no alternative, or if the alternative would involve disproportionately high costs in view of the controller’s means, even if that is in the apartment of a member of a housing association or an association of apartment owners, and by means of its encryption or securing using analogous measures that allow only a small group of persons, authorised for access on the basis of a decision by the association of apartment owners or housing association, and by restricting access to the room with the recording to that small group of persons, and then only in cases that it is found beyond all doubt that an event took place in the space monitored, and that the recording from the camera system is required to clarify it, it is possible to consider the conditions of Article 13 to have been satisfied.
The controller is obliged, prior to commencing personal data processing by means of a camera system, to notify the Office of the intended processing of personal data. The Office’s experience to date has been that for processing data by means of camera systems in apartment buildings it is not possible to apply any of the exemptions from the obligation to register set out in Article 18 paragraph 1 of the Act.
In addition to those obligations the controller is also obliged to observe other obligations set out in the Act, such as the obligation to process personal data solely in accordance with the purpose for which it was collected (Article 5 paragraph 1 (f) of the Act); if recordings are made for the purpose of protecting property, they cannot be used e.g. to establish marital infidelity, etc.Conclusion:
Each controller must demonstrate in his or her plan for the use of a camera system that the camera system is:
Mode No graphics is currently switched on. Therefore you see the web page with no decorative graphics as well as any advanced formatting. If your browser supports CSS2, you can switch a graphic mode on.