With the new Data Protection Regulation, last 25th May of 2018, the surveillance sector has changed some elements. We have to be clear with our steps to comply with the law, when we are installing the CCTV system and with the recorder images from it.
This new regulation is loooking for to be adapted to Regulation (UE) 2016/679 European Parlament and Council of 27th April 2016, about the protection of personal datas and free flow of them
In this article we´ll see how the surveillance sector is affected by new Data Protection Regulation.
BYE BYE NOTIFICATIONS
Since year, when we installed CCTV system we had to inform to Agencia Española de Protección de DAtos. NOTA system, did remember? guided us to fullfil the form and after that we sent to AEPD.
Now, with new Data Protection Regulation, you don´t need this notification. Only you have to fullfil an internal document. It´s explained in 30th article of the new regulation.
30th ARTICLE
Each responsible person, or agent, takes note of the activities done by his responsability. This register shall have the next information:
- The name and contact deails of responsible, co-responsible, the agent and data protection delegate.
- The purpose of the system.
- The categories description of interested, personal datas of categories, the recipients data, third countries and international organizations too.
- In case of datas transfer to a third country and international organization, we have to inform about that country and/or organization and the documentation (49th article, 1st section, 2nd paragraph)
- Preview perdiods to delete the data categories, when it could be possible.
- Description of security measures (32nd article, 1st section) when it could be possible.
The register shall have:
- The name and contact deails of responsible, co-responsible, the agent and data protection delegate.
- Las categorías de tratamientos efectuados por cuenta de cada responsable.
- The type of processing made by each responsible.
- En el caso de trasferencia de datos a un tercer país u organización internacional, se ha de identificar dicho país y/u organización junto con la documentación de garantías adecuadas (recogido en el Artículo 49, apartado 1º, párrafo 2º)
- Description of security measures (32nd article, 1st section) when it could be possible.
Above information has to be on paper and electronic format. Also, the responsibles have to make aviable to Authority.
Everything, looking until now, isn´t obligatory to companies with less than 250 employees. Unless it is a risk to freedoms and rights of them.
HOW TO APPLY THE NEW REGULATION TO SURVEILLANCE SYSTEMS
We´re going to stand out the aspects of new regulation that affect to surveillance installation:
- Cameras location: recorder imagenes have to respect the relax and private areas.
- Screens location: screens have to be located inside limited area.
- Saved images: the images will be saved for a month.
- Duty to inform: we have to inform about the CCTV installaton by a informative poster. This element is composed by a pictogram and text where inform how you could access to replace your data.
- Schedule control: we have to inform the employees if the cameras are used to control entrances and exits.
- Right to access to images: you could order it with a ID copy, date and hour that you want to see. The images don´t be showed directly to others. If they couldn´t be watched, we have to give a document with this information.
Here you are a link with a guide form AEPD to help you to supplement the information.
