CNIL Vidéosurveillance: RGPD, legality and video surveillance

In 2012, the European Commission proposed a global reform of the rules on personal data protection in the European Union. Indeed, the technological developments made possible since 1995 highlighted the need to bring the rules framing personal data up to date. In 2018, the General Data Protection Regulation was adopted and the CNIL, created in 1978 following the Data Protection Act (the French predecessor of the GDPR), now has the role of ensuring compliance.
Install Veesion

RGPD and video surveillance

The RGPD regulates the access and use of personal information. This text makes public and private organizations responsible for processing their data. Its objective is to "give back to citizens the control of their personal data, while simplifying the regulatory environment of companies".

Much data is processed by companies and organizations. This data reveals our history, our private life, it is intimate and belongs to us. It is therefore important to secure it and make sure that not everyone has access to it.

How video surveillance can invade people's privacy

Video recording of individuals

Video surveillance is a system that consists of monitoring a certain environment through the use of cameras. In other words, such a system records everything that happens in a given environment, in our case stores. Thus, all the people who visit this store are filmed.

Recording people is an invasion of their privacy. It influences people to behave differently as they know they are under surveillance.

Processing of recorded images

In addition to filming the comings and goings of people, it stores these images. This recording will then allow the video surveillance images to be processed to detect certain elements (e.g. suspicious or even criminal behavior, theft, etc.). Nevertheless, it is possible that the images are used for unintended purposes (such as the surveillance of employees for example) that may infringe on the privacy of individuals.

Processing of recorded images

In addition to filming the comings and goings of people, video surveillance records these images. This recording will then allow the video surveillance images to be processed to detect certain elements (e.g. suspicious or even criminal behavior, theft, etc.). Nevertheless, it is possible that the images are used for unintended purposes (such as the surveillance of employees for example) that may infringe on the privacy of individuals.

Making cameras intelligent tools

It is difficult for a single human to process all the images from all the surveillance cameras in place. To simplify the processing of these images, companies like Veesion automate their viewing.

Does the RGPD apply to video surveillance?

The RGPD is a text about personal data. A personal data is "any information relating to an identified or identifiable natural person". In other words, it is information concerning a natural person, identified directly (by name, first name, social security number) or indirectly (by an identifier, a customer number, or biometric data).

However, video surveillance does not make it possible to identify a person in the sense that it does not make it possible to obtain directly identifying data or biometric data.

However, video surveillance is a data processing operation, i.e. any operation or set of operations, computerized or manual, carried out on personal data: collection, recording, consultation, communication, dissemination, deletion, etc. The installation of a video surveillance system must therefore comply with the requirements of the GDPR. In other words, the video surveillance system must meet one of the 6 legal bases imposed by the RGPD (consent, contract, legal obligation, public interest mission, legitimate interest).

What are the key issues in data protection?

While there is no evidence that the theft rate is increasing year over year, it can't be said that it is decreasing either. This is a very damaging phenomenon for stores that find themselves at a loss. To remedy this, distributors pass on the cost of this loss to the products, which directly harms consumers.

The thieves therefore directly impact the purchasing power of other customers. According to an article of ladepeche.fr, this represents an average of 148 euros for each household per year. Theft is therefore detrimental to customers in addition to being detrimental to merchants.

Finally, fighting against theft means defending the purchasing power of households!

Data quality

The installation of a video surveillance system must respond to an identified security problem (security of goods and people). The goal is to reduce as much as possible the capture of useless images (example: in a store it is useless and forbidden to monitor the work of employees, except for rare exceptions). This allows on the one hand to limit the invasion of privacy but also to make the surveillance system more efficient.

Right to information

Every person has the right to see his or her own data; consequently, anyone who implements a file or processing of personal data is obliged to inform the persons concerned of his or her identity, the purpose of the collection of information and whether it is compulsory or optional, the recipients of the information, the rights recognized to the person, and the possible transfer of data to a country outside the European Union.

Retention Periods

No specific time limit on the collection or use of data has been set by the texts, so the retention period must be determined according to the purpose for which the data was collected. Once this objective has been achieved, the data must be archived, deleted or anonymized.

When should video surveillance be declared to the CNIL?

As long as the video surveillance is filming in a private place, not open to the public, no declaration to the CNIL is necessary. On the other hand, in the opposite case, the organization that sets up the video surveillance system must file a request for authorization with the prefecture of the place where the system is installed. So, for example, if you want to install a video surveillance system in your store located in Paris, you will have to apply for an authorization from the Paris prefecture.

Other obligations relating to video surveillance

The installation of the system

The installation of surveillance cameras must respond to an identified security problem. Thus, they must be oriented to ensure the security of people and property but not for other reasons such as employee surveillance. Employees have the right to privacy, so the video surveillance system must not film them at their workstations, break rooms or union premises.

Consultation of the images

Not everyone can have access to video surveillance images. In fact, only the persons authorized by the employer within the framework of their functions can view these images. These people must be trained and made aware of surveillance and data protection. Finally, access to the images must be secured so that not everyone can access them.

Image retention

Organizations must delete personal data when it is no longer needed for the purpose for which it was collected.

***The marketing firm Epsilon Abacus says organizations can argue that they should "be able to keep the data as long as the data subject is considered a customer. So the real question is: How long after a purchase can an individual be considered a customer?"

The answer depends on the industries and the purposes for which the data was collected. Any organization that is unsure of how long it can retain data should consult a lawyer.

Intelligent surveillance for supermarkets

Intelligent CCTV for supermarkets is an advanced retail theft detection solution. It enables the detection of theft automatically and in real time without the need for an individual to view hours of video surveillance. The goal is to detect more thefts with less effort.

Conclusion

One might think that intelligent video surveillance is a major invasion of personal privacy. In reality, this is not the case, for several reasons.

First of all, it does not allow for the identification of individuals any more than traditional video surveillance systems (no use of biometrics). Secondly, these systems, although called "intelligent", are subject to the same regime as other systems and therefore to the same obligations regarding the conservation, deletion or use of the images collected.

Clearly, all that intelligent video surveillance systems allow is to automatically detect suspicious gestures without a human being behind the cameras to view the images. No invasion of privacy is perpetrated.