Video surveillance: how to store data and what regulations apply to businesses in France?

When it comes to video surveillance, the European Union is seeking to protect individuals' personal data via the General Data Protection Regulation (GDPR). This applies in particular to companies with video surveillance systems. What are the regulations and how should video surveillance data be stored? Find out our answers in this comprehensive guide.

Video surveillance: installation under control

Prior authorisation for video surveillance installation

The law governs all cameras installed on public highways and in places open to the public, such as shops, cinemas, shopping centres, banks and so on. When access to the premises is not unrestricted and is therefore strictly limited to persons authorised to enter, such as employees of a company, the video surveillance system is subject to the provisions of law no. 78-17 of 6 January 1978 on data processing, data files and individual liberties.

In-store surveillance cameras are subject to prefectoral authorisation. There are two ways to apply for authorisation:

• send an application by post to the relevant prefecture. If the surveillance system is to be installed in Paris, the installation application should be sent to the Direction des usagers et des polices administratives of the Préfecture de Police de Paris;
• complete an online video surveillance installation application form.

The Prefecture sends the application to the Departmental Video Protection Commission. After 3 months, the Commission makes its decision. If authorisation is granted, the applicant is obliged to declare the commissioning of the video surveillance system to the prefecture.
Prefectoral authorisation to install and operate a video surveillance system is valid for 5 years and is subject to renewal. For each new application, the applicant must compile and send a new file to the relevant prefect. Once prefectoral authorisation has been obtained, work can begin on installing the surveillance kit.

It should be noted that some businesses may be eligible for financial assistance to install surveillance cameras. This has been the case for tobacconists in particular since 1ᵉʳ May 2023.

Informing people of the presence of cameras

To be valid, the operation of a video surveillance system must be justified. The employer must explain the reason for the surveillance: preventing the risk of theft, safety of goods and people, etc. Video surveillance must also be proportionate to the objective: if a ready-to-wear shop wants to limit its shrinkage, the cameras will only film the sales areas and not the rest of the business. If these conditions are not met, the employer may be condemned for infringing employees' rights.

In order to comply with the General Data Protection Regulation (GDPR), the implementation of video surveillance systems must respect privacy and individual freedoms. As soon as the people filmed can be identified on video surveillance images, they become sensitive data considered to be private. The company therefore has an obligation to provide information and transparency to its employees about its surveillance system. Employees must be informed of the presence of cameras and that they are potentially being filmed. To do this, the company manager will put up a sign, a logo or any other legible means of communication.

In addition, the purpose of the video surveillance, the length of time the images will be kept, the name of the Data Protection Officer (DPO) and the existence of "Informatiques et libertés" rights must also be explicitly mentioned.

According to the French Data Protection Act issued by the Commission Nationale Informatique et Libertés (CNIL), respecting the privacy of employees and customers is one of the obligations of anyone operating a video surveillance system. It is therefore forbidden to film the activities of employees when they are at their workstations, except in certain special circumstances (when handling money, for example). Rest and break areas, toilets, changing rooms, union premises and staff representatives' offices must not be filmed.

Who can access the video recordings?

To prevent abuse, access to images must be regulated to ensure the security of the data recorded. Images captured by a surveillance camera may not be freely consulted. Before any video-protection system is installed, the company must define which person(s) will have access to the images recorded. Under the law of 21 January 1995, only persons authorised by the person responsible for data processing (IT manager or security manager) or by the CNIL may consult the images. This ensures that access to images is strictly controlled, limiting the risk of privacy breaches and the use of recorded data.

The persons authorised to consult images from a company's video surveillance system may be the employer himself or another member of the company, provided that the latter is trained and authorised to access the images. If the video surveillance system can be accessed remotely, access must be secure. Companies are obliged to establish clear and detailed protocols for defining access to sensitive information. As companies are liable in the event of data theft, they must also implement measures to combat the risk of cyber-attacks.

Whoever is authorised to access the company's video recordings must be trained in respecting privacy and handling personal data.

How long can images be kept?

In France, images from a video surveillance system may not be kept for more than one month. This period may be extended if the images are used as part of an investigation. Generally speaking, keeping the images for just a few days is sufficient to carry out the necessary checks in the event of incidents.

It should be noted that the period for which data is kept must be specified in the authorisation issued by the local prefecture.
Any person is entitled to request access to the recordings concerning him or her at the end of the legal one-month period. However, this access is limited and people who are not concerned by the images have no right to access them.