The Liechtenstein data protection authority has Notes on video surveillance according to the DSGVO and the new DSG-LI published. The explanations on the admissibility based on a legitimate interest are interesting (although other legal bases are also explained). The data protection authority sees a legitimate interest as follows:
A legitimate interest can be of an economic, legal or ideal nature. For example, video surveillance can protect against burglaries, thefts or vandalism. Whether these purposes are actually permissible must always be assessed on the basis of the risk situation in the individual case. The legitimate interest exists when it can be proven that there is an actual danger. The latter is especially true if there have been in the past damage or theft has already occurred is. Documentation of these incidents is recommended.
In addition, in certain situations, an abstract risk situation may also be sufficient if, according to life experience, the circumstances are typically such a hazard have, such as in stores that sell valuable goods (e.g., jewelers) or that are potentially particularly vulnerable with regard to asset and property crimes (e.g., banks).
Is foreseeablethat future burglaries or theft damage cannot be prevented by other means, video surveillance is to be classified as a permissible means.
However, the data protection authority makes this subject to the overriding interests of the data subjects, for example if
[…] the video surveillance into the Privacy of people, for example by monitoring toilets, saunas, showers or changing rooms. Furthermore, the interests worthy of protection also prevail in those cases where the Development of the personality is in the foreground, such as where people come together, eat, drink or relax.Also classified as inadmissible is a permanent monitoringwhich is a great benefit for those affected. unavoidable for example at the workplace.
This is convincing in principle. It should be added, however, that the balancing of interests must be more or less schematic, but in and of itself takes into account all circumstances, in particular also the “safeguards” that the GDPR often mentions, i.e. all measures to protect the data subject, which include special transparency measures (if applicable. beyond Art. 12 and 13 GDPR), but also a data protection impact assessment, which can also be carried out voluntarily (unless it is required under Art. 35(3)(c) GDPR or a blacklist) and would also have to be taken into account in the balancing of interests.
In addition, the monitoring must be transparent, which would require a sign in the case of video surveillance. To this end, the data protection authority proposes following patterns (which are somewhat more concise than the patterns of the State Commissioner for Data Protection Lower Saxony):
