The European Data Protection Board has issued a notice, dated July 10, 2019, to the Draft guidelines on video surveillance (“Guidelines 3/2019 on processing of personal data through video devices”). The draft was open for public consultation until September 9, 2019.
The guidelines comment on the following topics, among others:
- substantive applicability of the GDPR (but not international applicability). It remains open when the recording of a crowd leads to personal data. In Switzerland, this question would have to be answered on the basis of the Logistep criteria. The EDPB probably assumes that this is personal data.
- Legal basis in the sense of Art. 6 and 9 DSGVO (detailed instructions of the EDPB)
- Disclosure of records to third parties, in particular also to authorities;
- Processing of special categories of personal data.
- Welcome is the renewed clarification that a photograph of a person wearing glasses or even in a wheelchair is not a special category of personal data per se, but only then, if the recordings are used to derive corresponding findings (“if the video footage is processed to deduce special categories of data”). This is in line with the position of the FDPIC that the qualification of abstractly sensitive data as particularly valuable or as a personality profile also depends on the context of use.
- The same applies to biometric data. Video recordings are not biometric data per se.
- Data subject rights:
- Explanations on the rights of the data subjects; also on the reasons for exceptions, e.g. if there are several data subjects on video recordings and the recording may therefore not be released;
- The EDPD confirms that “deletion” in the sense of the deletion claim can occur through irreversible pixelation. (Incidentally, this is also confirmed by the View that anonymization is an erasure equivalenti.e. legally equivalent in principle to a deletion).
- TransparencyHere, the EDSA repeats the recommendation to work with several information layers (“layered approach”);
- Retention and deletion;
- Safety measures including privacy by default and by design.