How to correctly mark a monitored area

The sign placed at the entrance to a monitored area must, in its first layer, contain all the information the controller is obliged to provide to data subjects in accordance with Article 5(1)(a) GDPR (the principle of transparency). That information must be provided before the data are obtained, or at the latest at the moment they are obtained. The first layer contains information for data subjects about the controller, the purposes of the processing and further information ensuring fair and transparent processing of their personal data. At the same time, the first layer should say where the data subject can find all the remaining information. That additional information may be a reference to the processing of personal data — a link to a website or a notice board, for example — where there is more room for a layered approach to the conditions of the processing and to the rights of data subjects.

It follows from those guidelines that information about the processing of a data subject's personal data by a camera system cannot be provided only after their personal data have been obtained, that is, after they have entered the monitored area. The placement of the sign is specific in another respect as well: it informs data subjects about the point of entry into the monitored area, and so — in line with the principle of transparency — it delimits the space in which their personal data are being collected.

Under Article 4(1) GDPR, "personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Under Article 4(2) GDPR, "processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The boundaries of the monitored area

Where premises are monitored on the basis of a legitimate interest under Article 6(1)(f) GDPR, the controller must observe the principle of data minimisation under Article 5(1)(c) GDPR — personal data must be adequate, relevant and limited to what is necessary in relation to the purpose pursued. Monitoring beyond the boundary set for that purpose is not permitted.

How long recordings are kept

The guidelines also address the recommended retention period for recordings where Article 6(1)(f) GDPR is relied on (processing necessary for the purposes of the legitimate interests pursued by the controller), which is 72 hours. No specific retention period for personal data is laid down by the GDPR or by any other generally binding regulation. If recordings were to be kept for longer than 72 hours, the controller must be able to give the supervisory authority sufficient reasons for the longer retention, so that it does not conflict with Article 5(1)(e) GDPR (storage limitation) — that is, retention for no longer than is necessary for the purposes of the processing.

The controller is responsible for setting the retention period in line with the principles of necessity and proportionality as understood in those guidelines.

Under Article 5(1)(e) GDPR, personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as they will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to implementation of the appropriate technical and organisational measures required by the Regulation in order to safeguard the rights and freedoms of the data subject ("storage limitation").

What else can affect the retention period

• the number of proven thefts or incidents in the monitored area that were investigated by the police and for which evidence exists
• the number of public holidays, which could extend the retention period (bear in mind, though, that this may be a problem if you use a security service that monitors the premises)

If you have any questions, do not hesitate to contact us.