{"id":887,"date":"2024-08-27T17:09:31","date_gmt":"2024-08-27T14:09:31","guid":{"rendered":"https:\/\/sgklegal.gr\/?p=887"},"modified":"2025-05-15T17:26:53","modified_gmt":"2025-05-15T14:26:53","slug":"gdpr-cctv-at-work","status":"publish","type":"post","link":"https:\/\/sgklegal.gr\/en\/gdpr-cctv-at-work\/","title":{"rendered":"GDPR & CCTV at work"},"content":{"rendered":"

On 30\/12\/2019, the Hellenic Data Protection Authority (hereinafter the “Authority” or “HDPA”) issued a decision regarding the use of video surveillance systems in the workplace.<\/strong> The case concerned a complaint submitted by a company\u2019s employee union, which focused on the legality of a closed-circuit television (hereinafter “CCTV”) system operating in areas such as company warehouses and the call center, not solely for security purposes but also for the monitoring and supervision of staff.<\/p>\n

The company argued that the operation of the CCTV system on its premises was based on its legitimate interest in protecting individuals and\/or assets (notably high-tech and therefore high-value goods) processed at its stores and facilities.<\/p>\n

The HDPA identified various breaches of the applicable data protection framework in force at the time of the complaint, regarding the employer\u2019s obligations. It subsequently issued both a warning<\/strong> to the company for the violation and an order to implement corrective measures<\/strong>.<\/p>\n

Taking into account this decision of the HDPA and the recent guidance issued both by the HDPA and the European Data Protection Board (EDPB) concerning the lawful and transparent adoption of CCTV systems in the workplace, this document aims to briefly describe both the relevant legal framework and the practical steps a data controller must follow to ensure compliance with the privacy requirements under Regulation (EU) 2016\/679 (GDPR) and national law.<\/p>\n

I. Legal Framework<\/h3>\n

It should be noted at the outset that the use and operation of a CCTV system with recording capabilities in the workplace constitutes processing of personal data<\/strong>. On 31\/03\/2011, the HDPA issued Guideline 1\/2011, defining CCTV systems as “systems permanently installed in a space, operating continuously or at regular intervals, and capable of capturing and\/or transmitting video and\/or audio signals from that space to a limited number of display monitors and\/or recording devices\u201d (see also Opinion No. 2\/2010, para. 8).<\/p>\n

In general, the lawfulness of processing<\/strong> is assessed based on the purpose pursued<\/strong> in conjunction with the means used<\/strong>, and the necessity<\/strong> and proportionality<\/strong> of such means. Specifically, the lawfulness of a CCTV system\u2019s operation is evaluated based on the purpose of the data controller, the level of risk involved, the rights and freedoms of the data subjects, and the existence of alternative measures, according to the principle of proportionality<\/strong>, which is crucial in such assessments, especially in workplace settings.<\/p>\n

Regarding CCTV in the workplace, the HDPA has stated that such systems generally constitute a means of employee monitoring and control<\/strong>. If installation is deemed necessary for security reasons, they must not be used for staff surveillance<\/strong>. Therefore, their installation should not extend to general workplace areas (e.g. hallways, offices, etc.) but only to locations requiring protection (e.g. entrances\/exits, cash registers, safes, etc.).<\/p>\n

This approach is also reflected in Law 4624\/2019, which allows installation of CCTV in workplaces only for the protection of individuals and property<\/strong>, provided that the core of the data subjects\u2019 rights and freedoms is not infringed<\/strong>.<\/p>\n

If employee data is collected via CCTV, such data must not be used to assess employee behavior or performance<\/strong>. Any data used for employee evaluation must be directly linked to the employment relationship<\/strong> and must not include unrelated information (e.g. behavioral data, interpersonal relations, etc.). In all cases, the controller must ensure that data subjects are informed timely and appropriately<\/strong>, use adequate technical and organizational measures<\/strong> (e.g. face masking, image-only capture), and retain the data only for the prescribed period (up to 15 days)<\/strong>.<\/p>\n

II. Accountability<\/h3>\n

As data controllers, employers may need to conduct a Data Protection Impact Assessment (DPIA)<\/strong> before installing a CCTV system.<\/p>\n

Under GDPR, a DPIA is mandatory<\/strong> when the data processing involves systematic monitoring of a publicly accessible area on a large scale<\/strong>, or when it appears on the list of high-risk processing activities<\/strong> defined by the supervisory authority of the relevant Member State.<\/p>\n

According to the HDPA, a DPIA is required where there is \u201csystematic and large-scale monitoring, observation or control of individuals through video surveillance systems in public, publicly accessible, or private spaces open to an unlimited number of persons\u201d.<\/p>\n

The Article 29 Working Party<\/strong> has identified nine criteria<\/strong> to determine whether a DPIA is necessary. If two or more<\/strong> are met, a DPIA is required:<\/p>\n

    \n
  1. \n

    Evaluation or scoring, including profiling.<\/p>\n<\/li>\n

  2. \n

    Automated decision-making producing legal or similarly significant effects.<\/p>\n<\/li>\n

  3. \n

    Systematic monitoring.<\/p>\n<\/li>\n

  4. \n

    Processing of sensitive or highly personal data.<\/p>\n<\/li>\n

  5. \n

    Large-scale processing.<\/p>\n<\/li>\n

  6. \n

    Matching or combining data sets.<\/p>\n<\/li>\n

  7. \n

    Data concerning vulnerable subjects.<\/p>\n<\/li>\n

  8. \n

    Use of new or innovative technologies.<\/p>\n<\/li>\n

  9. \n

    Processing that prevents data subjects from exercising a right or using a service\/contract.<\/p>\n<\/li>\n<\/ol>\n

    III. Conclusion<\/h3>\n

    As discussed above, under both EU and national legal frameworks and in light of CJEU case law and EDPB\/HDPA guidance, CCTV installation and use in the workplace is permissible solely for security purposes<\/strong> (e.g., safeguarding goods, facilities, staff engaged in high-risk work). If an employer deems installation necessary, they must ensure the following:<\/p>\n

      \n
    • \n

      No image capture from adjacent streets\/sidewalks or neighboring properties.<\/p>\n<\/li>\n

    • \n

      No image capture in areas violating privacy (e.g., restrooms, locker rooms, showers).<\/p>\n<\/li>\n

    • \n

      As a rule, no audio recording (allowed only in exceptional cases).<\/p>\n<\/li>\n

    • \n

      As a rule, no use of cameras with zoom or pan features (permitted only under specific conditions).<\/p>\n<\/li>\n

    • \n

      No installation in work areas (e.g., offices, hallways, kitchens), except in high-risk facilities, provided cameras focus solely on the asset being protected.<\/p>\n<\/li>\n

    • \n

      Only designated and authorized staff may access CCTV systems.<\/p>\n<\/li>\n

    • \n

      CCTV data must not be used to evaluate employees.<\/p>\n<\/li>\n

    • \n

      Data must be deleted within 15 days. Exceptionally, if an incident occurs, it may be stored separately for up to 30 days; if third-party involvement exists, up to 3 months.<\/p>\n<\/li>\n

    • \n

      No data transfer is allowed unless the data subject consents, or unless lawful requests are made by judicial\/prosecutorial\/police authorities. Victims or perpetrators of crimes may receive copies.<\/p>\n<\/li>\n

    • \n

      Data subject rights must be respected. If a legitimate objection is raised, appropriate action must follow to prevent recurrence of unlawful processing.<\/p>\n<\/li>\n

    • \n

      Employees must be timely and adequately informed<\/strong> about the CCTV system\u2019s installation.<\/p>\n<\/li>\n

    • \n

      The records of processing activities<\/strong> must be updated.<\/p>\n<\/li>\n

    • \n

      A DPIA must be conducted if required.<\/p>\n<\/li>\n

    • \n

      If the DPIA outcome so mandates, a prior consultation<\/strong> with the HDPA must take place to seek guidance on risk mitigation measures.<\/p>\n<\/li>\n<\/ul>\n

      It is emphasized<\/strong> that, since the GDPR came into effect, non-compliance<\/strong> with data protection obligations can lead to significant administrative fines<\/strong>, up to 4% of annual turnover or \u20ac20,000,000<\/strong>, whichever is higher.<\/p>\n

      For this reason, it is essential to collaborate with specialized advisors<\/strong>, whose expertise ensures both operational continuity and compliance with the data protection legal framework at EU and national level.<\/p>\n","protected":false},"excerpt":{"rendered":"

      On 30\/12\/2019, the Hellenic Data Protection Authority (hereinafter the “Authority” or “HDPA”) issued a decision regarding the use of video surveillance systems in the workplace. The case concerned a complaint submitted by a company\u2019s employee union, which focused on the legality of a closed-circuit television (hereinafter “CCTV”) system operating in areas such as company warehouses […]<\/p>\n","protected":false},"author":3,"featured_media":1535,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[271,272,111,270,157],"class_list":["post-887","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-en","tag-expert-in-cctv-legal","tag-fine","tag-gdpr-en","tag-gdpr-cctv-at-work","tag-hdpa"],"_links":{"self":[{"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/posts\/887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/comments?post=887"}],"version-history":[{"count":4,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/posts\/887\/revisions"}],"predecessor-version":[{"id":1611,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/posts\/887\/revisions\/1611"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/media\/1535"}],"wp:attachment":[{"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/media?parent=887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/categories?post=887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sgklegal.gr\/en\/wp-json\/wp\/v2\/tags?post=887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}