According to Article 5(1)(b) of the GDPR, personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way that is incompatible with those purposes.
For example, video surveillance may have the following purposes:
- secure access to the building;
- ensure the safety of staff and customers;
- detect and identify potentially suspicious or dangerous behaviour likely to cause accidents or incidents;
- accurately identify the origin of an incident;
- protecting assets (buildings, facilities, equipment, merchants, cash, etc.);
- organising and supervising the rapid evacuation of persons in the event of an incident;
- to be able to alert the emergency, fire or law enforcement services in good time and to facilitate their intervention.
- ...
On the other hand, the CNPD is generally of the opinion that the following purposes cannot be pursued by a controller using a CCTV system, since such a system installed for these purposes would not comply with the principles defined below in point 4:
- check that employees are working and not spending too much time on their phones or chatting with colleagues;
- checking that employees are complying with working hours;
- verify that employees comply with the work instructions given;
- verify that employees are behaving appropriately with customers.
Before installing a CCTV system, the controller must define precisely the purpose(s) he/she actually wishes to pursue by using such a system, and may not subsequently use it for any other purpose. Thus, an employer who decides, for example, to install a CCTV system for the sole purpose of ensuring the safety of staff and customers, may not then use it for another purpose for which the data was not initially collected and used and which, in particular, was not brought to the attention of employees.
Cameras that are used for the same purposes by a single controller may be jointly documented.
The example given below in point 4.3 of these guidelines illustrates this principle of purpose limitation.