Any processing of personal data must be based on one of the conditions of lawfulness exhaustively listed in Article 6.1[1] of the GDPR. In the context of a CCTV system, the most appropriate condition of lawfulness will generally be that of processing necessary for the purposes of the controller’s legitimate interests, unless the interests or fundamental rights and freedoms of the persons subject to video surveillance prevail (Article 6.1(f) GDPR). The CNPD points out that, in order to be able to use the condition of lawfulness constituted by the legitimate interest, three cumulative conditions must be met:
(1) the existence of a valid legitimate interest (for example, the desire to protect one’s property against theft or one’s employees against physical harm);[2]
(2) the need to process personal data for the purposes pursued by the legitimate interest invoked (i.e. are there reasonable and less privacy-intrusive alternative means to achieve the same purpose?); and
(3) the fact that the fundamental rights and interests of data subjects must not prevail over the legitimate interests of the controller (‘the balancing exercise’).
That third condition consists in verifying whether video surveillance is likely to infringe the fundamental rights and interests of data subjects, and if so, whether those fundamental rights and interests must not prevail over the controller’s interest in setting up a video surveillance system – in which case setting up is not permitted.[3]
In most cases, the fundamental rights and freedoms of data subjects will prevail over the legitimate interests pursued by the controller where video surveillance presents risks of a high level of interference with the rights of data subjects or in areas where there is a reasonable expectation not to be subject to surveillance. Examples of such areas are given in section 4.5.B. below. The balancing exercise must in any event be carried out on a case-by-case basis.
Controllers must be able to explain the choices made regarding the location of cameras, the areas monitored and the technical means used.
Attention: In principle, consent[1] does not constitute an appropriate basis for the lawfulness of video surveillance.
By their nature, video surveillance systems have, in their field of vision, an indeterminate number of persons simultaneously.[2] In principle, it is not possible for the controller to seek the consent of each of the persons passing through the camera’s field of view, nor to prove that each data subject has given their consent before their personal data are processed.[3] Moreover, in the event that the data subject withdraws their consent, the controller will find it difficult to demonstrate that the personal data is no longer processed.[4]
Obtaining a valid consent by the controller is made even more difficult when the CCTV cameras have employees of the controller in their field of vision. Indeed, one of the conditions to be met for consent to be valid – which stem from Article 4. 11) GDPR – is that it was freely given by the data subject. In the context of employment relationships, given the dependence and imbalance of powers that may exist in ‘employer-employee’ relationships, employees are only very rarely able to refuse or revoke their consent without fear of adverse consequences.
In those circumstances, consent can very rarely be regarded as freely given.[5]
[1] See Article 6.1(a) of the GDPR.
[2] See in this regard paragraphs 43 to 48 of the European Data Protection Board’s Guidelines 3/2019 on the processing of personal data by video devices, available at: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019-processing-personal-data-through-video_en.
[3] cf. Article 7.1 of the GDPR.
[4] cf Article 7(3) of the GDPR.
[5] See in this regard paragraph 21 et seq. of the European Data Protection Board’s Guidelines 5/2020 on consent within the meaning of Regulation (EU) 2016/679, taken up by the European Data Protection Board, available at:
https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019-processing-personal-data-through-video_en. See also Section 6.2 of Opinion 2/2017 of the Article 29 Working Party on data processing at the workplace (WP 249), available at: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=610169.