The GDPR stipulates that personal data must be kept in a form that allows the identification of data subjects for no longer than is necessary for the purposes for which they are processed. As regards to video surveillance, the CNPD considers that images can be kept in principle for up to 8 days.
The controller may exceptionally retain the images for a period of 30 days. However, the reasons justifying such a retention period must be indicated in the register of processing operations.
A shelf life of more than 30 days is generally considered disproportionate.[1]
In the event of an incident or offence, the images may be retained beyond the aforementioned time limits, as part of the transmission of data to the competent judicial authorities and law enforcement authorities competent to detect or prosecute criminal offences.
Finally, the controller must ensure that the images are destroyed after the retention period has expired. The introduction of automatic erasure is recommended by the CNPD.
-------------------------------------------------------------------------------------
[1] See Decision 14FR/2021 of 12 May 2021 of the Restricted Formation of the National Commission for Data Protection, paragraph 38.