The short answer: recordings may be viewed by whoever is responsible for them, and only as far as a specific purpose requires. A chair of the owners’ association, a board member or a neighbour who would “like to have a look” is not in that circle — even when the cameras were bought with shared funds.
This page answers the two questions we are asked most often: can an association’s management have direct access to the cameras, and can a private person obtain a recording from a shop’s camera?
When a security company carries out the monitoring
We were asked whether the chair and the board members of an association may have direct access to the live camera feed and the recordings when a security company carries out the monitoring under a contract.
The answer was no. The reasoning has four parts.
First — read the contract. Once a contract has been concluded with a security company to monitor the premises and the grounds, responsibility for the monitoring and for storing the recordings lies with the security company. It acts either as a processor or as an independent controller, depending on the terms of the contract. That distinction determines everything that follows, so the first job is not an argument but reading the contract. Where the security company is a processor, Article 28 GDPR requires the relationship to be set out in a contract with specific content; an ordinary security services contract usually does not meet this requirement.
Second — proportionality. Standing access for the chair would not meet it. If the security company is monitoring and can provide information when an incident occurs, additional direct access is excessive. Article 5 GDPR requires processing only as much data as the purpose needs. The purpose here is the safety of the property and the residents, not the ability to watch.
Third — the association’s bodies should not continuously monitor the movements of residents or visitors. That is not a function of the association. Monitoring based on legitimate interest under Article 6(1)(f) GDPR covers the protection of property; it does not cover knowing who comes home and when.
Fourth — recordings can be obtained, but only in a specific case. The chair or the board may obtain a recording only to investigate a specific incident: theft, vandalism, damaged property. The request must be made formally to the security company and must state why the data is needed. Such a request leaves a trail, and that is exactly what sets it apart from standing access.
The practical consequence for the association is simple: if you want someone to watch the cameras in real time, it has to be the security company itself, not the association’s bodies.
When the camera belongs to a shop
The second case. A person asked whether they could obtain a recording from a shop’s camera that films the door to the stairwell.
The answer: the recordings belong to the shop or to the security company that administers it, and only they or the competent authorities may view them. As a rule, such footage is not shown or handed over to other persons unless there is a formal request from the police or another authorised body.
This is not the shop being stubborn. Other people are visible in the recording too, and in relation to them the shop is a controller with duties of its own.
The person has two realistic routes.
Article 15 GDPR gives the right of access to one’s own data. That means the right to receive information about oneself, not the whole recording with other people in it. In practice, the controller may provide an extract in which other persons are blurred, or explain what was captured. The request must be in writing and must state the exact time — “last week” is not enough, and after 30 days the recording is most likely gone.
Article 77 GDPR gives the right to lodge a complaint with the State Data Protection Inspectorate (VDAI) if there is no reply or the reply is unsatisfactory. A complaint is stronger when the earlier written request is attached. That is why it is worth starting with a letter.
If the recording is needed because of a criminal offence, the fastest route is not a request to the shop but a report to the police. The pre-trial investigation officer, the prosecutor and the court have the right to require natural and legal persons to hand over items and documents relevant to investigating a criminal offence (Article 97 of the Code of Criminal Procedure (BPK)). If they are not handed over, a seizure is carried out by order of the pre-trial investigation judge, and they may be taken by force (Article 147(1) and (4) BPK).
A neighbour’s camera pointed at a shared yard
For an individual’s activity, the GDPR exemption applies only where the activity is purely personal or household. A camera whose field of view reaches a shared yard, a street, someone else’s plot or a stairwell no longer falls within this exemption. This means the neighbour becomes a controller with all the duties that follow: to inform under Article 13 GDPR, to respond to a request under Article 15 GDPR and to deal with an objection under Article 21 GDPR.
The Court of Justice of the European Union has settled this question. In its judgment of 11 December 2014 in Ryneš (C-212/13), it held that using a camera installed on a house which also monitors public space is not a purely personal or household activity. The judgment was given under Directive 95/46/EC, which the GDPR replaced; the European Data Protection Board (EDPB), in its Guidelines 3/2019 (paragraphs 12–13), applies it under the GDPR as well, and accepts the exemption only where the camera does not cover, even partially, public space or neighbouring property. Only the practical conclusion matters here: a written request to the camera’s owner fixes the date from which they can no longer claim they did not know. Often that is where it ends, without any authorities.
How to start
If you are an owners’ association or a building administrator and do not know what your security company counts as under the contract, send us the contract — we will tell you free of charge whether it meets the requirements of Article 28 GDPR and who, under it, has the right to view the recordings.
A practical step-by-step guide is on Privacio, a site built by Linden: Ar galime filmuoti patalpas ir teritoriją? (in Lithuanian). You can also check whether your organisation needs a record of processing activities with the Privacio tool (in Lithuanian).
Email: info@linden.lt
More about this service: video surveillance documentation.