Video surveillance documentation

Frequently asked questions

What must be in place before video surveillance cameras are switched on?

Seven steps. 1) Take a decision on video surveillance and set a legitimate, specified purpose. 2) Carry out a data protection impact assessment if at least one case on the VDAI list applies. 3) Keep records of processing activities. 4) Keep a log of personal data breaches. 5) Prepare and approve video data processing rules setting out the legal basis, the responsible contact person and the procedure for storing, using and destroying recordings. 6) Put up information signs. 7) Restrict access to the recordings.

What must a video surveillance sign say, and where should it be placed?

The sign is the first layer of information. It states the purpose of the surveillance, who carries it out, how long recordings are kept, the contact details of the data protection officer (if one has been designated) and where more detailed information can be found. It is placed so that people recognise the surveillance before entering the monitored area, at roughly eye level. The second layer of information, the full content required by Article 13 of the GDPR, is made available in an easily accessible place, for example on an information sheet at the reception desk or the till, or on the website. A sign saying only “CCTV” does not meet the requirement.

How long can video recordings be kept?

The law does not set a specific period: you set it according to the purpose of the surveillance, and it must be defined as a specific number of days. The key rule: the period cannot be determined by the capacity of the recording device. “We keep as much as fits on the disk” is precisely the answer that the supervisory authority does not accept as a justification. The period must also comply with the storage limitation principle.

Can an employer film employees’ workstations?

Cameras must be placed at entrances, emergency exits and in common areas. An individual workstation must not be filmed in order to monitor the employee, except in exceptional cases, such as work involving cash, and even then the camera is pointed at the till, not at the cashier. In any event, employee monitoring is on the VDAI list of cases in which an impact assessment is mandatory.

Where is video surveillance prohibited?

Filming is not permitted in rest areas, kitchenettes or, above all, in areas requiring absolute privacy, such as toilets, changing rooms and similar. Nor may cameras be pointed at private homes or windows, even if the cameras themselves are installed on premises you control.

How must employees be informed about video surveillance?

Against signature, or in another way that proves they were informed, by providing the information referred to in Article 13(1) and (2) of the GDPR. This is a separate rule of Lithuanian law, and it covers not only video but also audio data and the monitoring of employees’ behaviour, location or movement. An information sign is not enough for employees: the sign is intended for other people.

Can sound be recorded together with video?

Audio recording is a separate and considerably more sensitive form of processing than video surveillance. The VDAI list names video surveillance combined with audio recording as a case in which a data protection impact assessment is mandatory. In practice, audio can almost never be justified for the ordinary purpose of protecting property and people, which is why standard video surveillance does not record sound.

Who may view video recordings?

Only an authorised person who needs such access to perform their duties. The video surveillance rules must state who may view the recordings, for what purposes, how long they are kept and how they are destroyed. Giving access to the whole board, to the building administrator as a whole or to all members of the owners’ association does not meet this requirement.

Who decides to install cameras in the common areas or courtyard of an apartment building?

Surveillance of common areas or of the building’s grounds may only be introduced with the approval of a majority of the owners of the flats and other premises. For a courtyard, the decision is usually taken by the co-owners: the owners’ association of the building or of several neighbouring buildings. Before cameras are installed, a vote of residents must therefore be organised, and the result of the vote becomes part of the documentation.

Must video surveillance documents be registered or approved by an authority?

No. None of these documents has to be submitted to any authority, but they must be in place before video surveillance begins. They are needed in two situations: when a dispute arises, and when the supervisory authority visits. At that point, the absence of the documents is in itself an infringement, regardless of whether the cameras were filming lawfully.

Can a recording be handed to the police, or to a person asking for footage of themselves?

These are two different cases, and both must be covered in the rules. Disclosure to law enforcement relies on a separate legal basis and must be recorded. A person’s request for access to their own data is a data subject right: the reply must be given within one month at the latest and free of charge, and when the recording is provided, the data of other people caught on camera must be protected. This is precisely why the retention period must be long enough for such a request to be fulfilled at all.

Is legitimate interest enough to justify video surveillance?

Legitimate interest is the most common legal basis where the purpose is to protect property and people, but it is not automatic. It must be justified in writing: you assess whether the interest exists, whether it overrides people’s right to privacy and whether the purpose cannot be achieved by less intrusive means. The assessment is made for each camera separately, because one camera may be justified while the next one is not.

Which video surveillance documents do you prepare?

We prepare a questionnaire about the video surveillance you carry out, use it to assess whether each camera has a legal basis, and prepare the video surveillance documents together with instructions on what to do with each document. We also assess whether your video surveillance requires a data protection impact assessment. The description of the purposes of the cameras is a separate element of the documentation: the EDPB guidelines require the purpose of each camera to be described in detail.

We want to install cameras in a dental practice’s waiting room and at the till. Where do we start?

With the purpose of each camera. The waiting room and the till are two different purposes, and a healthcare provider is one of the situations in which an impact assessment may be mandatory.

Is putting up a sign enough?

No. The sign is part of informing people, but it does not replace the assessment of the legal basis, the procedure and the records of processing activities.