One sign at the main entrance to the building does not meet the requirements. Information about video surveillance must be visible before entering each specific monitored room or area, not only when entering the building. The sign is placed at roughly eye level, so that a person understands before going in that they will be filmed and can judge what the camera sees. And for employees a sign is not enough at all: they must be informed against their signature.
Below: where this comes from, and what exactly the sign itself must contain.
Why one sign at the door is not enough
In its explanation (FAQ) on informing people about video surveillance, published on 23 July 2018, the State Data Protection Inspectorate (VDAI) stated that the controller must ensure that the required information is provided clearly and properly before entering the premises or area where video surveillance is carried out. This is the authority’s explanation, not an article of law, and it is worth reading exactly that way: it explains how the authority expects the duty to inform to be met.
One simple point follows from this wording. If only a few specific rooms are monitored rather than the whole institution, the information must reach the person before they enter those rooms. A sign at the front door tells people about the building, but not that, for example, a third-floor corridor or a storeroom is being filmed.
Paragraph 113 of the European Data Protection Board (EDPB) Guidelines 3/2019 on processing of personal data through video devices says the same thing in terms of position and height: the information should be positioned so that the data subject can easily recognise the circumstances of the surveillance before entering the monitored area, at roughly eye level, and can estimate the area covered by the camera. The Guidelines are not law either. They are a joint interpretation by European-level authorities, and in practice they are relied on during inspections.
Two layers of information
Paragraph 111 of Guidelines 3/2019 sets out a structure for providing information that resolves the most common dispute: how to fit all the mandatory information onto a sign.
The answer is that you do not have to. The most important information is given on a warning sign (the first layer). The other mandatory information is provided by other means (the second layer): online, at reception, or in a paper document that can be requested.
Which information is mandatory in the first place is set by Article 13(1) GDPR and Article 13(2) GDPR. It includes, among other things: the controller and its contact details, the purpose, the legal basis, what the legitimate interest is, the recipients, the retention period, the data subject’s rights and the right to lodge a complaint. A pictogram with a camera symbol on its own does not meet the requirements of Article 13 GDPR at either layer.
A case from practice
In one case, a client for whom this information was being clarified had a sign only at the main entrance to the institution. Formally, there was a sign, it was correct, and it contained what it needed to. The problem was its location. The sources above show that signs must be placed at the entrances to the specific monitored rooms, not only at the main entrance.
The same question comes up in almost every training session we run. That is exactly why we recommend checking it first: fixing it costs a few signs, while if it is left unfixed it is visible at once, without anyone looking into the documents at all.
For employees a sign is not enough at all
This is the second common mistake, and it is the more costly one. A sign informs a visitor. An employee needs a signature.
Article 5(4) of the Law on the Legal Protection of Personal Data (ADTAĮ) provides:
“Where video and/or audio data are processed at the workplace and in the controller’s premises or areas where its employees work, and where personal data relating to the monitoring of employees’ behaviour, location or movement are processed, those employees must be informed of such processing of their personal data against their signature or by another means proving the fact that they were informed, by being provided with the information referred to in Article 13(1) and (2) of Regulation (EU) 2016/679.”
Three things in this provision are practical. First, it applies not only to the “workplace” in the narrow sense, but also to premises and areas where employees work. Second, the method of informing is against signature or by another means proving the fact that they were informed. This means there must be a trace that can be shown. Third, what is provided is not a summary but all the information referred to in Article 13(1) GDPR and Article 13(2) GDPR, the same information that sits in the second layer.
Informing employees orally at a meeting meets Article 5(4) ADTAĮ only if a trace proving the fact remains. In practice the simplest option is a sheet to sign or an electronic confirmation.
What a first-layer sign must contain
- a camera symbol, so that it is clear from a distance;
- the controller’s name and contact details;
- the purpose of the surveillance, stated specifically, not with the word “security”;
- a reference to where the full Article 13 GDPR information can be found, that is, the second layer;
- position and height: at the entrance to each monitored room or zone, at roughly eye level, before entering the monitored area.
The second layer, the full video surveillance notice, sits where a person can reach it without asking: on the website, at reception, or provided on paper. For employees, the same text is provided against their signature.
How to start
The most useful way to start is a single walk-round: how many rooms are monitored, how many signs there are, and which ones are missing. It takes an hour and usually ends with a few new signs and one sign-off sheet for employees.
Write to us with how many cameras are running, in which rooms, and whether employees work in those rooms. We will tell you what is missing in your specific case and give you the price before we start. The first answer is free of charge. Email: info@linden.lt.
A practical step-by-step guide is on Privacio, a site built by Linden: Ar galime filmuoti patalpas ir teritoriją? (in Lithuanian). You can also check whether your organisation needs a record of processing activities with the Privacio tool (in Lithuanian).
More about this service: video surveillance documentation.