Video Surveillance

Legal Framework

Video surveillance falls squarely within the scope of the GDPR whenever cameras capture identifiable individuals. Article 4(1) defines personal data to include any information relating to an identified or identifiable natural person, and the image of a person recorded by a camera constitutes personal data because it enables identification of the data subject. The household exemption under Article 2(2)(c) GDPR (formerly Article 3(2) of Directive 95/46) removes purely personal or domestic processing from the regulation's scope, but the boundaries of that exemption are narrow and contested where cameras capture anything beyond the controller's own private sphere.

Controllers deploying video surveillance must identify a lawful basis under Article 6 GDPR, most commonly Article 6(1)(f) (legitimate interests), which requires a three-part balancing test: the controller's interest, its necessity, and proportionality against the data subject's rights. Additional obligations attach under Articles 5, 12–14, and 35 GDPR, including purpose limitation, data minimisation, transparency, and—where systematic monitoring occurs—data protection impact assessments.

The AI Act adds a further layer. Recital 43 establishes that AI systems which create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage are prohibited. This reflects the legislature's concern that such practices contribute to a sense of mass surveillance and risk gross violations of fundamental rights, including the right to privacy under Article 8 ECHR.

Key Developments

The CJEU's ruling in Ryneš v. Úřad pro ochranu osobních údajů (11 December 2014) remains the foundational authority on the household exemption. The Court held that video surveillance covering even partially a public space cannot qualify as a purely personal or household activity, because the camera is directed outward from the private setting. A homeowner who installed a camera to identify vandals and whose footage captured a public street was therefore fully subject to data protection law.

Dutch civil courts have extended this logic to neighbour disputes, ordering removal or reconfiguration of cameras where they capture neighbouring property without a sufficient legal basis. Meanwhile, criminal courts have applied Article 139h of the Dutch Criminal Code to penalise covert photography where the presence of the recording device was not made apparent to the subject.

Enforcement by national DPAs has been granular. The Spanish DPA fined a landlord €1,800 for deploying cameras inside rental apartments without a sufficient legal basis, and fined a dental clinic €1,200 for surveillance that exceeded its stated security purpose. Both decisions underscore that purpose limitation and proportionality are actively policed.

The EDPB's Guidelines 3/2019 on video devices provide the operational standard, covering signage, retention periods, and access restrictions. The EDPB's Guidelines 05/2022 on facial recognition in law enforcement signal increasing scrutiny of biometric processing through cameras.

Practical Guidance

• Assess the household exemption carefully. Any camera capturing a public space or a third party's property—even incidentally—removes the processing from the Article 2(2)(c) exemption and triggers full GDPR compliance, per Ryneš ¶33.
• Establish a documented lawful basis and purpose. Relying on Article 6(1)(f) requires a written legitimate-interests assessment demonstrating necessity and proportionality. Security is a valid interest, but recording inside private living spaces (as in the Spanish landlord case) will rarely survive the balancing test.
• Provide visible notice. Signage must inform data subjects of the surveillance, the controller's identity, the purpose, and retention periods, satisfying Articles 13–14 GDPR. Covert recording risks both administrative fines and criminal liability under national law.
• Minimise capture scope and retention. Configure camera angles to avoid public spaces and third-party property where feasible. Set retention periods to the shortest duration consistent with the stated purpose; indefinite storage is disproportionate.
• Prohibit untargeted facial-image scraping. Building or expanding facial recognition databases by scraping images from the internet or CCTV footage is prohibited under the AI Act. Any biometric processing through video devices requires a DPIA under Article 35 GDPR and, in most contexts, explicit consent under Article 9(2)(a).