Conditions for CCTV monitoring

Do you want to use security cameras in your business? For example, to protect your staff, customers, or property? With CCTV or security camera’s you violate your employees’ and customers’ privacy. You may only install cameras if you meet the requirements set out in the General Data Protection Regulation GDPR (AVG). You cannot use cameras to assess employee performance.

Conditions for CCTV monitoring

Before you start with CCTV monitoring, you must meet these requirements:

• You must have a legal basis to use a camera. Often this is a legitimate interest. The reason you use a camera must be more serious than the privacy rights of your employees and customers. For example, to prevent theft or offensive behaviour.
• You must be able to demonstrate it is necessary to use video surveillance. You must make sure there is no other way to achieve your purpose. A way that has less impact on privacy.
• Is there a high privacy risk to the people you are filming? Then you must perform a data protection impact assessment (DPIA). A DPIA is always mandatory if you use camera surveillance on a large scale, or over a longer period of time or permanently.
• If your company has a works council, you must discuss your plans to use cameras with them. The works council must agree to camera surveillance.
• You take your employees’ and customers’ privacy rights into account. You must clearly indicate, with prominently placed signs or stickers for example, that CCTV cameras are in use and for what purpose.
• You cannot keep the camera images any longer than necessary. Did you record an incident? Then you can keep the recording until the incident is solved.

Use of a hidden camera

You an only make use of a hidden camera under strict conditions. For example, when there is a clear suspicion of theft or fraud by an employee and you have difficulty to put a stop to the theft or fraud.

If you use a hidden camera you must keep to the rules:

• You use the hidden camera temporarily.
• Impact on privacy must be as minimal as possible (you may not put up cameras in changing or toilet facilities).
• You let your customers or employees know in advance that you may use hidden cameras are in certain situations. For example, in staff regulations or camera surveillance regulations.
• If you want to film your employees with a hidden camera, the works council must give its prior consent. You must also inform the employees concerned about the use of a hidden camera afterwards.
• You must always conduct a DPIA. Does the DPIA indicate that there is a high privacy risk? And is it not possible for you to reduce this risk? Then you need to consult with de Dutch DPA (Autoriteit persoongegevens) on whether you can use a hidden camera. This is called a prior consultation.