Legal Risks and Compliance for Corporate CCTV Systems

New rules of the game: Why are cameras after 2024 a ticking time bomb for your company?

One of the biggest changes is the end of the old practice where attention was primarily focused on recording cameras. The new methodology clearly states that GDPR applies to any camera system capable of identifying a natural person, including online cameras transmitting live footage without saving it. The previous approach, where the Office dismissed complaints about non-recording cameras, is definitively a thing of the past.

In recent years, the Czech Office for Personal Data Protection (ÚOOÚ) has intensified its inspection activities and does not hesitate to impose significant sanctions. Fines in the millions of CZK, such as the record sanction for Avast, clearly show the office's determination to severely punish violations of personal data protection rules. For companies, this means that ignoring the new rules is not a strategic choice, but a gamble with unpredictable consequences.

To navigate this issue, it is necessary to understand two key concepts. As soon as your camera captures a recognizable person, personal data processing occurs, triggering all obligations under GDPR. The most common legal basis for such processing is legitimate interest – typically the protection of property and persons. However, this is not a blank check. You must be able to prove and defend this interest at any time in a strict proportionality test.

The cornerstone of compliance: How to properly conduct a balancing test and defend your legitimate interest?

If you operate a camera system based on legitimate interest, the so-called balancing test is an absolutely crucial and irreplaceable document. This is not a recommendation, but an obligation. Without a carefully prepared and documented balancing test, the entire operation of your camera system is unlawful from the very beginning and indefensible during a potential inspection.

A balancing test is essentially a detailed analysis where you place your interest (e.g., property protection) on one side of the imaginary scales and the right to privacy of the monitored individuals on the other. Your interest must demonstrably prevail. The new methodology of the ÚOOÚ divides this process into four specific steps:

• Criterion of real threat: You must describe and document that your company faces a real and objective danger. A vague feeling of "what if" is not enough. It is ideal to rely on concrete data – records of past thefts or vandalism, police crime statistics in the given location, or documented incidents.

• Criterion of necessity: You must prove why milder, less invasive means are not sufficient to achieve the monitored goal. Why is better fencing, higher quality locks, an alarm, or physical security not enough? This step requires comparing different solution variants and justifying why the camera system is necessary.

• Criterion of suitability: The chosen solution must be suitable for achieving the goal. This phase analyzes non-financial and financial benefits and proves that the installation of the system is an effective and meaningful measure.

• Criterion of balancing (proportionality): In the final step, the final "weighing" takes place. Does your interest in protecting property outweigh the intrusion into the privacy of employees, customers, and passers-by? The intrusion into privacy must be as minimal as possible and fully proportionate to the pursued purpose.

It is crucial to realize that the balancing test must be specific to the given location and purpose of the cameras. A generic, downloaded template will not stand up to an inspection. At ARROWS, our Czech legal team specializes in preparing this key documentation and will ensure that your balancing test is bulletproof.

Critical risks when conducting a balancing test

From signs to security: Key operational obligations you must not underestimate

Having a perfectly prepared balancing test is the foundation, but compliance is primarily about daily practice. There are several key operational obligations, the neglect of which can lead to serious problems.

Two-layered information obligation

Everyone entering a monitored area must be clearly and comprehensibly informed. The practice of the ÚOOÚ requires a so-called two-layered approach:

• First layer (information sign): A sign must be visibly placed at every entrance. A mere camera pictogram is not enough. The sign must contain a pictogram, the text "The area is monitored by a camera system", the identification of your company as the controller, and a link where more detailed information can be obtained (e.g., at the reception or on the website).

• Second layer (detailed information): Complete information under Article 13 of the GDPR must be available at the location referenced by the sign. This includes the purposes of processing, the legal basis, the retention period of records, information on rights (right of access, erasure, etc.), and other requirements.

Retention period of records

The principle of data minimization dictates that records should only be kept for the strictly necessary period. In the practice of the ÚOOÚ, 72 hours is usually considered a reasonable period. Any longer period (e.g., 7 or 14 days) must be very strongly justified in the balancing test by specific operational needs, such as a longer absence of the responsible person over the holidays. The technical capacity of the recording device is not a relevant argument.

Security and access to records

The entire camera system – from the cameras themselves through the cabling to the recording device – must be secured against unauthorized access, destruction, or loss.

Access to the captured records must be strictly limited to a minimum number of trained and authorized persons. It is essential to keep a log of who accessed the records, when, and for what reason. This record-keeping is crucial for demonstrating compliance during an inspection.

Last but not least, you must not forget the obligation to maintain so-called records of processing activities under Article 30 of the GDPR. This is an internal document that maps all personal data operations in your company, including the camera system. You must present this document to the ÚOOÚ upon request.

The lawyers at ARROWS will help you prepare all necessary internal directives and documentation to ensure your operational practice is fully compliant with the law.

Cameras in the workplace: The thin line between property protection and impermissible monitoring of employees

Monitoring employees is one of the most sensitive and legally complex areas. This is because it involves not only the GDPR but also the stricter rules of the Czech Labor Code. Employers thus operate under a dual regulatory framework, where a mistake can lead to sanctions from two different authorities – the ÚOOÚ and the State Labor Inspection Office.

While "legitimate interest" is generally sufficient for property protection, Section 316 of the Czech Labor Code allows employee monitoring only if there is a "serious reason consisting in the special nature of the employer's activity". This is a significantly stricter condition. Typically, it is met by high-risk operations such as banks, jewelry stores, facilities handling hazardous substances, or pharmacies. Standard office work usually does not pass this test.

There are also absolute prohibitions. It is impermissible to place cameras in areas where employees have a legitimate expectation of privacy, such as changing rooms, toilets, showers, kitchenettes, or break rooms. Even if thefts occur in these areas, camera monitoring is not an acceptable solution.

The basic rule is open and transparent monitoring. Employees must always be informed in advance and in detail about the purpose, scope, and method of monitoring. Covert monitoring is possible only in completely exceptional cases, which is also confirmed by the case law of the European Court of Human Rights. The condition is a reasonable suspicion of serious criminal activity (e.g., large-scale theft), and such monitoring must be limited in time and space and targeted only at specific suspects.

Legal risks in employee monitoring

Your business knows no borders. And your data? International aspects of camera systems

In today's digital age, it is common that data does not circulate only within one country. Many companies use cloud storage for camera footage without realizing where the servers are physically located. If your cloud service provider is established outside the European Economic Area (EEA), for example in the US, any transfer of footage to their server is considered an international transfer of personal data and is subject to the strict rules of Chapter V of the GDPR.

To legally transfer data to so-called third countries, it is necessary to ensure an appropriate legal mechanism. This can be:

• Adequacy decision: The European Commission can decide that a certain country provides a comparable level of data protection to the EU. Transfer to such countries (e.g., the UK, Switzerland) is then simpler.

• Standard Contractual Clauses (SCCs): For countries without an adequacy decision (including the US), it is necessary to conclude so-called Standard Contractual Clauses with the service provider. This is a standardized contract approved by the European Commission that contractually obligates the data recipient to comply with GDPR standards.

Moreover, even within the EU, national legislatives can differ in details. For example, the German Federal Data Protection Act (BDSG) is traditionally perceived as one of the strictest. For companies operating in multiple states, navigating this maze of rules without expert help is almost impossible.

Thanks to the ARROWS International network built over ten years, we handle issues with an international element daily. We are able to review your contracts with global providers, ensure the implementation of necessary SCCs, and guarantee that your international data flows are fully compliant with the GDPR.

Summary

Setting up a camera system correctly is not a one-time task, but a process that requires expertise and diligence. At ARROWS, we approach this issue comprehensively and offer a partnership that ensures long-term legal certainty for your company.

Our process begins with a legal consultation where we analyze your needs and goals in detail. Based on this, we will conduct a complete audit of your existing or planned system and prepare key documents, such as a robust balancing test and, if necessary, a Data Protection Impact Assessment (DPIA). We will prepare all documentation that protects you from fines, including internal directives for system operation and records of processing activities.

Our experience from long-term services for more than 150 joint-stock companies, 250 LLCs, and 51 municipalities and regions gives us a unique insight into your situation. We pride ourselves on speed and high quality. If your business extends beyond borders, we will arrange a review of contracts with global partners through our international network. And because prevention is the best protection, we offer professional training for employees or management, including a certificate.

And if the worst should happen, we are ready to represent you with full commitment before courts and administrative authorities, such as the ÚOOÚ. However, our role does not end with legal paragraphs. We enjoy connecting clients with interesting business opportunities and listening to their business ideas.

Do not wait for an inspection from the authority. Ensure peace of mind and legal certainty today. Contact us at consultation@arws.cz and get a tailor-made legal solution.