Given the proliferation of video surveillance systems, both in public and in private sectors (especially in the sectors of tourism, trade, health, and in communitarian buildings), and the increase in the complaints received by the Spanish Data Protection Agency (â€śAGPDâ€ť) against these systems, on January 28 2009, the AGPD presented a Guide on Video Surveillance. The Guide contains practical recommendations for the proper compliance, when using these systems, of privacy and personal data protection regulations. Among the obligations and recommendations provided by the regulations and the Guide published by the AGPD, which must be taken into account when installing a surveillance system in an office, private business, or premises, we highlight the following:
- The data controller must obtain the informed consent of the person regarding the collection and/or recording of his images. To this purpose, a written notice must be placed, in a sufficiently visible area, containing the information required by the Spanish Personal Data Protection Law, especially to inform about the rights assisting those persons recorded, and identifying the data controller responsible for such data processing.
- For video surveillance with private security purposes, it will be necessary to hire a security company duly accredited by the Spanish Interior Ministry.
- The decision to install a video surveillance system must always respond to the principle of proportionality, being especially accurate in sensitive environments such as schools, leisure areas or gyms, where surveillance should be the minimum necessary.
- In any case, cameras in private areas can not obtain images of public spaces, except if it is strictly necessary for the monitoring purpose or if it is impossible to avoid it because of their location.
- In working places, employees' rights must be always respected.
- When the recorded data is stored, the data controller will have to notify to the AGPD the existence of a file containing personal data.
- The appropriate security measures must be carried out in accordance with the Spanish Personal Data Protection Law, to ensure the safety of the images and to avoid their alteration, loss, or unauthorized access.
- In the case that the cameras installed are connected to the Internet, the data controller must also implement security measures such as identification and user authentication procedures, to avoid access by unauthorized third parties.
Finally, we recall that the installation of video surveillance systems, both in public and in private areas, must comply with the personal data protection regulations and any other applicable rules.