CCTV monitoring and the practice of the Hungarian DPA
CCTV monitoring affects a wide number of organizations and employers. Data processing by CCTV operation is covered by the GDPR in Hungary and Hungarian monitoring laws mainly provide additional rules in terms of internal system management and access rights, as well as data security, and require enhanced transparency bearing in mind the technology’s effect on the private sphere of individuals monitored.
Another key issue lies in the legal basis of the related data processing. The most common legal basis in case of operating a CCTV system is the legitimate interest of the controller operating it. Controllers often face harsdhips, however, in demonstrating such legitimate interest. In its decision published last year, the Hungarian DPA highlighted, for example, that the operation of a CCTV system cannot be used to prevent disputes in a retirement home between patients and staff members, since other means are at hand, which provide less invasion into the privacy of the individuals monitored. The Hungarian DPA also highlighted many times that a CCTV system cannot be used to assess the quality of work in case of employees (e.g. whether the employee is properly dressed or works efficiently), since such practice leads to an invasion of the employees’ privacy and the interests of the employee hugely outweigh the employer’s economic interests in such a case.
With regard to the above practice, it is highlighly recommended for controllers to carefully assess whether monitoring a given area is necessary to protect their legitimate interests and what arguments they can provide to prove that. In case of using a CCTV system for the purpose of property protection (e.g. monitoring goods or equipment in a warehouse), it is a good practice for the controller to give examples in the legitimate interest test from the recent past of related crimes (e.g. burglary or theft) that took place in the area or to detail security concerns, which necessitate the operation of a CCTV system.
With regard to the above, it can be highlighted that controllers are required to carefully plan their data processing by CCTV with respect to each area monitored. Providing documented information to individuals visiting such areas and being able to prove the necessity of the operation are the cornerstone of compliance, as well as the internal training of employees operating the system and having access to such recordings on the data protection aspects of their activity and on the rights of the individuals concerned.
Article provided by INPLP member: Kinga Madocsai (SimpLEGAL, Hungary)
Dr. Tobias Höllwarth (Managing Director INPLP)