What is camera surveillance legislation? Explanation and use

What is a camera surveillance regulation? It is an internal document in which an employer sets out why, where, and how they deploy cameras and how they protect the privacy of employees and visitors in doing so. The regulation substantiates the legal basis under the GDPR, usually legitimate interest (Art. 6 para. 1 sub f GDPR), and describes the necessity, proportionality, retention period of the footage, and who is permitted to view it. Furthermore, for camera surveillance directed at personnel, the consent of the Works Council is required (Art. 27 para. 1 sub l WOR). The regulation makes the surveillance transparent and verifiable.

The short answer

• Camera surveillance regulations specify why, where, and how you deploy cameras.
• It substantiates the GDPR legal basis, usually legitimate interest (Art. 6 para. 1 sub f GDPR).
• It describes the necessity, proportionality, and subsidiarity of the supervision.
• It regulates the retention period; the guideline is a maximum of four weeks, longer only in the event of an incident.
• It makes the supervision known by means of signs and information to those concerned (Art. 13 GDPR).
• Camera surveillance of staff requires the consent of the Works Council (Art. 27, paragraph 1, sub l of the Works Councils Act).

What exactly is a camera surveillance regulation?

Camera surveillance affects the privacy of everyone captured on camera: employees, customers, and passers-by. The GDPR requires an employer to be able to justify this processing of personal data. A camera surveillance regulation is the document in which this justification is detailed. It sets out the purpose for which the cameras are installed, the interests served by them, and why there is no less intrusive means. In this way, the regulation makes visible the balancing act required by law.

The regulations are therefore not a formality, but the place where you demonstrate that your surveillance is lawful. In the event of a complaint or an inspection by the Dutch Data Protection Authority, this is the document with which you substantiate that the cameras are necessary and proportionate and that you have correctly informed the data subjects. Without regulations, that substantiation is missing, and you run the risk that the surveillance will be deemed unlawful.

The GDPR basis: legitimate interest

For most companies, camera surveillance is based on the legitimate interest under Art. 6(1)(f) of the GDPR. Examples include the protection of property, the safety of personnel, or the prevention of theft. To rely on this, you must go through three steps. First, there must be a concrete, legitimate interest. Second, camera surveillance must be necessary to serve that interest, and there must be no less intrusive means available, such as better locks or lighting; this is subsidiarity. Finally, you weigh your interest against the privacy of the data subjects; this is proportionality.

You record that assessment in the regulations. Moreover, for systematic, large-scale monitoring, a Data Protection Impact Assessment may be required (Art. 35 GDPR), in which you map out the risks to data subjects. This is usually not required for a single camera at the checkout, but it often is for extensive surveillance in the workplace.

Awareness and retention period

In principle, camera surveillance may not be covert. You must inform those involved in advance that cameras are installed, for what purpose, and who is responsible. This is done via visible signs or stickers at the entrance and by referring to the regulations or the privacy statement, in line with the duty to inform under Art. 13 GDPR. Anyone who appears in the footage must know that they are being filmed. Temporary covert camera surveillance is permitted only in exceptional cases, in the event of a concrete suspicion and after careful consideration, and even then, it must be made clear in advance that covert cameras may be deployed.

Equally important is the retention period. The guideline from the Dutch Data Protection Authority is that footage should not be retained for longer than four weeks. Only if the footage contains a concrete incident may you retain that specific recording for longer, until the incident has been resolved. Record the term and the exception in the regulations, specifying who may view the footage and under what conditions.

Consent of the Works Council

If the camera surveillance is also aimed at the behavior or performance of personnel, it is a personnel monitoring system. The Works Council has the right of consent regarding its introduction, modification, or withdrawal (Article 27, paragraph 1, subparagraph l of the Works Councils Act). Without that consent, the decision is voidable. Even without a Works Council, it is advisable to inform and involve the staff in advance, because surveillance in the workplace affects the employment relationship.

An SME wholesaler installs cameras in the warehouse following repeated stock theft. The company draws up regulations in which the theft is substantiated as a legitimate interest, the cameras are aimed only at the storage zones and not at the canteen, and the footage is deleted after four weeks. The Works Council approves, and signs are displayed at the entrance. When an employee later complained about privacy, the company was able to demonstrate with the regulations that the surveillance was necessary, proportionate, and transparent.

Honest recommendation

You don't need a lawyer to understand the basics. If you install a single camera at your store entrance, aimed at your own access and not at staff, and inform visitors with a sign and a brief privacy statement, a simple set of regulations will suffice. However, as soon as surveillance is also directed at employees, involves multiple cameras, or affects sensitive zones, the regulations become the place where you substantiate lawfulness and involve the Works Council. In that case, have them drafted or reviewed by someone familiar with the GDPR balancing act, retention periods, and the right of consent.

Want to read more? View the camera surveillance regulations on our contracts page, read how to go drafting camera surveillance regulations , and what it costs to camera surveillance regulations drawn up .

Frequently Asked Questions