On February 8, 2024, the Office for Personal Data Protection (ÚOOÚ) released a new methodology for the design and operation of camera surveillance systems. This document updates and supplements the previous methodology from 2012 and responds to significant legislative changes in the field of personal data protection, primarily the introduction of GDPR.
Key Changes and Recommendations of the New Methodology
Expanded Definition of Personal Data Processing: The new methodology explicitly includes real-time (online mode) personal data processing as an activity that requires compliance with all legal obligations related to data protection. This is a significant change compared to the previous methodology, where such processing was not automatically considered as processing personal data.
Legal Bases for Processing and the Balancing Test: The methodology emphasizes the use of protecting legitimate interests as the basis for processing personal data. Operators must now perform a balancing test before installing a camera system to ensure that their legitimate interests do not conflict with the rights of the data subjects. The methodology provides detailed instructions on how to conduct this test, including practical examples and templates.
Classification of Camera Systems and Corresponding Measures: A new classification of camera systems is introduced based on the extent to which they can violate the rights and interests of subjects. Based on this classification, corresponding technical and organizational measures must be implemented to minimize risks and enhance the protection of processed data.
Documentation and Record-Keeping Requirements: The methodology specifies the documents that need to be prepared and maintained. This includes both the project documentation and an impact assessment on data protection, which is a new requirement in response to legislative changes.
Conclusion
The new ÚOOÚ methodology provides a clear and structured guide for administrators and operators of camera surveillance systems who want to ensure that their operations comply with current data protection requirements. With an emphasis on thorough preparation and preventative measures, the new methodology promises improved privacy protection and a safer environment for all involved parties. Its comprehensive and detailed approach offers operators not only guidelines on how to comply with legislation but also how to effectively respond to modern security and privacy challenges.
