Video Surveillance Systems

Video Surveillance

• I want to install/renovate a video surveillance system to protect people. How should I proceed?

In order to install/renew a video surveillance system, it must meet several legal requirements, which may include, in addition to the RGPD and the national law that executes it – Law 58/2019, Law 34/2013, which regulates the activity of private security, or the Labor Code, whichever is applicable to your specific situation.

With the new European data protection regulation, it is no longer necessary to request authorization or make any notification to the CNPD to communicate anything in order to have a video surveillance system.

• Is it mandatory to post an information notice?

Yes. Data subjects have the right to be informed about the use of video surveillance systems. The information notice must comply with the provisions of article 31, paragraphs 5 and 6, of Law 34/2013 and respective regulatory ordinance.

• How long do I have to keep video surveillance images?

Unless your organization is covered by specific video surveillance legislation that imposes certain deadlines, you must keep the images for a period of 30 days, and it is mandatory to delete the images within 48 hours after the 30 days. This is without prejudice to the need to keep the images for longer, in the context of ongoing criminal proceedings.

• What are the places where I cannot put cameras?

The installation of video surveillance aims to protect people and property, either for its potential deterrent effect, or to allow the identification of the perpetrator in criminal proceedings. Therefore, the placement of the cameras must take into account the strict need to maintain a security perimeter and to control access from the outside, in a way that is adequate to the circumstances of the place and in a proportionate way so as not to excessively restrict the rights of citizens.

Thus, the councils cannot focus on public roads, neighboring properties or other places that are not the exclusive domain of the person in charge.

Nor can they focus on the interior of areas reserved for clients or users, such as: restrooms, waiting areas, technical hairdressing areas, rest or leisure areas, the interior of elevators, dining rooms, terraces, changing rooms, indoor pool or gym.

When placing the cameras, special care must be taken so that they do not allow capturing images of the typing of security codes in payment terminals or ATMs.

In educational establishments, the cameras can only focus on the external perimeters and places of access and also on spaces whose goods and equipment require special protection, such as laboratories or computer rooms.

The balance between the legitimate interest of the company or public entity and the rights of individuals must always be made by the data controller, with the exception of places already prohibited by law (article 19 of Law 58/2019) or legally authorized in special legislation.

• When the law requires video surveillance systems, how to proceed?

In some specific sectors of activity, there is special legislation that requires the installation of CCTV systems, such as in financial establishments, gas stations, jewelers, gunsmiths or scrap metal companies.

In these cases, the basis for the legitimacy of video surveillance is based on compliance with a legal obligation, but in terms of procedure, it does not change in any way what was explained above. All other legal obligations must be observed.

• WHICH ENTITIES ARE OBLIGED TO MAKE PRIOR REGISTRATION WITH THE NATIONAL DIRECTORATE OF PSP?

Entities that carry out the study and design, installation, maintenance or technical assistance of security material and equipment (video surveillance systems, access control systems and intrusion detection systems) or of alarm centers.

• IS THE INSTALLATION OF VIDEO SURVEILLANCE SYSTEMS SUBJECT TO PSP REGISTRATION?

The video surveillance systems used by entities holding a permit or license A, C or D, as well as the systems in which these entities are responsible for the processing of personal data, need to be registered with the National Directorate of PSP, as established in Article n. 51 of Ordinance No. 273/2013, amended by Ordinance No. 106/2015.

Failure to register the video surveillance system with the National Directorate of PSP, pursuant to paragraph 1 of Article 31 of Law No. 34/2013, constitutes a very serious administrative offense punishable by a fine of €600 to €3,000, when committed by single person, and a fine of €15,000 to €44,500, when committed by a legal person.

Intrusion

• IS THE INSTALLATION OF INTRUSION DETECTION SYSTEMS SUBJECT TO REGISTRATION?

The installation of alarm devices in property that has an outdoor siren or communication equipment capable of triggering a call to the national emergency number or to the security forces is subject to communication and registration, by its owner, with the police authority of the area, in the within 5 working days after installation.

The purpose of this communication is to ensure that, in the event of an alarm, the owner or user of the system ensures that the alarm is reset within three hours, counting from the communication of the competent police authority.

This obligation stems from the Private Security Legal Regime, established by Law nº 34/2013, of 16 May, more specifically in its article 11th.

Failure to register the intrusion system with the police authority in the area, pursuant to paragraph 3 of article 11 of Law no. 34/2013, constitutes an administrative offense punishable by a fine of €300 to €1,500, when committed by a single person, and a fine from €7,500 to €37,500, when committed by a legal person.

• INSTALLATION AND MAINTENANCE

In order to ensure the reliability of the systems, they must be installed by a specialized security company, with qualified technicians and duly registered with the National Directorate of PSP, and it is recommended that they be subject to regular periodic inspections and maintenance procedures with a minimum frequency annual and in compliance with the applicable legislation in force, namely with regard to the registration of intrusion alarm systems (to be carried out by the owner), when applicable.