Video Recording

Video Recording / CCTV, Dash Cams, Action Cams, Drones and Other Video Recording Equipment

EU data protection legislation, such as the GDPR, may apply to people or organisations (as ‘data controllers’ or ‘data processors’) who record (‘process’) video and/or audio information about identifiable persons (‘personal data’).

Video recording equipment, can include CCTV, dash cams, action cams, camera-enabled drones, and other technologies. Where these types of equipment are used, users (as well as those recorded) should be aware of the potential application of the various rights and duties under data protection law to that recording. Guidance on the duties of data controllers can be found on the ‘For Organisations’ section of this website.

As a starting point, any person or organisation using recording equipment should remember that simply recording and/or storing video and audio data could be considered ‘processing’, even if no further use is made of that data. Further, that data may be considered ‘personal data’ where some individual can be identified from it. Thus both the context and quality of the recording can be highly relevant.

One thing which should be kept in mind, particularly by individuals who use or intend to use video recording equipment in either a commercial context or in a public place, is whether or not the recording falls under the ‘personal’ or ‘household exemption’ from the GDPR (under Article 2(2)(c) and Recital 18 GDPR). This exemption states that the GDPR does not apply to processing of data (such as recording video) by an individual “in the course of a purely personal or household activity”. If the recording does not fall within this category, then it is possible that the person making the recording has a number of obligations as a ‘data controller’ under the GDPR.

When assessing whether or not recording is purely of a personal or household nature, a number of factors should be taken into consideration, such as:

• whether it has any connection to a professional or commercial activity;
• who were the people involved in or captured by the recording – where they known to the person making the recording; and
• what area the recording covered – did it cover public or only private spaces.

A case from the Court of Justice of the European Union (CJEU) assists in understanding the extent of this exemption, making it clear that this exemption must be construed narrowly. In its judgment in the case of Rynes vs Urad (2014), the Court considered that;

To the extent that video surveillance… covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity ...

Although this case related to a fixed CCTV system, it is still helpful in deciding whether the exemption applies in cases where individuals are using other types of video recording equipment, such as ‘dash cams’ or ‘action cams’.

Ultimately, whether or not a recording was of a purely personal or household nature will depend on the facts of each case.

CCTV

Any individual using a CCTV camera in a non-commercial context, should still consider whether the personal or household exemption, in the particular circumstances of their CCTV set-up, and in light of guidance on the extent of the exemption (such as the Rynes case), applies in their case.

Where CCTV is used by an organisation, or by an individual in a commercial or otherwise non-exempted manner, the obligations of data controllers or data processors under the GDPR should be considered and complied with. First and foremost, they should be aware that any such processing of personal data under the GDPR is required to have a ‘legal basis’ under Article 6 GDPR. Further information on the obligations on data controllers and data processors can be found under the ‘For Organisations’ section of this website.

You may also want to consult the DPC’s published guidance on ‘Data Protection and Community Based CCTV Schemes’. This guidance paper contains both specific information on community based schemes, but also general principles which may be applicable to many instances of CCTV usage or other video recording.

Dash Cams

Due to the increased trend in the use by road users of ‘dash cams’, the DPC has produced specific ‘Guidance for Drivers on the use of "Dash Cams"’. Similarly to the guidance on CCTV, this guidance paper contains both specific information on the use of dash cams, but also general principles which may be applicable to many instances of video recording, such as dash cams.

Some of the issues that data subjects and users of dash cams should be aware of include:

• whether the cameras are outward- or inward-facing, or both;
• whether they record audio as well as video;
• whether they record video of the road ahead and/or other public spaces;
• the quality of any recording, and whether people are identifiable from it;
• how the recordings are stored and used; and
• whether any recording is done purely in a personal context.

Where users of dash cams consider they may be data controllers under the GDPR, they should consider the material found under the ‘For Organisations’ section of this website.

Action Cams and Drones

The DPC does not currently have specific guidance on the use of ‘action cams’ (such as GoPros) or drones capable of recording video, but, as you can imagine, many of the considerations relevant to CCTV and dash cams apply equally to the use of these types of video recording equipment.

In particular, users should consider the location in which they use these devices and the possibility of identifying any individuals recorded, and whether or not they are required to comply with certain obligations under data protection law, outlined under the ‘For Organisations’ section of this website.

Last updated: 4 February 2019