GDPR Updates: New Guidelines, Code Of Practice, Regulatory Decision And CJEU Judgment

Guidelines on Video Devices. The European Data Protection Board (EDPB) has issued draft guidelines for public comment on the data protection issues arising from the use of video devices and video surveillance. The guidelines explain that controllers operating video systems must establish the legal ground for video processing, the most likely ground being a compelling legitimate interest of the controller, which overrides the interests, rights and freedoms of the data subjects, or for the establishment, exercise or defense of legal claims. As such, a real-life situation of distress needs to be at hand - such as damages or serious incidents in the past - to legitimize the use of video surveillance. The draft guidelines also indicate that the use of video devices must be adequate, relevant, proportional and limited to what is necessary in relation to the purposes for which they are used, consistent with the data minimization principle and the countervailing interests of data subjects. For this reason, a short retention period of one to three days is usually required, according to the draft guidelines.

The use of video systems with biometric recognition functionality by private organizations for their own purposes (e.g., marketing, statistics or security) in most cases requires the prior, explicit, specific, freely given and withdrawable consent of data subjects, because this processing is considered 'special categories of data' subject the special arrangements in Article 9 of the GDPR. The use of video systems with biometric recognition functionality also require special attention to the data minimization principle.

The draft guidelines emphasize that the use of video systems requires controllers to give data subjects the rights afforded to them under the GDPR, such as the right to access a copy of the footage (if the controller is able to search and identify the data subject in the footage) and the right to erasure in certain cases. Controllers must also inform data subjects of the use of video systems, using a dual system of warning signs to provide basic information and other means (e.g., link to an online webpage) to provide more detailed information.

CLICK HERE to read the EDPB's draft guidelines on processing personal data through video devices.

Guidelines on Cookies. The United Kingdom's privacy regulator - the Information Commissioner's Office (ICO) - has published guidance on websites' use of cookies. The guidelines urge websites to...