Recently, the Dutch Data Protection Authority ("Dutch DPA") published new policy rules on camera surveillance ("Policy Rules"). Businesses and public authorities are ever more often using camera surveillance to provide security of persons and goods. This often entails the processing of personal data, as a result of which the Netherlands Personal Data Protection Act (Wet bescherming persoonsgegevens ("PDPA") applies. The use of camera surveillance is becoming more and more advanced. This is the reason why the Dutch DPA thinks that it is a good moment to publish its new Policy Rules on camera surveillance. These Policy Rules replace policy rules issued in 2004 on the use of cameras in public spaces and these policy rules are therefore more elaborate. The release of the new Policy Rules also provides a good opportunity to revisit what a (private) organisation has to take into account when using camera surveillance.
Rules for Camera Surveillance
The following general starting points are important.
- The purposes for the use of a camera must be determined. Camera surveillance can be a justified objective in a shop to secure properties from theft.
- A basis must be determined on which the processing of personal data can take place by means of a camera. Section 8 of the PDPA contains six general bases. A retailer (using camera surveillance) to secure visitors and property can be based on Section 8, under basis f, where the processing of data is necessary for the defence of the legitimate interests of the retailer. Under this basis:
- The camera surveillance must be necessary to achieve the objectives set. No disproportionate infringement may be made on the interests of data subjects (i.e. personnel in the shop or visitors to the shop) in relation to the objectives set (proportionality). If the objectives can be realised in another way which is less disadvantageous for the data subjects, camera surveillance is not permitted (subsidiarity). Therefore, cameras may not be used any more and no more persons and/or places may be brought into vision than is strictly necessary for the realisation of the objectives set. For instance, a shop manager who wants to start camera surveillance in order to find out whether money is stolen from the cash register of a shop may only film the cash register. In this instance it would not be necessary to film the entire shop.
- In principle, covert camera surveillance is not allowed, because it constitutes a great infringement on privacy. Only in exceptional circumstances will this be deemed necessary.
- Next, it must be determined which kind of camera or software technique is justified in a concrete case. Also in this case the interests of the data subjects must be considered.
- It must also be determined what will be done with the camera images. The statutory regime may impose further rules regarding the question to whom the images may be provided and how long the images will be retained. The PDPA also applies if the camera images are watched live.
- The camera images must in any case be adequately secured. Generally accepted security standards may be a guideline. It must also be checked whether the security measures have actually been taken and are complied with.
- The data subjects must also be informed about the use of camera surveillance. For instance, a shop owner will have to place a sign near the entrance if he has installed cameras in his shop. In the event of covert camera surveillance, the provision of information does not apply in so far as this is necessary in the interest of the prevention, detection and prosecution of criminal offences. This may also apply in the case of an employer, for instance in the event of a reasonable suspicion of theft or fraud. The following conditions must then be met:
- The employer must inform all employees in general terms in advance about the possible use of covert camera surveillance in the future.
- If there is a works council or a staff representation, they must have approved an arrangement regarding the covert camera surveillance.
- The employer must always inform the employees afterwards about the covert camera surveillance if he has actually proceeded to use this surveillance.
- Finally, it must be taken into account that the data subjects are entitled to inspection or correction.
Obligation to report
In principle, the use of camera surveillance must be reported to the Dutch DPA. Such a report must be made before starting the processing. If certain requirements (mentioned in Article 38 of the Exemption Decree (Vrijstellingsbesluit)) have been met this processing does not have to be reported: inter alia, the camera surveillance is set up to secure persons and goods which have been entrusted to the care of the controller, the camera surveillance is clearly visible and the personal data are deleted no later than four weeks after the video footage has been made. Covert camera surveillance must always be reported to the Dutch DPA.
Recent Case Law
In recent case law an employer was rapped on the knuckles for not complying with the rules and regulations on camera surveillance.
The employer had previously faced difficulties with three of its employees not following instructions. Separate to this, the employer had placed a number of hidden cameras. The employees were not aware of this and found the cameras whilst tidying and cleaning the workplace. As a result, they sent an angry but neat letter on behalf of a considerable number of employees in which they expressed their worries on and objections against the camera surveillance. The three employees concerned in these judgments had also put their names on the letter.
For the employer enough was enough and he requested the Subdistrict Court to terminate the employment agreements with those three employees. The Subdistrict Court terminated the employment agreements but also considered in detail the circumstances around the employer's use of the camera surveillance. The Subdistrict Court found that the rules around use of camera surveillance had not been met at all. For instance, the camera surveillance had not been disclosed, the works council had not been asked to consent, and the camera surveillance had not been reported to the Dutch DPA.
Therefore, the acts of the employer were regarded as seriously culpable As a result, the employees did not only get the ‘standard’ statutory transition fee, but on top of that a fair compensation was granted. The employer had to pay two employees an extra compensation of EUR 15,000, and to the other employee – who had been in the employment for a longer time – the employer had to pay EUR 48,000 (approximately two annual salaries).
Organisations should ensure that any use they make of camera surveillance in the Netherlands is in compliance with the new Policy Rules.
A press release on the Policy Rules can be accessed here (Dutch).
The Policy rules can be accessed here (Dutch).
Submitted by Nicole Wolters Ruckert and Leonie van Sloten of Kennedy Van der Laan – Amsterdam, The Netherlands, in partnership with DAC Beachcroft LLP.