The Spanish Supervisory Authority (AEPD) has published guidelines on the use of video cameras under the GDPR. The guidelines state, as a potential legitimate basis for video surveillance, the achievement of a task carried out in the public interest. The guidelines establish a list of accountability measures, security and risk analysis and other evaluations and key aspects to be considered in the context of video surveillance. Moreover, the guidelines clarify how to comply with the duty to provide information and address a wide variety of specific industry cases and circumstances sometimes differentiating by sectors.

Regarding the information to be provided to data subjects, the guidelines confirm that it is still mandatory to place an informative warning at the entrance to areas which are subject to video-surveillance, but this warning should be updated to comply with GDPR requirements. Further information should be made available to the data subjects at their request, particularly all the information required by Article 13 GDPR.