Cameras vs. Privacy:

1. Introduction

Cameras are getting better, cheaper and smarter all the time. It will not have escaped anyone's attention that individuals, companies and organisations increasingly want to use cameras for all kinds of purposes. However, the use of cameras brings with it significant risks of violating the fundamental right to privacy. Camera technology is widely accessible. The use of cameras is in principle permitted, and the collection and distribution of camera images is not in itself prohibited. From a legal perspective, a problem only arises when the use of cameras is in violation of the law or infringes on the rights of another person, for example through the placement and positioning of the camera or the content of the collected video and audio material.

Most cameras are capable of collecting both image and sound material. Legally, there is a distinction between video and audio material. For example, it is not permitted to collect audio material in the case of systematic camera surveillance. The distinction between video and audio material lies, among other things, in the fact that an audio recording may contain an utterance by a person or a conversation; separate standards apply to this, as they would if an audio recording was collected or distributed using a dictaphone or an audio recording app on a smartphone. For example, sound recordings made surreptitiously may constitute illegally obtained evidence, but in a civil case, illegally obtained evidence may still be used. The lawful use of audio material is a separate subject and will not be dealt with further in this article.

The question that arises is what legal boundaries are set within Dutch law for the use of cameras and the collection or distribution of camera images?

The following article outlines what you should legally speaking be aware of when using cameras.

2. Legal framework

2.1 The fundamental right to respect for private life

The fundamental right to respect for personal privacy is recognised in, among others, Article 10 of the Dutch Constitution and in various human rights treaties such as Article 8 of the European Convention on Human Rights.

The High Council of the Netherlands determined in the HR judgment of 9 January 1987, no. 12717, NJ 1987, 928, ECLI:NL:HR:1987:AG5500, section 4.4, that an infringement of the right to respect for personal privacy in principle constitutes an unlawful act (“onrechtmatige daad”). The prevailing line was confirmed more recently in HR 31 May 2002, ECLI:NL:HR:2002:AD9609.

The right to privacy is not an 'absolute' right, but can be weighed against other (fundamental) rights, interests or factors. The presence of a justification may deprive an infringement of its unlawful character. The existence of a justification can only be assessed in the light of the circumstances of the case by weighing the seriousness of the infringement of the right to respect for privacy against the interests that can reasonably be served by the infringing acts. It must also be considered whether the use of the camera meets the requirements of proportionality and subsidiarity.

Neighbourly disputes about cameras in and around plots of land that are partly aimed at the neighbour's plot of land and the public road occur fairly regularly in lower courts, in which the courts are asked to weigh up the interests of the user of the camera to protect his property and person, on the one hand, against the right to respect for the privacy of his neighbours, on the other.

A recent example is the judgment of the District Court of North Holland of 15 September 2021, ECLI:NL:RBNHO:2021:8075, in which the court ruled that the interest of the camera user to prevent destruction of his property outweighed the privacy interest of the plaintiff. In another recent ruling by the District Court of East Brabant on 17 February 2022, ECLI:NL:RBOBR:2022:387, the possible violation of the privacy of neighbours and third parties outweighed the security and supervision of the property of the camera user and the camera had to be removed.

2.2 Criminal law

In current practice, it often happens that a company or organisation asks - rightly - whether the use of cameras could be in violation of the EU General Data Protection Regulation 2016/679 (GDPR). However, there is another question that one may ask oneself when he or she wants to use a camera, namely "am I committing a criminal offence?".

The (covert) installation of cameras in toilets, changing rooms, shared living quarters or someone else's living quarters is punishable by law. Cameras are also tools with which certain criminal offences can be committed. An example of an offence committed with a camera is revenge porn, i.e. making, possessing and/or distributing sexual images of another person without permission. Since 1 January 2020, revenge porn has been made punishable in the Dutch Penal Code.

2.3 Other laws and regulations

If it is not a real camera, but a fake camera, for example as a deterrent, then there is no processing of personal data to which the GDPR applies, but at national and local level in the various EU Member States there may be laws and regulations regarding the use of fake cameras.

Municipal, provincial or other local regulations may contain special rules concerning the use of cameras on or around private property.

3. The GDPR

The General Data Protection Regulation (GDPR) applies to the processing of personal data. Camera images may contain personal data within the meaning of the GDPR. As a result, the GDPR and its provisions apply insofar as a camera processes or may process personal data.

3.1 Applicability

The General Data Protection Regulation (GDPR) applies to the processing of personal data. One way to avoid the GDPR applying to camera use is to position the camera in such a way that no personal data is processed. An example could be positioning a camera at a high or low angle and not pointing it directly at human faces at eye level, so that facial features or objects containing identifying data, such as a smartphone or a name tag, cannot be used to identify a person. Another example could be to deliberately make the image quality less sharp.

The type of camera and the functionalities it offers may influence the way the GDPR is applied. For example, a sufficiently 'smart' camera may be equipped with or form part of technology capable of processing biometric data through the use of artificial intelligence. Biometric data is also considered a special category of personal data and separate rules apply to the processing of this data.

What further distinguishes the 'smart' camera include the involvement of third parties in the processing of the camera images and the possibility of using AI to direct the camera or analyse the camera images. The relationship with a third party for the processing of such data, such as a hosting party, must be formalised in a data processing agreement within the meaning of Article 28 (3) GDPR. A particular point of attention when using 'smart' cameras is the risk that personal data may be reused more easily for other purposes in violation of the purpose limitation principle.

3.2 The Data Controller

If the GDPR applies to the processing of personal data by means of a camera, the question then arises as to who is the Controller within the meaning of the GDPR and who is subject to various legal obligations, including the general accountability for the processing of personal data in accordance with the following principles:

• legality, appropriateness and transparency
• purpose limitation
• minimum data processing
• correctness
• storage limitation
• integrity and confidentiality

The Controller is the entity that determines the purposes and means of the processing of personal data. The Controller may be a natural or legal person, a public authority, a department or another body.

Governmental bodies

Public authorities can use cameras in public spaces for the enforcement of public order, for example for traffic safety and the detection of crime. The use of systematic camera surveillance in publicly accessible areas by public authorities is subject to separate laws and regulations in addition to the GDPR.

Including the EU Data Protection Directive 2016/680 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
personal data by competent authorities for the purpose of prevention, investigation, detection or prosecution of criminal offences the detection and prosecution of criminal offences or the execution of penalties, and concerning the free movement of those data. In the Netherlands, that directive has been implemented in the Police Data Act (Wpg) and the Judicial and Criminal Records Act (Wjsg).

Carrying out a Data Protection Impact Assessment (DPIA) is mandatory when using systematic camera surveillance in public spaces by public authorities, such as the police.

Individuals

The GDPR does not apply to the processing of personal data that takes place in the domestic context. It is not always predictable where this 'lower limit' lies; in a specific circumstance it is possible that processing of personal data within the meaning of the GDPR has taken place in or around a house to which the GDPR does apply. For example, a professional social media influencer who collects visual material in and around his or her home and publishes it on the Internet for a large audience and for commercial purposes may not be able to invoke this exception for domestic use.

In most cases, disputes regarding the non-professional use of cameras in and around homes are settled on the basis of the unlawful act as described above in Section 2.1, and the question of whether the GDPR was applicable and has been violated does not arise. In theory, however, it may be possible that in a specific dispute, depending on the circumstances of the case, such a camera user may still be accused of violating the GDPR. If the GDPR still applies, the GDPR contains its own liability ground that allows for the awarding of immaterial damages rather than tort. The Dutch Data Protection Authority (”Autoriteit Persoonsgegevens”) can also issue fines.

In the journalistic context, more is allowed when it comes to infringing personal privacy, at any rate when societal interests are served, for example because a societal wrongdoing is exposed. In this situation, the right to privacy is weighed against the journalist's right to freedom of expression and the freedom of the press. Filming in public spaces is allowed in principle. Blurring or black bars over the eyes may be a measure in the journalistic context to address the impact on the right to privacy, but is not sufficient in every case, certainly if the blurring does not make the facial features or identifiable characteristics of a person sufficiently unidentifiable.

3.3 Purpose

Let us assume that the Controller in the sense of the GDPR, the party who determines the purpose and means (cameras), is not a public authority or an individual and does not wish to pursue improper purposes that would constitute a criminal offence. The systematic use of a camera to process personal data may be permissible if it is necessary for a legitimate and sufficiently defined purpose.

The necessity of the use of cameras is influenced by the principles of proportionality and subsidiarity. Proportionality relates to the question of whether the use of the camera is proportionate to the purpose that the Controller wishes to achieve with it. Subsidiarity relates to the question of whether the purpose of the Controller can also be achieved with a less drastic means than the use of cameras.

Performing a Data Protection Impact Assessment (DPIA) can be a useful means of documenting whether the intended use of cameras could adversely affect the rights and freedoms of individuals and of identifying the measures that the Data Controller could take to prevent or mitigate potential adverse effects on individuals. Even if performing a Data Protection Impact Assessment (DPIA) is not mandatory for your company or organisation.

3.3 Legal Basis

The six bases for the lawful processing of personal data are:

• Consent of the person the personal data concerns.
• It is necessary to process data in order to perform a contract with the person.
• It is necessary to process data because the Controller is legally obliged to do so.
• It is necessary to process data in order to protect vital interests of the person.
• It is necessary to process data in order to perform a task of general interest or public authority.
• It is necessary to process data in order to fulfil a legitimate interest of the Controller.

There is discussion about the question to what extent the processing of visual material via cameras should be regarded as the processing of the special category of personal data of racial or ethnic origin. If it concerns the processing of special personal data of race or ethnicity, an exception to the ban on processing these special personal data is also a requirement for the lawfulness of the processing. The exceptions to the ban on processing personal data on race or ethnicity are:

• A person has expressly consented to the processing of his or her personal data.
• The processing is necessary for the purposes of carrying out obligations or specific rights of the Controller or the person concerned in the field of employment law, social security law or social protection law.
• The processing is necessary to protect the vital interests of the person concerned or of another natural person, this only applies if that person is physically or legally incapable of giving his or her consent.
• The Data Controller processes the data as a foundation, association or other non-profit organisation working in the political, philosophical, religious or trade union field. This concerns data of (former) members or persons with whom the Data Controller has regular contact in relation to that objective. The Data Controller processes the data for legitimate activities and with appropriate safeguards.
• The Controller shall process personal data which the data subject has deliberately made public.
• The processing is necessary for the establishment, exercise or substantiation of a legal claim. Or you are acting at a court of law.
• The processing is necessary for an important public interest.
• The processing is necessary for purposes of prevention or (occupational) health care. Such as assessing fitness for work and/or providing health care.
• The processing is necessary for public health purposes.
• The processing is necessary for archiving in the public interest, scientific/historical research or statistical purposes.

3.4 Retention period of camera images

The guideline retention period for camera images collected with systematic camera surveillance by employers is 4 weeks, unless an incident is recorded. If the camera images record an incident, for example a theft, then the images of that incident may be retained for as long as is necessary to deal with the incident.

3.5 Transparency (warning signs)

Also on the basis of the GDPR, the Controller has the obligation to actively inform data subjects about the processing of their personal data, inter alia, on the basis of the principle of transparency.

When personal data are processed by means of cameras, part of the information of those involved is provided by warning signs. However, many warning signs with cameras are outdated and actually insufficient from the point of view of the GDPR. A sign that simply says 'camera surveillance' and a picture of a camera contains no information about the purpose or basis or the identity or contact details of the Controller that has placed the camera or had it placed.

4. Certain categories of persons in view of the camera

Employees

In practice, it is surprisingly common for employers to want to film their employees' activities right down to the toilet; this is of course not permitted. It was certainly during the lockdowns in response to the Covid 19 pandemic where working from home became the norm that employers began to question whether they could require their employees to have an 'open' webcam aimed at their face and their home workplace in order to monitor their behaviour and presence.

The employer is in any case legally obliged to behave towards his employees as a 'good employer'. In addition to this open norm, there is more concrete law and regulation, among others within the GDPR, to protect the employee who is in a dependent position towards his employer against infringement of his or her privacy in the workplace through covert or excessive monitoring and tracking.

In the eyes of the (European) legislator, the employee is in a very dependent position when it comes to the effective enjoyment of his fundamental right to privacy within the employment relationship. The psychosocial impact of surveillance on an employee is a subject that is often investigated in a European context.

If an employer intends to use camera surveillance on the work floor and there is a Works Council, the Works Council must give its consent. It follows from Section 27(1)(k) and Section 27(1)(l) of the Works Council Act (WOR) that the consent of the Works Council is required for so-called 'personnel monitoring systems'; personnel monitoring systems are facilities aimed at or suitable for observing or monitoring the presence, behaviour or performance of the persons working in the company.

Moreover, pursuant to article 25 paragraph 1 sub k, the Works Council has the right to advise on the introduction or modification of an important technological facility within the organisation.

According to the Dutch Data Protection Authority, secretly filming employees is only permitted for the purpose of combating theft or fraud. For training purposes or to assess the functioning of an organisation secretly filming would be too intrusive. The predecessor of the Authority for the Protection of Personal Data, the College Bescherming Persoonsgegevens, reprimanded MediaMarkt for secretly filming employees in an investigation of 21 November 2013. The Authority for the Protection of Personal Data continues this line and does not allow the surreptitious filming of employees for the purposes of training and performance assessment.

The employee must be informed in advance of any filming for training purposes and proportionality/substitutionality must be observed; for example, a training period should probably not be unnecessarily long in order to ensure proportionality.

It is often wise to document the awareness of potential risks to employee privacy, for example in a DPIA or in a separate camera protocol in a staff handbook.

Students

In contrast to employees, for students it was ruled in a notorious judgment of the Amsterdam Court of Appeal of 1 June 2021 ECLI:NL:GHAMS:2021:1560 (Proctorio) that the use of webcams directed at the faces of students during remote exams during the corona pandemic was permissible.

The court ruled that the use of Proctorio for the purpose of surveillance during examinations was allowed, partly because the University of Amsterdam's interest in complying with the obligation to conduct examinations under surveillance outweighed the students' privacy interests. In this specific case, the fact that the University of Amsterdam had carried out a prior investigation into the potential impact of the use of Proctorio on the privacy of the students and had sought advice from the Data Protection Officer (FG) of the educational organisation also weighed in the balance.

Although the average age of students at the University of Amsterdam was not discussed in this ruling, it is important to realise that students are on average 22 years old. The students are adults and no longer subject to compulsory education.

If this case had related to schoolchildren, it is possible that the weighing between the interests of the school to supervise by means of webcams during remote testing and the privacy interests of minors would have had a different outcome. The GDPR contains special rules with regard to the admissibility of the processing of personal data of children under the age of 16.

Visitors or the casual passer-by

If there are cameras in or around your company's or organisation's building, remember that other people's privacy may also be affected by the use of these cameras than those with whom your company or organisation has direct personal contact and who are more often present on site, such as those who work or study in the building. Even the casual passer-by or a visitor, i.e. a person who is only in the picture once, has the fundamental right to respect for his or her privacy.

The casual passer-by may therefore also be affected by the appearance on camera images. Given that there is probably no contractual relationship and little contact between the Data Controller and a casual passer-by, the possible bases and possibilities for actively informing such data subjects about the processing of their personal data are more limited.

From the perspective of the GDPR, the processing of this person's personal data must also have a valid basis and he or she must be informed that his or her personal data is being processed. It is possible, for example, to meet this requirement with warning signs that provide information at a glance about the presence and position of cameras, the purposes and the identity/contact details of the Responsible Party.

5. Rules of thumb

Do's

The following principles are useful to keep in mind.

1. Indicate transparently under whose responsibility the cameras are used. Which party decides whether, where, how and for what purpose the camera is used?
2. Indicate transparently the legitimate purpose for which cameras are used and why it is necessary to use cameras to achieve that purpose.
3. From which angle are the images collected? Do not point cameras directly at faces, for example by placing cameras high up or at a non-direct angle of view.
4. Do not make audio recordings during systematic camera surveillance.
5. Indicate clearly and transparently where the cameras are placed, which organisation is responsible and for what purpose the cameras are placed. The warning sign should also serve to inform the persons whose image may be processed. For example, a warning sign or a sticker with the symbol of a camera, the purpose: "to protect our property" and the logo of the organisation.
6. Use a retention period of no more than 4 weeks for camera images, unless the images in question record an incident, such as theft or assault. Store footage of incidents that still needs to be preserved, for example, as evidence in civil or criminal proceedings, separately.

Don'ts

1. Do not hang cameras in changing rooms, toilets or (shared) living areas.
2. Do not point cameras at workers without documented risk assessment, warning or consultation.
3. Do not point cameras at minors indiscriminately.

5. Conclusion

Unfortunately, there is no simple answer to the question of when the use of cameras is or is not permitted and for what purposes specific camera images may or may not be used. The answer to these questions depends very much on weighing up the interests within the given circumstances.

A wide range of laws and regulations are relevant to the use of cameras. These include the fundamental right to privacy in the Constitution and human rights treaties, criminal laws and regulations and the General Data Protection Regulation.

Various factors, such as the role, interests and purposes of the Controller; the principles of proportionality and subsidiarity; the incidental or systematic nature of the camera use; the positioning, location and functionalities of the camera; the categories of persons in view of the camera; completeness of warning signs; measures taken and many other factors all play a role in assessing the lawfulness of camera use.

Any advice on the legal implications of intended camera use should therefore be tailored to the circumstances of the case.

Advice

Will you be using cameras at your sites or during your activities? We can assist you with legal advice on the use of cameras for your purposes.

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!