When do you break the law with a camera on your house?

Chapters of the article

• Protection of the family house
• CCTV and GDPR
• CCTV in a residential building

There are no uniform rules for camera installation. It is important to distinguish whether you want to have it on a family or apartment building and whether the camera allows recording or not. Of course, you must pay attention to where it is directed and what it can capture. In some cases, installing a camera may violate the right to privacy protected by the Civil Code. Sometimes a camera system is subject to the data processing regime. Let’s discuss the basic rules that apply.

You want to protect your property, which is legitimate, but most people do not want to be filmed by you. And this is also not controversial. These two rights interfere with each other and need to be respected and balanced. In the words of the law, making a recording of a dwelling can also be an invasion of privacy, regulated by the Civil Code, which states that no one may invade the privacy of another unless he has a legal reason to do so.

First of all, without the permission of the person:

• monitor his private life and make any record of it
• further use or disseminate any such recordings.

Protection of the family house

The audacity of some thieves knows no bounds. The case of the “lame thief“, who did not even wait for families to go on holiday and robbed houses in their presence, has caused a stir. The highlight was when he sat on the bed of a sleeping nine-year-old at night. The public was able to learn of his actions thanks to cameras installed in and around the houses.

If you want to protect your family home, by law you can use the cameras. But you must meet several conditions:

1. If you install cameras inside the house, all people involved (and any visitors) should know about them and consent to them. You don’t need to formalise your consent in any way, just tell the visitor and they won’t object.
2. The outdoor camera should primarily monitor the house itself or your property. Your camera system should not take up unreasonable amounts of public space, i.e. not, for example, the entire width of a pavement many (tens of) metres long, but for example only the entrance to the house itself. An exception could be cases where your house is repeatedly damaged by vandals and it is necessary to occupy also a part of the street with the facade of the house. Similarly, in the case of a family house, cameras may only be directed at your own property; barbecuing and sunbathing by neighbours is already completely out of your filming remit.
3. If you take footage of passers-by along with your house, you must not use it anywhere. The exception is the use of the evidence in cases of theft, vandalism, etc.
4. You must protect the footage against misuse by outsiders.
5. The time limit for keeping records should be no more than a few days – just long enough to investigate any of the above. An exception to this might be, for example, during your vacation period, when you keep the record longer. Neighbourhood monitoring with more extensive recording would already be subject to the obligations under the General Data Protection Regulation and would only be permissible exceptionally (e.g. repeated serious attacks against the home of the camera operator from a public place).

CCTV and GDPR

If the above conditions are met (i.e. a camera for private purposes occupying only one’s own house or land, with a maximum of reasonable coverage in public spaces), there is no need to deal with (or even register) anything further. The operation of such a camera system is not considered to be processing of personal data subject to the GDPR regime.

On the contrary, it is processing of personal data if it is

• public space is systematically recorded,
• the recording may be used to identify individuals in connection with certain conduct.

In such a case, the recording will be subject to the obligations under the GDPR. In this context, it should be emphasised that the former mandatory registration of processing under the Data Protection Act has now been discontinued and there is now no need to register the CCTV system. Nevertheless, certain obligations remain.

The so-called controller (which is the entity that determines the purpose and means of processing personal data and is responsible for processing them) is obliged to keep records of the processing activities. Unlike the previous legislation, the record is not sent to the Data Protection Authority.

The processing of personal data within the CCTV system must comply with the following rules:

• It does not excessively interfere with privacy (in the last resort, it is allowed to enter people’s apartments with the explicit consent of the occupants, and filming of purely private areas such as changing cubicles, showers or toilets is strictly prohibited).
• The purpose of the recordings is clearly stated in advance and expresses the important interests of the controller, which are protected by law. Only in this context may the recordings subsequently be used.
• Thepurpose of using the CCTV system cannot be achieved in any other way (if it is intended to protect against theft and an easy-to-break lock is used at the same time, such a procedure is inappropriate).
• Those who may move within the range of the cameras shall be informed of their installation (no explicit consent is required, for example an information board is sufficient).
• The camera system and data carriers are properly secured against misuse by unauthorised persons.
• Thedata retention period has a precisely defined (reasonable) time limit, usually within a few days.

The aforementioned processing record is in the following form:

• Identification of the controller (common identification of the controller, i.e. the entity carrying out the processing).
• Purpose of the processing (e.g. protection of the controller’s property, life and health of persons by means of a permanent CCTV system).
• Description of the categories of data subjects (e.g. residents of the building, visitors, employees, etc.).
• Description of the categories of personal data (image and visual information on the behaviour and actions of the persons recorded).
• Recipients of the personal data and information on any transfer of personal data to third countries (e.g. law enforcement authorities or insurance company).
• Time limit for erasure (general retention period is X days, any record of the captured incident is retained for the time necessary for the hearing).
• Technical and organisational security measures against misuse of data.

Camera system in an apartment building

The above-mentioned personal data processing regime is also fulfilled by the camera system installed in the apartment building.

In connection with the installation of cameras in an apartment building, the most frequent question is whether the consent of the unit owners’ assembly is necessary or whether this can be avoided. According to a number of legal opinions, the lawful grounds for processing personal data on the basis of which the camera system is to be installed must be relied upon. The GDPR itself allows for the fulfilment of a legal obligation of the data controller (which may include obligations related to the management of the building and the land) as a ground (in addition to the consent of the data subjects).

Therefore, if there is a fundamental reason for data processing, then the consent of all residents/owners to the installation is not required (on the contrary, the Data Protection Authority considers requiring the consent of data subjects where they are superfluous to be a breach of the GDPR rules). Moreover, this consent could be withdrawn at any time, the residents of the house also change frequently and the whole situation would be highly opaque.

However, a CCTV system could be used in accordance with the above rules, provided that the purpose pursued cannot be effectively achieved by other means (e.g. a more secure door, better quality lock, etc.) and, if necessary, the manager must be able to demonstrate its necessity and usefulness.

Due to the sensitivity of the whole issue and the potential penalties for individual residents of the building, it is advisable to consult a solicitor before installing the system.

The camera is allowed to monitor areas such as:

• entrance doors to the house and areas around mailboxes,
• entrances to elevators and stairwells,
• the immediate surroundings of the house,
• attics and entrances to them,
• garages,
• carriage and wheel houses, entrance to cellars.

However, it is not possible to set up cameras so that they interfere with people’s privacy and, for example, occupy entrances to apartments, etc.