When do you break the law with a camera on your house?

There are no uniform rules for camera installation. It is necessary to distinguish whether you want to have it on a family or apartment building and also whether the device allows recording or not. Of course, you must pay attention to where it is directed and what it can capture. In some cases, installing a camera may violate the right to privacy protected by the Civil Code. Sometimes a camera system is subject to the data processing regime. Let’s discuss the basic rules that apply.

Protecting property is legitimate, but most people do not want to be recorded without consent. And this also cannot be disputed. These two rights interfere with each other and need to be respected and balanced. Making a recording may constitute an invasion of privacy as defined by the Civil Code, which states that no one may invade the privacy of another unless he has a lawful reason to do so.

First of all, without the permission of the person:

• monitor his private life and make any record of it
• further use or disseminate any such recordings.

Protection of the family house

The audacity of some thieves knows no bounds. The case of the “lame thief“, who did not even wait for families to go on holiday and robbed houses in their presence, has caused a stir. The highlight was when he sat on the bed of a sleeping nine-year-old at night. The public was able to learn of his actions through cameras installed in and around the houses.

If you want to protect your family home, by law you can use the cameras. But you must meet several conditions:

1. If you install the devices inside the house, all people involved (and any visitors) should know about them and consent to them. You don’t need to formalise your consent in any way, just tell the visitor and they won’t object.
2. The outdoor camera should primarily monitor the house itself or your property. Your monitoring system should not unduly occupy public space, i.e. not, for example, the entire width of a pavement many (tens of) metres long, but only the entrance to the house itself. An exception could be cases where your house is repeatedly damaged by vandals and it is necessary to occupy also a part of the street with the facade of the house. Similarly, in the case of a family house, cameras may only be directed at your own property; barbecuing and sunbathing by neighbours is already completely out of your filming remit.
3. If you accidentally catch passers-by, you must not use the footage without their consent – the exception being for evidential purposes (e.g. in the case of theft). The exception is the use of evidence in cases of theft, vandalism, etc.
4. You must protect the recordings against misuse by outsiders.
5. The retention period for records should be no more than a few days – just long enough to investigate any of the above. An exception to this might be, for example, during your vacation period, when you keep the record longer. Neighbourhood monitoring with more extensive recording would already be subject to the obligations under the General Data Protection Regulation and would only be permissible exceptionally (e.g. repeated serious attacks against the home of the camera operator from a public place).

CCTV and GDPR

If the above conditions are met (i.e. a device for private purposes occupying only one’s own house or land, with at most a reasonable footage in the public space), there is no need to deal with (or even register) anything further. If a natural person operates a CCTV system solely for personal use and the coverage is limited to his own property, this is not processing within the meaning of the GDPR.

On the contrary, it is processing of personal data if it is

• public space is systematically recorded,
• the recording may be used to identify natural persons in connection with a particular act.

In such a case, the recording will be subject to the obligations under the GDPR. In this context, it should be emphasised that the former mandatory registration of processing under the Data Protection Act has now been discontinued and there is now no need to register the CCTV system. Nevertheless, certain obligations remain.

The so-called controller (which is the entity that determines the purpose and means of processing personal data and is responsible for processing them) is obliged to keep records of the processing activities. Unlike the previous legislation, the record is not sent to the Data Protection Authority.

The processing of personal data within the CCTV system must comply with the following rules:

• It does not excessively intrude into the privacy of the person’s home (in the last resort, it is possible to enter the home with the express consent of the occupants, and filming of purely private areas such as changing cubicles, showers or toilets is strictly prohibited).
• The purpose of the recordings is clearly stated in advance and expresses the important interests of the controller, which are protected by law. Only in this context may the recordings subsequently be used.
• The purpose of using the CCTV system cannot be achieved in any other way (if it is intended to protect against theft and an easy-to-break lock is used at the same time, such a procedure is inappropriate).
• Those who may be within range of the equipment shall be informed of its installation (no explicit consent is required, for example an information board is sufficient).
• The camera system and data carriers are properly secured against misuse by unauthorised persons.
• The data retention period has a precisely defined (reasonable) time limit, usually within a few days.

The aforementioned processing record is in the following form:

• Identification of the controller (common identification of the controller, i.e. the entity carrying out the processing).
• Purpose of the processing (e.g. protection of the controller’s property, life and health of persons by means of a permanent CCTV system).
• Description of the categories of data subjects (e.g. residents of the building, visitors, employees, etc.).
• Description of the categories of personal data (image and visual information on the behaviour and actions of the persons recorded).
• Recipients of the personal data and information on any transfer of personal data to third countries (e.g. law enforcement authorities or insurance company).
• Time limit for erasure (general retention period is X days, any record of the incident captured is retained for the time necessary for the hearing).
• Technical and organisational security measures against misuse of data.

Camera system in an apartment building

The above-mentioned personal data processing regime is also fulfilled by the camera system installed in the apartment building.

In connection with the installation of cameras in an apartment building, the most frequent question is whether the consent of the unit owners’ assembly is necessary or whether this can be avoided. According to a number of legal opinions, the lawful grounds for processing personal data on the basis of which the monitoring system is to be installed must be relied upon. The GDPR itself allows for the fulfilment of a legal obligation of the data controller (which may include obligations related to the management of the house and land) as a ground (in addition to the consent of the data subjects).

Therefore, if there is a fundamental reason for processing the data, then the consent of all residents/owners is not required for the installation (on the contrary, the Data Protection Authority considers requiring the consent of data subjects where they are superfluous to be a breach of the GDPR rules). Moreover, this consent could be withdrawn at any time, the residents of the house also change frequently and the whole situation would be highly opaque.

Although the consent of the owners is not required here in the case of any other lawful reason for processing the data, nothing prevents them from being informed at the owners’ meeting. The information can also be supplemented by subsequent mailing of the information or by placing an information sign in the house. The information board must contain at least information that the premises are monitored by CCTV, the controller – the operator of the CCTV system, or a contact person or a notice where the data subject will be provided with complete information about the processing to the extent required by law.

However, a CCTV system could be used in accordance with the above rules, provided that the purpose pursued cannot be effectively achieved by other means (e.g. a more secure door, better quality lock, etc.) and, if necessary, the manager must be able to demonstrate its necessity and usefulness.

Due to the sensitivity of the whole issue and the potential penalties for individual residents of the building, it is advisable to consult a solicitor before installing a system.

The camera is allowed to monitor areas such as:

• entrance doors to the house and areas around mailboxes,
• entrances to elevators and stairwells,
• the immediate surroundings of the house,
• attics and entrances to them,
• garages,
• carriage and wheel houses, entrance to cellars.

However, it is not possible to set up cameras so that they interfere with people’s privacy and, for example, occupy entrances to apartments, etc.

If you don’t suspect any owners or tenants of theft in the house, then placing a fake camera on the house may serve its purpose (to deter random thieves from outside). Many of these are indistinguishable from the real ones and sometimes confuse even police officers who ask the HOA for camera footage. In such a case, it is enough to inform the apartment owners that they are not actually being recorded and it is only a dummy.

Summary

The use of cameras on family and apartment buildings is legal, but must respect the right to privacy and data protection rules. The key is that the camera only captures the property itself or its immediate surroundings and that the footage is not misused. If the system intrudes into a public space or identifies individuals, it is subject to GDPR rules – the controller must then have a legitimate reason, inform the individuals concerned and ensure adequate protection of the footage. In the case of residential buildings, the consent of all owners is not required if there is a legitimate reason for the installation. If the system is not set up correctly, there is a risk of invasion of privacy and legal consequences, so it is advisable to consult a professional.