D: CCTV and preliminary evaluation

CCTV surveillance by companies has become ubiquitous. Legal surveillance using cameras is completely possible if certain criteria and form requirements are observed, although it is not sufficient to use one's householder rights as a justification.

The prerequisites for surveillance in publicly accessible areas are contained in § 6b BDSG (German Data Protection Act) and § 28 for areas not accessible to the public.

Data protection should therefore not be first considered when images are taken or saved, but instead as soon as surveillance becomes an actual possibility. The measure is applied as soon as cameras are installed, even if the devices only record when necessary or when the alarm is triggered, or if they are used for mere surveillance. As surveillance with optical electronic devices cannot be carried out using a dummy, § 6b BDSG is not immediately applicable. Nevertheless, passers-by may feel compelled to change their behavior due to the perceived surveillance and have the right to make claims to forbearance in terms of civil law, provided they are negatively affected.

A preliminary evaluation in accordance with § 4d para. 5 BDSG should be carried out for automated data processing, which presents specific risks for the rights and freedoms of those affected. For video surveillance, specific risks for the right to informational self-determination must be assumed because a camera records all persons and behaviors that occur in its area.

The aim of the preliminary evaluation is to check the controllability of new information and communication procedures before they are introduced. This is not only used to legally assess the video surveillance measures, but also to make the automated data processing activities transparent, highlight dangers to the rights of those affected, estimate risks and draft security concepts. Specifically, a system description is conducted, the legal basis of the data processing is checked and a risk analysis is performed. Surveillance without recording and used as an extended eye is therefore less critical, but hidden CCTV surveillance is only lawful as a last resort.

The regulations surrounding this have been very liberal up to now in Germany, while in other EU member states each video camera must be approved on an individual basis by the regulatory bodies.

Overt CCTV surveillance and the person responsible for it must be indicated on a clearly visible notice. A notice regarding CCTV surveillance and the person responsible for it is regularly required. Before the video surveillance begins, the purpose of the surveillance must be set down in writing in a sufficiently concrete manner. For this reason, the data protection officer must be involved in good time if CCTV surveillance is planned.

https://www.ldi.nrw.de/mainmenu_Datenschutz/submenu_Datenschutzrecht/Inhalt/Videoueberwachung/Inhalt/04_03_23_Videoueberwachung/achtung_kamera.pdf