Camera Surveillance
Camera surveillance is regulated by the Act on the Protection of Privacy in Working Life and the General Data Protection Regulation (GDPR). The employer may carry out camera surveillance on the premises at its disposal to ensure the personal safety of workers and others on the premises, to protect property or to monitor the proper functioning of production processes and to prevent or investigate situations endangering safety, property or the production process. However, camera surveillance may not be used to monitor a specific employee or employees in the workplace. For example, there may be no camera surveillance in the toilet, dressing room, break room or other staff rooms, or in the work rooms dedicated for the personal use of employees.
The employer may, however, direct the camera surveillance at a particular work station where employees are at work if the surveillance is essential for:
preventing an apparent threat of violence related to the work of the employee or an apparent harm or danger to the employee’s safety or health;
preventing or investigating property crimes if an essential part of the employee’s work is to handle property of high value or quality, such as money, securities or valuables; or
safeguarding the employee’s interests and rights, where the camera surveillance is based on the request of the employee and is agreed on between the employee and employer.
Before initiating camera surveillance, it is necessary to determine why and for what purpose the data is collected. The need for camera surveillance must always be justifiable. Before initiating camera surveillance, it is important to plan how long the data is to be stored, whether the data is to be passed on to other parties, and how the data will be securely destroyed.
The data must be destroyed immediately when it is not necessary to use it for its original purpose. If the camera surveillance is outsourced, the client is also responsible for the actions of the contractor. The security of the processing of personal data must be ensured and the data should not, for example, be transferred over an open network or in any other way that may make the data available to third parties.
Everyone has the right to know why data is collected, who collects it and for what purpose it is aimed to be used. Surveillance has to be notified openly:
a prominent notification of the recording camera surveillance has to be put on a visible spot;
recorded persons have the right to familiarize themselves with filmed material on them, with some exceptions;
the controller has to draw up specifications, from which the controllers name and contact information, the purpose of the processing of personal data, description on the group or groups of data subjects, to whom data is disclosed and if data is transferred outside of the EU or the EEA and a description on the basics on the protection of the register.
The controller is obliged to compensate for the financial or other damage caused to the data subject or another person due to the processing of personal data in violation of data protection legislation.