Publications

Because the impact on a person's privacy can be considerable, the pros  and cons of  a given form of data processing should be weighed, before the introduction of modern technology, and subsequently assess whether and to what extent such a measure is even permissible. The test of proportionality must be done taking into account the circumstances of each case, keeping in mind a person's legitimate expectation of privacy. A decision to use modern technology must be explained and documented. Additional caution is required with vulnerable groups of people who require special protection (such as employees, children, mentally ill people, patients, the elderly, and asylum seekers). The innovative use of existing and new technologies and systematic observation, tracking or surveillance of individuals belong to those types of personal data processing that require a prior data protection impact assessment as specified in Article 35(4) the General Data Protection Regulation (GDPR). 

 
Because GDPR does not regulate all aspects on the use of modern technologies, we advise the companies who are considering the introduction of such solutions to also take into account the so-called soft law. 

If you are planning to install video surveillance, we advise you to consider the recently adopted guidelines of the European data protection board (EDPB) on processing of personal data through video devices, which among other things state, that the controller must be mindful of the fact that each camera or complex of cameras, which are used together for the same purpose, are a separate legally-relevant event, for which the controller must clearly document the purpose of use and ensure the congruity with the provisions of applicable legislation. 

For each individual instance of surveillance, it must therefore be separately determined, what the purpose of the surveillance is (e.g. surveillance for the safekeeping of property, insurance against damage claims, fear of illegal activity taking place, fear of stealing of professional secrets or protection of people) and information for individuals prepared as specified in Article 13 of GDPR. EDPB differs from the IC (for the time being) in that it proposes that information be provided to individuals in two layers – the most important information: (i) information regarding the controller and (ii) regarding the processor, when applicable, (iii) the purposes of data processing and (iv) the legal basis as well as (v) the rights of individuals, should be evident from the warning sign. It follows that the existing warning signs require an update. 

Before making a decision to install video surveillance do not forget the current provisions of the Personal Data Protection Act (ZVOP-1) on video surveillance and the Guidelines of the IC regarding video surveillance, which have been issued on this basis, as well as the opinions of the IC. The IC namely only allows, for example, video surveillance in work places in exceptional cases (e.g. as part of the working process, in specific places, for a limited time frame or outside of office hours). 

Special attention must be given to data processing with the aid of GPS tracking. Even though this technology is normally used to track devices (e.g. mobile phones) or vehicles, the processing of personal data of the individuals handling such a device/vehicle, occurs simultaneously. The IC in the guidelines on the use of GPS tracking devices clearly states that the use of GPS technology is inappropriate for monitoring work done by employees, as it only tracks location and time data, and not work performance.

GPS technology might be permissible in order to protect individuals who are exposed to dangerous situations (e.g. security guards, police officers), for the safety and protection of the property of employers, the protection of high-value cargo or vehicles transporting high-value cargo (IC has allowed the tracking of trucks carrying cargo valued at EUR 1 million or more), the safekeeping of hazardous substances (e.g. oil derivatives), pinpointing traffic accident sites or protecting vehicles from theft, all of which does not mean, however, that the tracking of commercial vehicles is generally allowed. 

Arguments such as »everybody else is doing the same« will not convince the IC. In all cases, the controller must assess whether the technology is even fit for purpose and perform the proportionality test to that effect, and whether the same objective could satisfactorily be achieved using measures less intrusive to privacy, freedom of movement and dignity of individuals. With the aid of an impact assessment the controller must establish the circumstances in which the use of GPS tracking devices is lawful and proportional, and make provision for measures to mitigate any risk of infringement of individuals' rights (e.g. the device only activates when the vehicle leaves a certain zone, it can be turned off during rest periods, it is activated only for more risky journeys or when transporting hazardous goods). If the recorded risks are manageable, then the GPS tracking system must be described in the appropriate employer bye-law and individuals provided with all the information referred to in Article 13 of GDPR.