Contact
The Official Gazette of the Generalitat de Catalunya (DOGC) today publishes the announcement through which the Catalan Data Protection Authority submits for public information the project to draw up the new Circular on video surveillance, which will be mandatory within its scope of action (administrations, public entities, universities, professional associations and private entities that perform public functions).
The new Circular will replace the previous Instruction 1/2009, of 10 February, on the processing of personal data using cameras for video surveillance purposes, which was drawn up to specify the application of the principles and guarantees established by Organic Law 15/1999, of 13 December, on the protection of personal data. Thus, the Circular arises from the need to adapt this Instruction to the regulatory and jurisprudential changes that have occurred since then, such as the approval of Regulation 2016/679 and Organic Law 3/2018, on Data Protection and Guarantee of Digital Rights and the amendment of Law 5/2014, of 4 April, on private security. In this sense, from the outset, Organic Law 3/2018 provides for the change of name of the mandatory instruments drawn up by the control authorities, which go from being Instructions to Circulars.
New features of the Circular
The Circular consists of an explanatory memorandum, 23 articles divided into 6 chapters dedicated to the general provisions; principles applicable to the processing of video surveillance; obligations of the person responsible; transparency; rights of access, rectification, deletion, limitation of processing and opposition; and security of personal data. A transitional provision, a repealing provision, a final provision and an annex containing the information and design of the information posters that must be placed prior to the capture of images and voices are also incorporated.
It incorporates a series of new features in terms of content. Among others:
- It refers to new devices that allow the capture and transmission of images and voices with increasingly precise technology, such as cameras installed in drones, vehicles or people's clothing.
- It differentiates between the activities that are excluded from the Circular because they do not capture images that allow people to be identified or because they occur in the domestic sphere, and those that are excluded from the scope of application of the Circular.
- It incorporates the definition of biometric data, expands the processes included in the concept of processing and replaces the concept of dissociation with that of anonymization of images or voices.
- It adapts the terminology regarding the principles applicable to video surveillance processing, and includes the principle of legality in place of the concept of legitimacy of the processing. It identifies video surveillance processing that is in no case considered legitimate, adding the places where workers carry out their most intimate or recreational activities, and the rooms of residences, hotels and similar, except for overriding legitimate interests.
- The report required in the previous Instruction under the principle of proactive responsibility will now not be required in those cases in which the processing must be subject to a data protection impact assessment
- Incorporates the need to appoint a data protection delegate and to keep a record of processing activities.
- It specifies in the field of video surveillance the relationship with the data controller and the formalization of this assignment.
- Expands the content of the information that must be offered to interested parties. The information posters must necessarily inform about the existence of the treatment, the identity of the person responsible for the treatment or the video surveillance system, the possibility of exercising the rights recognized to the interested parties in Regulation 2016/679 and the place where to obtain the rest of the information about the treatment that is carried out.
- It establishes the obligation to inform about the existence of drones, vehicles or clothing of people, through posters or other systems.
- It incorporates the possibility of contacting the data protection delegate of the person responsible for the treatment to exercise their rights (access, deletion, etc.).
This is a new provision that must be complied with, which will replace the previous Instruction on video surveillance, from 2009, with the aim of adapting it to regulatory changes and current case law.