What does Article 13 of the GDPR include in the context of video surveillance?
When video surveillance is installed that captures images of people (i.e., personal data), the operator (controller) must provide the following information to the data subjects (people who appear in the camera’s field of view):
- The identity and contact details of the video surveillance operator (e.g., organization name, address, contact information).
- Contact details of the data protection officer (if one has been appointed).
- The purposes of the data processing — for example, property protection, security.
- The legal basis for processing — such as the operator's legitimate interest.
- Data recipients — who may receive the footage (e.g., law enforcement).
- Data retention period — how long the footage will be stored.
- Rights of the data subjects — right to access, correction, restriction, objection, etc.
- Information about the right to file a complaint with a supervisory authority.
- If data is transferred outside the EU — information and guarantees must be provided.
- Automated decision-making (if any) — usually not applicable in video surveillance.
Summary:
The information sign about video surveillance should contain at least part of this information (e.g., operator’s name, contact, purpose), while more detailed information must be available upon request.
This requirement ensures transparency in personal data processing and informs people that they are under video surveillance.
