CCTV in a business and GDPR: what is allowed

The Hellenic Data Protection Authority states that article 10 of Directive 1/2011 (notification) no longer applies and that no permit is required. The controller, however, is responsible for demonstrating lawful operation (the accountability principle, GDPR art. 5(2)).

As a rule the legal basis is legitimate interest (GDPR art. 6(1)(f)). The Authority also notes that even a live picture with no recording is processing of personal data.

In practice, accountability means having it in writing: why each camera exists, what it sees, how long footage is kept and who has access.

Directive 1/2011 (art. 2(a)) accepts the protection of people and property against unlawful acts as a purpose. Article 5 requires proportionality: the camera must be suitable and necessary, and the aim must not be achievable by milder means. The Directive gives as examples more frequent checks by existing security staff, an alarm at entrances and better lighting.

The Directive warns against cameras for minor infringements. Write down, for each camera, which risk it covers; if you cannot, you may not need it.

Article 6 of Directive 1/2011 sets, for every business:

• Roads and pavements: no pictures of adjacent roads and pavements; exceptions only for high-security places (e.g. ATMs), and even then only the strictly necessary area (§1).
• Neighbours: no pictures of the entrances or interiors of neighbouring homes, buildings or premises (§2).
• Toilets, changing rooms, showers: never (§3).
• Pan-tilt-zoom cameras: only for real-time monitoring in order to intervene at once, with masking of areas that are not needed (§4).
• Audio: prohibited (§5).

For shops, article 19 allows cameras at entrances and exits, tills, cash storage, stockrooms, plant rooms and car parks. On the sales floor only exceptionally, in large stores selling high-value goods, with wide-angle views. Never in dining areas, fitting rooms, toilets or staff areas closed to the public. More in our guide to retail loss prevention.

The Authority says so explicitly, citing article 27 of Law 4624/2019 and article 7 of the Directive. Under article 7:

• in a typical office, cameras are limited to entrances and exits, without covering offices or corridors;
• cash desks, safes or plant equipment may be covered, as long as the camera focuses on the asset, not on the staff;
• footage may not be the sole criterion for assessing an employee’s conduct or performance (§2).

Under article 12 of the Directive, people must be clearly informed before they enter the system’s range. Signs go up in sufficient numbers and in visible places, and state:

• the controller — the person on whose behalf the filming is done;
• the purpose;
• the contact for exercising data-subject rights.

On request, fuller information must be available: purpose, a description of the system, camera locations and range, retention period, who operates the system and any recipients. Anyone who appears in the footage has a right of access (art. 13); how to handle it is explained in our guide on how long CCTV footage can be kept.

The limits are in article 8 of Directive 1/2011. How to set the recorder, what counts as an “incident” and how to hand footage to the police are covered in detail in how long CCTV footage can be kept in Greece.

Article 11 §2 of the Directive provides that when the operation of the system is assigned to a processor — for instance a security company watching the screens — the assignment is made in writing. Article 11 §1 puts the security measures on the controller: access control to the control room and the archive, suitable and trained staff, secure transfer of recorded incidents.

1. Who is the controller and who is the processor? Does the contract say so?
2. Who has access to the screens and the archive, and how is it logged?
3. Who sets the deletion period, and who exports footage after an incident?
4. Whose name goes on the sign?

OVIT pairs security equipment with field response and visibility in Guardly. For more questions to ask before signing, see questions to ask a security company.