What applies to security cameras in various locations?

The use of video surveillance systems in both indoor and outdoor spaces, by both public authorities and individuals, is now widespread. For example, banks, hotels, retail stores, etc., install video surveillance systems to protect their customers, staff, and facilities.

Video surveillance is undoubtedly a preventive measure, especially when implemented with the right design. On the other hand, it affects the behavior of individuals, as someone who knows they are being monitored may adjust their behavior or even experience psychological pressure.

To ensure the fundamental right to the protection of personal data and privacy, these systems must be used correctly and not abusively. In other words, such systems should only be used when absolutely necessary and when the intended purpose cannot be achieved through milder means (the principle of proportionality – Article 4 of Law 2472/1997).

The Hellenic Data Protection Authority has received a significant number of inquiries and complaints in recent years regarding the legality of the operation of video surveillance systems and has examined many cases of their operation.

A video surveillance system refers to systems that are permanently installed in a location and have the capability to capture and/or transmit images and sound to display screens or recording devices (where cameras can be connected to the screen or recording device either directly or through a network/internet).

The most common example of such a system is closed-circuit television (CCTV).

Whenever a video surveillance system captures images of individuals (regardless of whether the system is in permanent operation or not), it involves the processing of personal data. It should be noted that even the simple capture of an image, without recording, also constitutes the processing of personal data (and therefore, the responsible party for such processing is not exempt from their obligations towards the Authority, as described below in the section “Information for Data Controllers”).

It should be noted that hand-held cameras, photographic cameras, mobile phones, and intercoms/entry phones that are activated upon the action of the visitor and do not record are not considered video surveillance systems. Therefore, the content of this section on video surveillance systems does not cover photography/videography carried out with these systems.

As for surveillance cameras in public spaces or sidewalks, the installation and operation of such cameras is generally not allowed. You have the right to request access to the recorded images and information about why and where they are being monitored from a store or establishment that has cameras in its external area.

The Hellenic Data Protection Authority handles thousands of cases related to this issue each year and provides guidance based on existing legislation and jurisprudence.

Please note that this information is provided as a translation of the original text and should not be considered legal advice. It’s important to consult with legal experts or authorities in your jurisdiction for specific legal guidance.

Read below, the 5 questions and the answers provided by the Data Protection Authority.

These are two different cases.

a) Video surveillance systems used for the protection of persons and property (i.e. security) are regulated by Directive 1/2011 of the Authority.

As for the number of systems that are not reported to the Authority, there is no estimate. It should be noted that the notification system has been found (at EU level) to be ineffective and is moving towards abolition with the new general regulation on the protection of personal data, expected to be implemented throughout the EU in about 2 years. On the contrary, other solutions are favored, such as having more comprehensive written documentation and prior consultation with the Authority in cases of critical processing.

b) Recording systems of conversations are based on the provision of article 4 par. 3 of Law 3471/2006 (“Recording of conversations and related traffic data is allowed when carried out during lawful professional practice for the purpose of providing evidence of commercial transactions or other professional communication, provided that both parties, after prior information about the purpose of the recording, give their consent…”). In the standard case, no notification to the Authority is required for recording conversations between customers/suppliers and companies (see Article 7A of Law 2472/1997).

Specifically for cases of debtor information companies, special legislation applies (see http://www.dpa.gr/portal/page?_pageid=33,185100&_dad=portal&_schema=PORTAL) and the recording of communications is mandatory.

2. In recent years, there has been a proliferation of cameras placed in public and shared spaces, such as sidewalks, entrances to apartment buildings, gates, stores, and even entertainment centers. Is their installation and use legal? Does the Authority receive frequent complaints or reports regarding possible violations of the law?

Their use for the protection of persons and property may be legal under certain circumstances, depending on the specific circumstances. See also Articles 6, 15, and 19 of Directive 1/2011 of the Authority.

The installation of cameras in public spaces is allowed, in principle, only by public authorities, for purposes and under conditions specified in Article 14 of Law 3917/2011 (e.g., prevention or prosecution of serious crimes, national security, traffic regulation). It should be particularly noted that, as a rule, the installation of cameras in a public space by a private individual for the purpose of protecting persons and property is not allowed (such installation can only be permitted in exceptional cases and under specific conditions – see Article 6 of Directive 1/2011).

The Authority receives several such complaints. From the examination of the complaints submitted, it is observed that the majority of cases concern complaints about the installation of video surveillance systems by neighbors in single-family and multi-family homes. In many of these cases, the parties involved also have other disputes between them. The second significant category of cases concerns complaints about the use of video surveillance systems in workplaces.

3. If a citizen notices a camera in the area where they are moving and believes that they are being recorded, do they have the right to ask the owner of the camera if they have permission or if they have notified the Authority of its use? Can they request to see the content of the recorded videos, and is the owner obliged to show them?

Yes. Data protection legislation provides for the right of access, which is precisely this case. See Article 13 of Directive 1/2011. A specific note is that no license is required from the Authority for the operation of cameras, but only notification. Licenses are only issued for sensitive personal data (which generally does not include a person’s image).

4. In recent years, there has been a significant increase in electronic media such as websites, web-TV, where journalists and photographers, as well as traditional media, record photos and videos in public spaces for news coverage on various topics. Is there an issue of personal data with people appearing in such material? Does a citizen who believes they have been recorded and does not wish to be have the right to check the material or request its deletion?

The use of image capture systems for purposes other than the protection of persons and property is dealt with differently (not by Directive 1/2011) and depends on the intended purpose. Even if there is an issue of personal data, the rights must be balanced, such as the freedom of the press and the public’s right to information (cases of journalists). Of course, citizens retain the right to request that their image not be included in such recordings; however, this should be weighed by the responsible data controller (journalist – newspaper) in the first instance.

5. Telephone conversations and recording – Private companies such as banks, debt collection agencies, telecommunications companies, etc., often call citizens, stating that their call is being recorded. Can a citizen refuse the recording? When a citizen calls such a company and hears a recorded message that the call is being recorded, before even speaking to a company representative, is this legal? Does the citizen have the right to record their phone calls by informing their interlocutor?

As mentioned in question 1, this is specifically regulated by Article 4 paragraph 3 of Law 3471/2006, while there is a special regulation for debtor information companies, which are required by law to record their conversations.

In other cases (except for debtor information companies), it is important that a) recording is allowed only for the purpose of proving a transaction or professional communication (these may also include calls for the satisfaction of an existing customer relationship, e.g., inquiries to a company’s support department), and b) there must be prior information before recording. In case someone does not consent to the call being recorded, they simply hang up the phone, but they should communicate with the company in another way (in person) if it involves a transaction.

However, if a conversation is recorded that does not involve professional communication, it may be an illegal action, and the citizen can raise objections (the right to object – Article 13 of Law 2472/1997), and if they are not satisfied, they can appeal to the Authority.

Regarding recording on the citizen’s side, the same rules apply. However, an easy tool for the citizen is to exercise the right of access (Article 13 of Law 2472/1997) to find out what the company that recorded them has captured, and they may also request a copy.

Operation of video surveillance systems for the protection of persons and property:

The Authority, in order to regulate the use of video surveillance systems for the protection of persons and property, issued Directive 1/2011 (which replaced the previous relevant Directive 1122/2000), which concerns the operation of these systems installed by public authorities or natural or legal persons in spaces they manage. The same directive also regulates the use of video surveillance systems for the purpose of providing health services (in this case, which is essentially a special case of personal protection, only natural or legal persons operating in the field of health and bound by special professional confidentiality, such as doctors and nursing staff, can be responsible). Therefore, with this directive, everyone can know the conditions that must be met for the lawful operation of these systems installed for the above purposes.

It is explicitly noted that the operation of video surveillance systems for purposes such as monitoring employees for control/evaluation or for training purposes is not allowed.

Frequently Asked Questions about Video Surveillance Systems:

1. I want to install a video surveillance system. Am I obliged to submit a notification to the Authority?

Yes, based on Article 6 of Law 2472/1997 (unless the system captures and records images exclusively from your private, non-professional space, e.g., within your home, in which case you do not need to submit a notification). Failure to notify may result in both administrative and criminal sanctions, as provided in Articles 20 and 22 of Law 2472/1997. You are also required to notify the Authority of any changes to your system (e.g., adding/removing/repositioning cameras).

1. I want to install cameras in my single-family home for security reasons. Is it allowed, and under what conditions?

If the cameras only record your private property, then data protection legislation does not apply, and you do not have the related obligations (e.g., no requirement to notify authorities). However, it is prohibited to capture images from public spaces (e.g., streets or sidewalks) and neighboring buildings (see Article 3 of Directive 1/2011). Please note that any other non-domestic use of the recorded material, except for transmission to competent authorities (e.g., police, courts) in case of an incident, would be subject to data protection legislation and is generally not allowed.

Capturing images from adjacent roads or sidewalks may only be justified in exceptional cases, i.e., when there have been dangerous attacks on life and property, and there are reasonable suspicions of further incidents. In such cases, image capture should be limited to the absolutely necessary adjacent space (see Article 6 of Directive 1/2011). In addition, in such cases, you are considered the data controller, so you have all the relevant obligations (e.g., notification, information signs, satisfaction of access and objection rights).

2. I live in an apartment in a multi-story building and want to install cameras for security purposes. Where is it allowed, and can I install a camera that monitors the area in front of my front door?

A) You can install cameras that capture images within your apartment (but not in any case capture images outside your private space, e.g., a camera on the balcony capturing images from a public street is not allowed).

B) You can install a camera that monitors the absolutely necessary area of your entrance, without recording images or sound (e.g., to see who is ringing your doorbell).

C) You can install a camera with image recording (but no sound) that is considered for domestic use (so, like case B, it does not fall under data protection legislation) if it is technically feasible to limit the camera’s field of view to the absolutely necessary area in front of your apartment’s entrance, without affecting other apartments. In this case: C1) it should not capture images from other common areas, and C2) depending on the layout of the entrances to the apartments on the floor and the elevator, it should not affect the entrance to other apartments or passage to them.

In the above three cases, the use of cameras is considered domestic and does not fall under data protection legislation. For details, see Opinion 5/2017 and read the next question as well.

Additionally, you can install a camera in a common parking area to monitor your vehicle if there is no such system provided by your apartment building. However, you should seek the consent of the other tenants, and the camera should focus solely on your vehicle, with clear signs (see Article 15(4) of Directive 1/2011). For this processing, you must submit a notification to the Authority.

3. The layout of the apartment doors on my floor is such that some tenants may pass in front of my apartment door. How can I install a camera with image recording to monitor my entrance?

In this case, before proceeding with the camera installation, you should obtain the consent of the tenants of the affected apartments on your floor, providing them with all relevant information about how you intend to operate the camera. The affected apartments include those on the same floor as yours, except for those where entry does not require passing through the monitored area in front of your apartment’s entrance.

When unanimous agreement cannot be reached, you should follow the procedure in Article 15(1) of Directive 1/2011, which means obtaining prior consent from two-thirds of the tenants of the affected apartments on the floor. The consensus is determined based on one vote per inhabited (or used) affected apartment.

For example: In the following layout of a hallway on a floor, the tenant of Apartment A, who wishes to install a camera at their entrance, must obtain the consent of the tenants in the apartments marked in orange (B and C).

1. The door of apartment B is in close proximity to that of A, and it is extremely difficult not to capture an image of those entering apartment B. Anyone wishing to enter apartments C, D, and E does not need to pass by apartment A. However, to enter apartment F, one must pass in front of apartment A.
2. If I have a shop or office in a multi-story building, can I install a camera that monitors my entrance?

The rules mentioned in question 4 apply to residences, with the caveat that in this case, data protection legislation always applies, and you are always considered the data controller. Therefore, you can install a camera without image recording or a camera with recording (always without sound) as long as you limit it to the absolutely necessary area of your entrance and do not affect other units. If other units are affected, you must obtain the consent of the tenants, as described earlier.

6. Is a unanimous vote of tenants required for the installation of a video surveillance system in common areas of a multi-story building?

According to Directive 1/2011, a decision of the body responsible for the management of the building (e.g., General Assembly of owners, as defined in the building’s regulations, with ownership percentages, etc.) is required.

If the building’s regulations already provide for the installation of the surveillance system, then you simply follow what is specified in the regulations. If the installation is not provided for in the regulations, it requires, in addition to the decision of the competent body, the consensus of 2/3 of the tenants. This means that tenants express their opinion only on whether they want the operation of the surveillance system or not. It should be noted that each (inhabited) unit corresponds to one vote. Following a positive vote, the General Assembly of the building can decide on the installation.

Examples:

a) The General Assembly of the building votes unanimously (100%) in favor of the installation of the surveillance system, but out of the 20 tenants, only 13 agree (less than 2/3), while 7 disagree. In this case, the surveillance system cannot be installed. b) The General Assembly of the building votes with 55% in favor of the installation, and more than 2/3 of the tenants want the installation. In this case, the surveillance system can be installed (provided that in the regulations decisions on such matters are made by a majority of 50% + 1).

7. I have a commercial store. Where can I install cameras?

You can install cameras at entry/exit points (without capturing images from public areas), at cash registers, money storage areas, and goods storage areas. For large stores or stores dealing with high-value goods, cameras can also be placed in areas where customers move, if it is deemed absolutely necessary. In this case, the camera’s field of view should focus as little as possible on individuals, and wide-angle views are preferred (see also Article 19 of Directive 1/2011).

In any case, you are not allowed to install cameras in areas where employees work and customers do not have access, or in employees’ offices (see also Article 7 of Directive 1/2011).

8. I have a restaurant/bar. In which areas can I place cameras, and where can’t I?The same rules apply as mentioned in the previous question. However, it is particularly emphasized that you are not allowed to record dining or entertainment areas (tables, seats, dance floors). Regarding the bar, a camera is allowed only above the cash register and should focus on it. Also, the placement of cameras in the kitchen or other areas where only employees move is prohibited (see Article 19 of Directive 1/2011).
9. What is considered a public space? Is it allowed to place cameras in such areas?Public spaces are those designated for common use under urban planning laws and the Civil Code, such as streets, squares, parks, beaches, ports, lake and river banks, public forests, and more. Additionally, any other space that is open and freely accessible to an indefinite number of people, and has been legally made available for common use, is considered a public space. This can include large shopping centers, special parks, recreational areas, etc. Public transportation hubs like subways and airport passenger buildings are also considered public spaces, even if they have controlled access.Placing cameras in public spaces is generally allowed only by public authorities, for specific purposes and under the conditions specified in Article 14 of Law 3917/2011. It’s important to note that, as a rule, private individuals are not allowed to place cameras in public spaces for the purpose of protecting people and property. Such placement can be allowed only in exceptional cases and under specific conditions (see Article 6 of Directive 1/2011).
10. Can I place cameras outside my business in a public space?No, you are not allowed to capture images from adjacent streets or sidewalks (as mentioned in the previous question). Only in exceptional cases where it is necessary due to the “nature” of the space (e.g., government buildings, large hotels, bank automated teller machines) or when incidents have occurred in the past, can such recording be allowed. In these cases, the recording should be limited to the absolutely necessary adjacent space (see Article 6 of Directive 1/2011).
11. Under what conditions is it allowed to place cameras in schools/school complexes?Installing a video surveillance system in schools should be done with great care and under strict conditions. A decision should be made by the competent school administration body, taking into account the opinions of the teaching staff and parent and student associations. The system should not operate during school hours, and everyone (students, parents, educators, etc.) should be fully informed to ensure that they are aware they are not being monitored. Data should be deleted the next working day if no incidents occur, and the system’s operation should be regularly evaluated (not longer than one year). Cameras should not be placed inside classrooms (see Article 18 of Directive 1/2011).
12. I am an employee, and my employer has placed cameras that can monitor the staff. What should I do?Firstly, it should be noted that, in any case, you can exercise your rights to access and object to a video surveillance system under Law 2472/1997. Your employer is obliged to respond to you in writing. If the responsible person does not respond or the response is not satisfactory, you can file a complaint with the Authority, either through a collective body or individually. It is important to note that, given the dependent relationship between employees and employers, the weight of employees’ consent to such processing is weakened, as it is difficult to ensure that such consent is freely given. Therefore, any written consent from employees that the employer may present regarding the operation of the system cannot alone justify lawful processing.
13. I have a private medical practice in a multi-unit building. Where can I place cameras for security reasons, and where can’t I?You cannot place cameras outside your medical practice (e.g., monitoring the hallway or the entrance to the building) because in such areas, the responsibility for camera placement lies solely with the competent management body of the multi-unit building, and the rules mentioned in Article 15 of the Directive apply. For controlling the entrance to your medical practice within your office, please refer to questions 3, 4, and 5.

In summary, it’s important to follow the specific legal regulations and guidelines regarding the placement of cameras in different settings, and in some cases, you may need authorization from relevant authorities or property management bodies.

14. For how long is it allowed to retain data recorded by the video surveillance system?

Data must be retained for the shortest possible time. In any case, they should not be retained for a period longer than 15 days, except for exceptions. Specifically, for apartment buildings, data should be retained for a maximum of 48 hours, while for school complexes, etc., it should be retained until the next working day. Banks and financial institutions can retain data for up to 45 days. The retention period can be extended if there is an incident and the material can be used as evidence (see Article 8 of Directive 1/2011 for a more detailed description, as well as the corresponding article of the Special Part of the directive depending on the category of the data controller).

15. I am considering installing fake cameras or cameras that do not record but only capture images. Do I need to take any actions regarding the Authority?

Fake cameras do not process personal data and, therefore, you have no obligations towards the Authority (nor even the obligation to submit a notification). However, it should be noted that such a system that simulates closed-circuit television, even if it does not operate, may create the perception among citizens that personal data processing is taking place. The feeling that one is likely to be under surveillance affects their behavior, so the installation of such a system may infringe on the constitutionally protected right to the free development of personality (Article 5 § 1 of the Constitution).

In the case where cameras capture images, even if they do not record/store data, personal data processing occurs (albeit in a milder form compared to recording), so all the conditions of legality apply.

16. Can I install web cameras for displaying images on various websites for advertising purposes?

For the advertising display of a location or a business, it is not necessary to use images where individuals are recognizable. You should ensure:

a) Either the cameras are positioned in such a way that the identification of individuals or vehicle license plates is not feasible (in which case there is no processing of personal data).

b) Or you should take appropriate measures, such as blurring techniques if the image contains recognizable faces, to prevent their identification. In this case, personal data processing takes place, and you should submit a notification.

You must be very careful to ensure that individuals or vehicle license plates are not recognizable in the displayed images, as the processing of personal data without consent is illegal in most cases.

17. I notice (e.g., in a store or café) cameras for which I do not know if they are legal, and I am not sure what they are recording. What should I do?

You can exercise your right to access the business that has installed the cameras, meaning you can request them to provide you with a copy of recorded material or simply show you relevant recorded material (if you have passed through an area that you believe is within the camera’s field of view). It should be noted that the data controller is obliged, under Article 12 of Law 2472/1997, to respond to your request. If they do not respond or if their response is unsatisfactory, you can file a complaint with the Authority (see Article 13 of Directive 1/2011 for details on the process). You can also exercise the right to object (as mentioned in Article 13 of Directive 1/2011). If the data controller does not respond or if their response is unsatisfactory and they do not appropriately adjust the camera, you can also file a complaint with the Authority.

In any case, it is not allowed for cameras to record tables, seats, bars, etc.

18. My neighbor has installed a camera, and I believe it may be recording my home as well. What can I do?

You can exercise your right to access the person who has installed the camera, meaning you can request them to provide you with a copy of recorded material or simply show you relevant recorded material (if you have passed through an area that you believe is within the camera’s field of view). It should be noted that the data controller is obliged, under Article 12 of Law 2472/1997, to respond to your request. If they do not respond or if their response is unsatisfactory, you can file a complaint with the Authority (see Article 13 of Directive 1/2011 for details on the process) – while simultaneously submitting both your request and their response.

Additionally, if the camera ultimately records your private or shared space (e.g., the road outside your home), you can exercise the right to object (as also indicated in Article 13 of Directive 1/2011). If the data controller does not respond or if their response is unsatisfactory and they do not appropriately adjust the camera, you can also file a complaint with the Authority.

In any case, even if they respond that the camera is for personal use and does not record you (in which case, if true, the provisions of Law 2472/1997 for the protection of personal data do not apply), you can still exercise your legal rights based on general provisions of privacy protection law (particularly Article 3 paragraph 3 of Directive 1/2011).