Staff CCTV notice rules under GDPR: what to tell employees

Start with the guideline

The key text is the EDPB's Guidelines 3/2019 on processing of personal data through video devices. It applies Regulation (EU) 2016/679 (GDPR) to cameras. National law and works agreements can add rules on top.

1. Name the purpose and the legal basis

Write down what the alerts are for, for example "tell a free colleague that a customer is waiting". Operators usually rely on legitimate interest under Article 6(1)(f), which needs a real interest, a necessary means and a balance against the rights of the people filmed.

Do not assume the security purpose covers the new one. The guidelines warn that cameras must not be misused for unexpected purposes, and they give employee performance monitoring as an example.

2. Tell staff before it starts

A sign at the entrance is the first layer. The guidelines recommend layers (paragraph 111): the most important facts on the sign, and the rest of the mandatory details in a second layer. Staff need that second layer in writing before the alerts go live. It should say who runs the system, what the alerts are for, the legal basis, who sees the data, how long it is kept and how to use their rights, as Article 13 GDPR requires.

Update the sign and the staff notice together when the cameras gain a new purpose. Where there is a works council or staff representation, involve it early.

3. Treat staff as people in the picture

The guidelines say an employee in the workplace in most cases does not expect to be monitored by the employer (paragraph 37). Consent from staff is unlikely to be freely given because of the imbalance of power (paragraph 47). Member State law or collective agreements, including works agreements, may set specific rules (paragraph 48, Article 88 GDPR).

Alerts help a colleague do the job. They never score one.

4. Prefer the smallest data that does the job

An alert rule needs to know that a person stands in a zone and that a colleague is or is not nearby. It does not need a face or a stored image. A design that reduces each person to a position on a floor plan keeps far less than one that stores video for analysis. This follows data minimisation in Article 5(1)(c) and data protection by design in Article 25.

The guidelines say footage becomes special category data under Article 9 when it is processed to uniquely identify people through biometric templates. A system that only classifies people, without identifying anyone, does not fall under Article 9 (paragraph 80). Avoid face recognition for this purpose. A position with a persistent staff ID can still point at one person in practice, so keep IDs out of anything beyond the alert itself.

5. Process in the store and keep little

If the analysis runs on a device in the store, the video does not have to leave the building. For retention, the guidelines suggest that data kept for a purpose such as detecting vandalism be erased, ideally automatically, after a few days. The longer the period, especially beyond 72 hours, the stronger the justification must be (paragraph 121). An alert needs a live view, not an archive. Store the event, such as "zone D, 90 seconds, closed", and set an automatic deletion time for it.

6. Do the impact assessment

Article 35(3)(c) requires a data protection impact assessment for systematic monitoring of a publicly accessible area on a large scale. A shop floor open to customers can fall into that. Even where it does not, an assessment is a sound way to record the purpose, the data, the retention and the risks.

The UK and Switzerland

The UK follows UK GDPR. The ICO says signs must be clearly visible and readable, and should identify the organisation, the purpose and a contact route. For workers, it says to make them aware of what is collected and to consult staff or unions, especially during the DPIA. It lists monitoring individuals at a workplace as a case that needs a DPIA. See the ICO guidance on surveillance systems and on monitoring workers. Several ICO pages say they are under review after the Data (Use and Access) Act, so check the current text.

Switzerland has its own data protection act and an employment rule. The FDPIC states that video surveillance for the targeted monitoring of employee behaviour is prohibited (Article 26 of Ordinance 3 to the Employment Act), and that employees must be informed before video surveillance starts. For retail, it advises against pointing cameras at checkout staff and their workstations. Read its page on video surveillance in the workplace. A staff alert design has to stay clearly on the right side of that line.

How Corteal Watch is designed

The Watch page says what is built and what is not. The demo runs alert rules on recorded clips. Detecting people from live video is not in the demo, and a pilot is where that gets built and tested. The footage in the demo is real, with faces blurred in editing.

The design reduces visitors and staff to positions, uses no face recognition, and runs on a device in the store so that video stays on site. People on camera are still personal data under GDPR, so a pilot includes the privacy paperwork. The alert rules and thresholds are described in an earlier note. Data handling on this website is described in the privacy policy.

Running a store and want to test alerts? Start a pilot.