Video Surveillance and Personal Data – Rights, Laws, and Advice from the CPDP

Approximate reading time: 3m 11s

Video cameras and personal data: what do we need to know?

The camera on the corner. The camera by the entrance. The camera in the store, in the office, in the kindergarten. We are being watched almost everywhere – sometimes for security reasons, other times without a clear reason. But what does this mean for our personal data? Do we know when it is permissible to film us? And who makes sure the rules are followed?

According to the latest report of the Commission for Personal Data Protection (CPDP) for 2024, the sector „Video Surveillance“ is the record holder in the number of filed complaints – a total of 345. This is not just statistics. It is a signal that our society needs more clarity. In this article, we will tell you what the law says, what your rights are, and what everyone who installs cameras needs to know – from the manager of a small shop to the building manager in an entrance hall.

If the topic is important to you, learn everything you need through our online training in personal data protection. Sign up today for the Personal Data Protection Course and be prepared.

Video surveillance – when is it legal?

GDPR and the Bulgarian Personal Data Protection Act (PDPA) apply to any situation in which a person can be identified through video recording. This means that in most cases video surveillance is personal data processing and is subject to strict regulation.

Lawful video surveillance must meet several conditions:

• There must be a legal basis – e.g. legitimate interest, contractual obligation, or explicit consent;

• It must be proportionate – the cameras must not capture more than necessary;

• There must be awareness – signs posted with information on who is recording, why, and how to contact the controller;

• There must be an internal policy – how the recordings are stored, who has access, and what the retention periods are.

Example from practice: The camera in the entrance hall is aimed at the mailboxes and the staircase – permissible. But if it covers part of an apartment or a public street – that is already a problem.

What rights do you have?

Many people do not know that they have specific rights when it comes to video surveillance. Here they are briefly:

• Right to information – who is recording you and why;

• Right of access – you can request a copy of the recording if you appear in it;

• Right to object – if you do not agree to be filmed;

• Right to erasure – when the recording was made without grounds;

• Right to complain – if you believe your rights have been violated, you can file a complaint with the CPDP.

Important: not every situation allows for automatic deletion of a recording. The controller must assess the balance between your rights and other legal interests.

What should controllers, companies, and entrance halls do?

Before installing a camera, the question must be answered: "Is it really necessary?"

Here are the concrete steps:

1. Assess the need for video surveillance;

2. Ensure awareness – signs clearly indicating who is recording and why;

3. Limit the scope – do not film a public street or neighboring balconies;

4. Store the recordings securely and for a limited period (usually up to 30 days);

5. Designate a person responsible for access to the recordings;

6. Keep documentation and be ready for an inspection by the CPDP.

Example: A building manager wants to install a camera in the entrance hall. A decision by the general assembly of the condominium is required, along with a notice sign, an appointed responsible person, and written rules for access to the recordings.

What does CPDP practice show?

• A camera installed in a store fitting room without a warning sign leads to a sanction for violating personal space;

• Video surveillance in a classroom without the parents' consent and without proven legal interest – the CPDP orders removal;

• Surveillance by a co-owner in the entrance hall without a general assembly decision – an order for dismantling.

All these examples are real and available in CPDP decisions.

Citizens vs. Cameras: what should you do?

If you are a citizen:

• Spotted a camera? Look for an information sign;

• Do not agree to being filmed? Contact the controller and ask for clarification;

• Not getting a response or believe your rights have been violated? File a complaint with the CPDP.

If you are a controller:

• Remember: prevention is better than a sanction;

• Complete all legal steps before installing cameras;

• Store the recordings securely and do not use them outside the stated purpose.

Final words

Video surveillance is not just technology. It is responsibility. And if we want to live in a society where the right to privacy is respected, we must know the law – and apply it.

 The course "GDPR Regulation for Personal Data Protection" is created for everyone who wants to learn about the rights and obligations under the regulation, as well as its application in Bulgaria.

Sources:

• General Data Protection Regulation (EU) 2016/679 (GDPR)

• Personal Data Protection Act (PDPA)

• CPDP Annual Report for 2024

• CPDP practice: https://www.cpdp.bg

Read more about personal data protection in the article The right to be forgotten, or how to delete your personal data under GDPR