g-docweb-display Portlet

Video Surveillance: Privacy-Friendly Integrated Systems and Smart Cameras - 27 april 2010

Stampa Stampa Stampa
PDF Trasforma contenuto in PDF

[versione italiana  ]

Video Surveillance: Privacy-Friendly Integrated Systems and Smart Cameras
New rules for video surveillance (27 April 2010)

Integrated video surveillance systems should only be set up in compliance with specific safeguards for individuals’ freedom. Ad-hoc notices should be posted to inform that cameras are in operation and connected with law enforcement authorities’ control rooms. The DPA’s prior checking is required before implementing systems that entail risks to data subjects’ fundamental rights and freedoms – such as “smart” video surveillance systems. The images, where recorded, may only be kept for a limited period, and stringent security measures must be in place to protect images and ward off unauthorised access.

These are some of the new rules laid down by the Italian DPA for both public and private entities with a view to the installation of CCTV and video surveillance systems. The deadline for compliance is set at six to twelve months, depending on the specific requirements.

The rules are set forth in a Decision that replaces the one issued by the DPA in 2004 to take account not only of the substantial increase in the use of video surveillance for multifarious purposes (preventing, detecting and suppressing offences; public security; protection of property; road traffic monitoring; etc.), but also of the many items of supervening legislation – including those that recently conferred specific competences on mayors and municipalities as for ordre public and security and the laws (including some enacted by Regions) aimed at fostering the use of CCTV.

Account was also taken of the considerations submitted by the Italian Ministry for Home Affairs and the Association of Italian Municipalities (ANCI). The Decision was published in Italy’s Official Journal.

A summary of the rules laid down by the DPA is provided below.

General Principles

- Information Notices : Citizens must be informed via specific notices that CCTV cameras are in operation in the areas they are crossing; the notices should be visible also if the CCTV system operates at night. If a video surveillance system – regardless of whether it is managed by public or private entities – is connected with law enforcement authorities, a specific notice will have to be displayed as per the template developed by the DPA (see Attachment 2). Although no notices are required if the CCTV system serves public security and/or ordre public purposes, the DPA recommends that citizens be informed in any case.

- Data Retention : The images, where recorded, should be kept for a limited period of time, which should not be in excess of 24 hours – subject to specific retention requirements in connection with investigations. A longer retention period is envisaged in especially risky cases (e.g. banks), but it should not exceed 1 week. Longer retention periods require the DPA’s prior authorisation (prior checking).

Main Sectors

- Urban Security : Where a municipality plans to rely on CCTV to ensure urban security, it is required to post notices informing on presence of the CCTV system – unless the video surveillance activity falls within the scope of public security or prevention, detection and/or suppression of offences. The data may not be kept for over 7 days subject to specific requirements.

- Integrated VS Systems : Specific security measures must be implemented (e.g. to prevent unauthorised access) in case several entities resort to interconnected cameras or video surveillance services are provided “remotely”  by specialised companies via an IT connection with a control room. The DPA’s prior checking may be required in respect of certain systems.

- Smart Systems : The DPA’s prior checking is required if a “smart” video surveillance system is deployed including software that can associate images and biometrics (e.g. “facial recognition” software) or else automatically film and record “deviant” behaviour or abnormal events (e.g. “motion direction” cameras).

- Traffic Violations : Electronic systems for detecting traffic violations must be signposted. Cameras should only be directed at car plates (i.e. they should not film driver, passengers, pedestrians, etc.). Pictures or videos used as proof of the violation should not be sent to the car owner’s home address.

- Waste Disposal : Cameras may be lawfully used to monitor hazardous waste dumps and waste collection sites, e.g. to monitor what type of waste is dumped, how this is done, and at what time.

Other Sectors

- Workplace : CCTV may be only resorted to in compliance with employment laws. It is forbidden in all cases to remotely monitor employees whether inside buildings or in other areas such as building yards, cars, etc.

- Hospitals and Health Care Institutions : Patients may not be displayed on monitors that are located in publicly accessible areas. Where indispensable, nursing staff may monitor patients that are hospitalised in specific units (e.g. resuscitation unit); however, only the staff in charge and the patients’ relatives may view those images.

- Schools : Video surveillance systems may be installed to ward off vandalism, but the cameras should only be directed at the areas involved and only operate when the school is closed.

- Taxi Cabs : Cameras should not be directed exclusively at the driver and specific notices should inform on their presence.

- Public Transportation : CCTV cameras may be lawfully installed on public transportation vehicles as well as at public stops; however, specific limitations must be complied with (e.g. narrow visual angle, no zooming, etc.).

- Webcams in Tourist Areas : The shooting should be arranged in such a way as not to allow identifying individuals.

Private Bodies

- Protection of Individuals and Property : CCTV cameras may be installed without obtaining the consent of filmed individuals in order to prevent assault, theft, robberies, damage, vandalism, fire, occupational accidents, etc. . However, the requirements laid down by the DPA will have to be met in all cases.

27 April 2010

Annex 1
(see point 3.1 in the DPA’s decision)
Note : If no recording is envisaged, please substitute “rilevazione” (collection) for “registrazione” (recording).

Annex 2
(see point 3.1.3 and point 4.6 litt. c. in the DPA’s decision)
Note : If no recording is envisaged, please substitute “rilevazione” (collection) for “registrazione” (recording).