Today there are many communities of owners who agree to install video surveillance cameras in common areas as a protection system for this type or areas and residents, although, before installation, and so as not to violate the regulation on data protection, it is necessary to know what are the steps to follow for its installation and start-up.
Last December came into force the current regulation on Personal Data Protection, that is, the Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights. This law adapts the Spanish legal system to European Union Regulation 2016/679 of the European Parliament and Council, of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free circulation of it.
In the first place, in order for a community of owners to install surveillance cameras in their common areas, it is necessary that the installation is agreed by the Owners’ Board, taking into account, for this, what is established in article 17 of the Law of Horizontal property regarding the votes necessary for the approval of said agreement (favorable vote of three-fifths of the total of the owners who, in turn, represent three-fifths of the participation fees).
In the agreement that is taken in this respect, and that, evidently, must be recorded in the “acta”, it would be convenient to specify the chosen video surveillance system, how many cameras are going to be installed and the areas that are going to be recorded.
Once the Board of Owners has adopted the installation of a video surveillance system, and before putting it into operation, the community of owners must prepare the record of video surveillance treatment activities established in Article 22 of the Law on Protection of Personal Data and guarantee of digital rights.
When we speak of registration, we refer to an internal document of the community of owners, in which the following aspects should be detailed:
- The data of the person responsible for the treatment, this being the owners’ own community.
- The purpose of the treatment, which would be the safety of people and goods.
- Category of the interested party, being, for example, the people who access the facilities.
- Category of data, in this case images.
- Days until suppression of the images, that according to the effective legislation is of 1 month from its recording.
- Security measures, detailing them.
- Also, it is necessary to inform people who access the common areas where cameras are installed that are entering a video surveillance zone. To do this, posters will be placed in the access areas to the video surveillance zone, located in totally visible places.
In these posters you must clearly indicate that we are facing a video surveillance zone, the identity of the person in charge, who, as we have already indicated, would be the community owners, the possibility of exercising data protection rights and the person before which it has to be done and a reference to where to obtain more information about the processing of personal data.
To facilitate this task, the Spanish Agency for Data Protection has a model of these posters.
Another important aspect to take into account is the recording environment of the cameras installed, being that they can only record common areas of the community of owners, without filming the public road except the minimum strip necessary to capture access to the property of the community.
Obviously, you can not record any other area that does not belong to the community.
Another fact to take into account is if workers are going to be recorded, being that in that case they should be notified, informing them of the rights that correspond to the capture of images and not being able to record in their rest area. In addition, the collection must be done within the legal framework and in accordance with the provisions of the Workers’ Statute.
Once we have installed the cameras according to the law allows us, it is necessary to know who, how and for how long the images can be seen.
The community of owners must designate a person to be the only one who has access to the images captured and the area where the system is located.
The person designated for the treatment of the images should be warned of their duty of confidentiality and secrecy, the steps to follow in the case of a data security breach and the technical measures to be used to guarantee the security of the recordings. and, therefore, the protection of the personal data of the people filmed.
Both the access to the area where the recording system is located and the images that are filmed must be insured in such a way as to guarantee that only the authorized person will have access, being that if the access is made with an internet connection, restrict by means of a user system and password or any other means that guarantees access exclusivity.
The location of the recording system must be a restricted area, to which, as already indicated, only authorized personnel can access.
The images will be kept for a month, and after that period they must be erased. If the images show the commission of facts against persons, goods or facilities, the period of one month of storage would not be applicable, although the images must be made available to the competent authority within 72 hours from the date it is taken.
Finally, note that the community of owners can hire an external video surveillance service, although this commission must be regulated by a contract that establishes the object, duration, nature and purpose of the treatment, the type of personal data and categories of stakeholders, and the obligations and rights of the person responsible. The community of owners, as responsible, must choose a person in charge of processing data that can comply with legal requirements, responding otherwise, for their duty of care before the choice of the person in charge.
However, the hiring of an external video surveillance service does not exempt the community of owners from complying with the data protection regulations and with the records that it requires.
As you can see, before installing in a community of owners of a video surveillance system, it is necessary to be very clear about all the necessary steps to avoid violating the right of protection of personal data of residents in the same or of the people who access it, since, nowadays, the tuition regulations on data protection is very demanding.
Verónica Ávila Díez