The General Data Protection Regulation (GDPR) has been applicable since 25 May 2018. Not by coincidence did the revised Law on Surveillance Cameras enter into force the same day. After all, filming people does imply the processing of personal data.

This revised law provides, inter alia, an obligation to (i) submit an electronic declaration of the camera system, (ii) maintain specific records of image processing activities, and (iii) display (adapted) signs.

In addition, non-compliance with the Camera Act is now sanctioned more severely.

The use and placement of cameras in companies is subject to numerous rules. For example, the camera surveillance of employees may only take place for specific purposes and is also subject to compliance with a number of specific conditions included in the CLA no. 68. One of these conditions is that the employer must inform in advance the employee(s)(representatives) about the camera surveillance.

If the camera system is also used to prevent, detect and track down crimes comitted by third parties (e.g. customers, suppliers, visitors,...), the cameras are so-called surveillance cameras. For such cameras, not only the CLA no. 68 will be relevant, but also the amended Law on Surveillance Cameras. The most important additional obligations are the following:

(i) a specific electronic declaration - using a standard form on the dedicated e-desk of the FPS Home Affairs via the website www.aangiftecamera.be - must be made to the police services. This registration must be made per site monitored by cameras, with several compulsory indications, and must be re-validated annually. The new electronic declaration must also be made for already existing camera systems that have already been notified to the (former) Privacy Commission. For these cameras a transitional period of two years is foreseen. Therefore this must be done before 25 May 2020 at the latest;

(ii) specific records of image processing activities must be kept. This obligation is already applicable (since 25 May 2018). In addition to the data that the GDPR requires registration of in the records of the processing activities, the records of image processing activities must also contain the following information:

• the legal basis for the processing activity;
• the indication of the type of place (either private or non-private);
• the technical description of the surveillance cameras and, in the case of fixed surveillance cameras, their location - if applicable - indicated on a plan;
• in the case of temporary or mobile cameras, the description of the zones monitored by these surveillance cameras and the periods of use;
• the way information is given about the processing (e.g. via a general privacy statement to the employees and other persons);
• the place for processing the images;
• whether the images are viewed in real time and how this is organised if necessary.

(iii) signs must be hung at the entrance to alert the public that surveillance cameras are being used. These signs must - in addition to the already existing mandatory specifications - mention the phone number and the website (and, if applicable, the coordinates of the data protection officer) of the company. The existing signs must be adapted to these new regulations before 11 December 2018.

In addition, the legislator has also introduced consideraly higher sanctions for violations of the Camera Act.

Furthermore, you should bear in mind that the general obligations as foreseen in the GDPR continue to apply, which i.a. implies that the enterprise must provide extensive information (e.g. via a privacy statement to the staff and/or online privacy statement to the public), that a data protection impact assessment may need to be carried out, and so on.

> Action point

When introducing a new surveillance camera system, an electronic declaration must be made on www.aangiftecamera.be and signs must be hung up. For existing surveillance camera systems the electronic declaration must be submitted before 25 May 2020 and the signs must be modified before 11 December 2018. As soon as the surveillance camera system is operational, specific records of the image processing activities must be kept.