GDPR Enforcement Against Video Surveillance - 79 Fines Analyzed
The arrival of the GDPR three years ago raised fears in European video surveillance of stringent enforcement and high fines, but an IPVM review shows overall enforcement is inconsistent and limited.
While the median fine was low, the largest fine was over $12 million and one security firm was fined $80,000 for the common and controversial practice of filming video surveillance with one's smartphone.
In this post, IPVM examines GDPR enforcement, what practices are most legally risky, which countries have the most enforcement, and GDPR compliance best practices. Plus, we include a spreadsheet detailing the 79 cases we analyzed.
Executive *******
**** **** ********* (** *** ** 30) **** ****** **** ** **** one **** ***** ************ **** ** far, ***** **** *** ******* - Spain - *** ******* **** **** seven **** ***** ************ ***** ** total.
*** ****** **** ****** ** ~$*,*** and *** **** ****** ********** *** filming ****** *****, ******* ** ******* proper *******, *** ********* ********** *********. IPVM ***** **** *** ******** ***** subject ** * **** **** ** far **** *********** ******* *** ****-*******.
****'* ******** ******* ********** **** *** singled *** ***** ************ *** ****** enforcement *** *** ******** ** *********** by ******* ***-*****. *******, **** *** change ** *** ****** ***** *** to *** ****** ********** ** ***** providers *** *** ********** '**** **********'.
IPVM ******** ** ***** *** ***** ************
**** **** ******* **** ********* ******* ******** ******************* ********* ****** * ******** ** ***** single **** **** ********** ****** ***** surveillance ***** **** ** "****", "******", "video ************", ***.
**** **** ******** ***** ** ***** issued ** ***** **** ********** ********* to *** *** ***** *** ******* missed. *** ******* *** ******* ********, even ********* **** ***** **** **** DPAs ****** ********.
****** ****'* *********** ** ** **** video ************ ******* ** ******** *********.
Many ********* **** ** ***** ** ***
** *** ** ** **** ********* issued ** ***** ************ ***** ** all *** ******* * **** ****** one. *******, ***** ******* **** *** UK ****** * ***** ***** ****** issued ***:
***** *** ** *** *** **** active, **** ** *****. *** ***** was ** *******; *** ******-******* ****** of ***** *** ******* **** *, still ***** *** *** * *****-**** period.
Top ***** ******* *** *****
*** *** ***** ******* *** ***** was ******* ****** ** ******* *****, monitoring *********, *** ******* ** ******* proper *******:
Filming ****** *****, ********** ********* ********* ******* ********
********** ********* ***** **** ******* * public **** **** * ****** (** a ******* **** **** * ********'* entrance) *************** *, ***** ******** ********** ** ******** data ** "******* ** **** ** ********* ** relation ** *** ******** *** ***** they *** *********". *** *******, ** Austrian ******* **** ******** ****** $*,****** ********** * ****** ***** *** supposed ** **** ** ******** *** also ****** * ****** ************.
********** ********* *** **** ***** ***** to ******* ******* * **** ******* spaces ****** *********** (**** ****** *****) or **** **** ******** ******* **** possible. *.*. * ***** ****** *********** company*** ******** ********** ******* ********* ** ***** desks.
******* ** ******* ****** *********
********** ******* ******* ****** ******* *** also * ****** ****, **** ********** finding ************ *** ****'******** ** ('*********** ** ** ********').********* **** ********* ***** *** *** having *** ******* **********. ******** *** GDPR ******** ** ******* ** **** specific ******* ** ******** ** *******, IPVM ***** *** ******** *** ***** for ******* ********* ********* ** ************ details.
********* *** ******* ******* ** ***********
******* ******* ******* *** ***-***** *** recorded ****** ***** ************ ******* **** their ********** *** ****** ** **********, with **** ***** ** ******* ******** 5,* (********** ** **********), ***** ('******** ** **********').*** *******, * ********* *********** *** fined ***** *** *** ******** **** violations ******** **,*** ***** (~$**,***) ***** an ******** ****** ************ *******.
Median **** **** $*,***
*** ****** *** ******* ***** ***** the **** *** ******* ********* ******* ** ******* ***** ($**.* *******) or *% ** ****** *******, ********* is ******. *******, *** ****** **** video ************ **** *** ~$*,*** ***** is *** *************, *** ***** ********** for **** *********.
Single **** ** ******* ***** $**.* *******
*** ******* **** ****** ** ***,*** euros ($***,***) ** ********** ****** ** a **** **** ** ******* ***** a ******** ************** ****** ******** *****************.****.* ******* ***** ** $**.* ******* for ********** ***** *** ********* *** "at ***** *** ***** **** ** legal *************". *** ****** **** *** so **** **** ** *********** **% of ***** ****** **** ***** ************ fines. ********* **** ****, ******** ********** imposed ***,*** (~$***,***) ***** ** ***** for ***** ************-******* **********.
*****************.** *** ***** *** ********** * wide ***** ** ***** - **** as "**********, ***** ******, ********** *** staff *****" - ******* ****** **** invasive ******* **** "****** *** ******", the ** **** ********** *********. *** ******* **** *** *** "limit *** ***** ************ ** ******** employees ** * ******** ******" ***** saving **** ********** *** ** ****, "much ****** **** *********" **** ******.
*** **** ** ***** ******'* ***,******* *****, ****** **** **** * "******* violation ** ********* ************", ******* ********* that **** ****** ******* "********* *** unjustified" ******** ************ "**** ** ***** criminals":
**** ** * ******* **** ** workplace ************. ********* **** ** ********** that **** ********* ***** ************ ** a ***** ********* ** ***** *********’ rights. ***** ********** ***** ***** **** video ************ *** ** *********** **** to ***** *********, **** **** *** justify *** ********* *** *********** ************ with *** ******** ****** ** ***** employees. ** **** **** *** ****, companies ***** ** **** ** ****** their ************ ******* *****. ********* ** not **** ** ********* ***** ******** rights **** ******* ***** ******** **** them ***** ******* *********
** ***** **** **** **** ***** to *****************.**, **** *** ****** ******* fine ** **,*** ***** ** ~$**,*** being ********* * ******* **** ********** ******* ** ******* * **** Protection ****** ********** *** *** ************ system.
End **** *******
****** *** *** ***** **** ****** against *** *****, *** *** ********* considered '**** ***********'***** *** ****, *.*. *****, ***********, ******* *******, etc. ** ************* **** **** ** Hikvision **** *****. **** ** ************ since *** ***** *** ********* ****** the **** ****** *** ******* **********, like ******* ****** ***** ** *** displaying *******.
Only *** ******** ********* *****
**** ***** **** **** *** ******** of ******** ********* ***** ***** **** video ************ **********. *** ***** *** a ******** ******** **** ***** ******** recorded * ******'* ***** ************ ******* on *** *********, **** "****** ** with * ***** *****" ******* "******* and ********" ** *** **** ******* in *** *******, ******** **** ************* *********.
**** ***** $**,*** **** **** ******** for ********* ******* ** ('******** ** **********'). *** ****'* ****** *************** "*********" ** ***** *****; *** Croatian *** ******************* *** "********* * ******* ** controllers *** ********** **** *** **** must ** ***** *********, **** ********* are ****".
*** ***** **** *** ** *****, where * ******** **************** ** ******** **** ********** ******* (*******, *** employee *** ** * ***) *** was ***** **,*** ***** ($**,***) *** breaching******* **, ***** ******** * *** ** an ******'* "**** **********" ******* "********** monitoring ** **** ******** ** * large *****".
Data ******* **** ****** ** **** **********
**** *** *** ****** ******** ***** the **** ********** ********** *** **** allow ********* ********** ** ****. *******, data ******** **** ********* ******* ** complaints, ******* **** **** ********* ** certain ********* ********* ***** ************, ********* who ******* ******* ******** ** ***** property, ** ****** *** *** ************ footage ** **** ****** ** ****** media.
vSaaS ***** **** ***** **** ********
****'* ******** ** *** ******* **** GDPR ********** ** ***********, ** ***** do ****** *** *** **** ************** that ***'* ****** ** * **** (which **** ******** **** *** *****) can ***** **** ** **** *** resources. ****'* ****** **** ******** **** European ********** **** *** ******* *** video ************ *** *********** ***, ********** ***** **** ********* *******.
*******, **** **** ****** ** ***** services *******-**************** **** ******* ** ******, ***** with ***** ********* ******** ****** ******** data *** **** ****** ****-****** '**** Processors'. *** *******, * ****/****** **** the******* **** ********* ******* *** ***** **** ***** were ** ** ****** ** ******, particularly ***** *******'***** ******** *********.
How ** ***** *****
*** **** *** ** ***** * GDPR **** ** ************* ** ** comply **** *** ****. *** ****** on ********** **** ***, **** ****'***** *** ***** ************ *****, ******* *** ****** ******* *****, *** *** *********** ** *****'* ******** ***** ************ **********.
******* **** *******'* **** ********** ********* interprets *** **** ***********, **'* **** good ** ***** ** **** ******** DPA *** ****** * ******** ***** for ***** ************ **********.
*** **** *********** ** **** ***** GDPR ** **** ** *** ******** industry. ** **** ************* ***** ** invade **** *******, **** ***** ** sanction ***** ******** ********.
******* *** *** **** ******** ***** the ********* ** ****** *** ********* and **** ******** *** ********* **** to ** ****.
*** ***************** *** ** ***********. ** there * **** ******** ** ******, especially *** ******* **** ***** ***** that *****'* **** ****? * ****** if * ******** **** *** **** face ******** ** ******* **** ********* (I'm **** ****** ** ** ****!) for ******* ***** *** ***** ****? You **** **** ******* *** ******* face **** * ***** *** **** committed *** **** * ******* *** audit *** ****** ****. *** ***** are ***** ******** ***** *** *** they *** ********* ** *** ******** system ********* **** *** ********* ****/**** until *** ***** ******** ** ***** occurs?
******* **** *** ***** ***** **** and ** *** *** **** **** of ********* ***** ******** **** ** Europe *** **** ******?
****** *** *** *********** **** ****.