The Danish Data Protection Authority has published a closure decision regarding the use of video surveillance by a social housing company. Although no sanctions were imposed, the decision sets out a series of reminders and key points of attention for data controllers implementing such systems, notably on necessity, data minimization, and information to data subjects.

Facts and context

The Danish Data Protection Authority (Datatilsynet) published a decision closing its inspection against the social housing company "Arbejdernes Andels Boligforening", without imposing any sanctions, concerning the use of video surveillance.

The case originated from an inspection planned by the authority for the year 2024, aiming to examine the compliance of video surveillance practices of five housing companies.

Reasons for the decision

The authority examined the compliance of the video surveillance system with several principles and obligations, making the following observations:

• Principle of necessity and proportionality: The authority recalls that video surveillance is a very intrusive form of data processing. Its implementation must only occur for compelling reasons, such as crime prevention and combat, which make it necessary. Isolated incidents of vandalism or simple theft generally do not justify surveillance. The data controller must have assessed less intrusive measures and must periodically reassess the necessity to maintain the system, disabling it if the issues that led to its installation have disappeared.

• Data minimization obligation (Article 5(1)(c) of the GDPR): Out of respect for residents' privacy, cameras must be placed and configured to avoid filming people's comings and goings at their home entrances as much as possible. The authority noted that in one residence, cameras were directed at apartment entrance doors but dynamic masking zones ("privacy zones") were used to avoid filming inside the dwellings when doors open.

• Lawfulness of audio recording (Article 6 of the GDPR): Audio capture by video surveillance devices is lawful only if based on a valid legal basis and is relevant and necessary regarding the pursued purpose. The data controller must systematically consider whether the purpose can be achieved by less intrusive means, such as video surveillance without audio recording.

• Storage limitation obligation (Article 5(1)(e) of the GDPR): The company retained recordings for 30 days, justifying this duration by police processing times. The authority positively noted that reflection was made on the retention period. However, it reminds that the maximum duration allowed by national law (30 days) is not a default duration and recordings must be deleted earlier if there is no real need to keep them that long.

• Information obligation (Articles 13 and 14 of the GDPR): The authority noted that the company informed new tenants via a notice attached to the lease contract and visitors via clear information panels supplemented by QR codes linking to detailed information. Regarding employees, information was provided via an addendum to the employment contract, but the authority noted this document was incomplete, notably omitting the retention period and categories of recipients.

• Right of access (Article 15 of the GDPR): The company had a formalized internal procedure to handle access requests to recordings, including identity verification, masking of third parties, secure transmission, and subsequent deletion of files. This procedure was deemed satisfactory by the authority.

Authority's decision

Consequently, the authority did not find it necessary to take further control measures and closed the inspection.

Lessons learned

This decision reminds that:

• The implementation of video surveillance, especially in residential areas, must be justified by a compelling and documented necessity, after demonstrating the ineffectiveness of less intrusive measures.

• The data minimization principle requires rigorous technical configuration of cameras (angle, orientation, masking zones) to avoid excessive infringement on individuals' privacy, especially near their homes.

• The retention period of video recordings must correspond to a real and justified need and must not be by default aligned with the maximum duration allowed by applicable legislation.

• Information to data subjects can be delivered at multiple levels (summary information panel with QR code, detailed notice), but must always be complete and easily accessible.

• Employees filmed at their workplace must receive complete information compliant with the GDPR requirements, just like any other data subject.