Data protection and video surveillance in public spaces – a contradiction in terms?

Not too long ago, German courts have issued clear rulings on video surveillance in public spaces and data protection: Video surveillance may not take place during a registered assembly, otherwise the fundamental right to freedom of assembly is restricted. In addition, there are further particularities that influence the use of video security technology in an urban context.

German law is very clear: there must be a legal basis and proportionality for the use of video surveillance, as it generally represents an encroachment on the right to informational self-determination. In most cases, decision-makers think first and foremost of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) or state data protection laws. In Germany, however the legal basis for permissible video surveillance is often the Police Act (POG) of individual federal states.

Insufficient image quality may make surveillance inappropriate
Under certain circumstances, the POG entitles the police to use video technology or to demand its use. First and foremost, this means that the public area in question is a so-called crime hotspot. These are places where it has been proven that more crimes are committed – such as drug trafficking, bodily harm or damage to property – or where the nature of the area is conducive to the commission of such crimes. However, it is always necessary to check whether milder measures, such as improved lighting or the deployment of more civilian or patrol police officers, are not sufficiently suitable for fulfilling the purposes, i.e. preventing such crimes or solving them, for example. There may also be objections from the data protection side if the purpose of the measure is not fulfilled by the use of video security technology. This may be the case, for example, if the image quality is not sufficient in all areas of the monitored space, e.g., to be able to identify criminals (= purpose of the surveillance). In that case – as contradictory as it sounds – the video surveillance may declared illegal because it is not good enough to identify individuals.

“Integration and participation”
Keyword data protection: In the case of video projects in public spaces, it can be consistently observed that data protection officers are perceived as “opponents“ and are kept out of the decision-making process for a long time for fear of possible resistance. However, the data protection officer or the responsible external data protection supervisor – both at the municipal and state level – fulfills an important function in a democratic society. And they want to be taken seriously. So, the earlier involvement in the project and planning takes place, the better it is possible to communicate “at eye level“.

Are we talking about the same thing?
To ensure that project managers and data protection officers are talking about “the same things,“ it has proven useful to use 3D simulations for video projects in public spaces, which are often available from manufacturers of video security technology. These vivid visualizations recreate the area to be monitored, such as a public square in a city center, as a “digital twin.“ In this model, the locations, fields of view and image qualities of the individual cameras can then be simulated exactly. This allows the people involved in the project to see what image quality the cameras provide in each sub-area of the area to be covered. The resolution qualities are in turn defined in the DIN EN 62676-4 standard for video surveillance systems. This distinguishes between several image qualities for different purposes. In the field of video observation or video surveillance in public areas, a resolution density of 250 pixels per meter (px/m) is usually required. This is almost always sufficient to identify perpetrators beyond doubt in court.

In addition, the 3D model shows where personal or personal-related data is generated and whether cameras may need to be positioned differently so that the responsible parties can operate them in compliance with data protection requirements. At the same time, the use of further data protection measures can be planned. These include pixelation and blackening of entrances to residential and commercial buildings, temporary storage of video images, or separate access rights – such as for public transport operators as secondary users of the video system, who are only given access to the overview images from the cameras.

Protecting freedom of assembly
More and more frequently, courts are declaring the operation of stationary video surveillance at peaceful public gatherings, such as demonstrations or rallies, to be illegal. According to court decisions, those responsible must not only switch off cameras, but deactivate them in a “highly visible“ manner.

Instead of the personnel- and time-intensive covering of the cameras by means of jute sacks or bags attached via a hoist, some manufacturers now also offer technical solutions – such as remote-controlled blinds that cover the lenses of the cameras and can be activated at the touch of a button in the control center. These “privacy blinds“ thus clearly indicate to participants that no video surveillance is taking place. In this context, the Higher Administrative Court of North Rhine-Westphalia stated in a ruling in May 2022 that video surveillance must also be deactivated for a certain period of time before and after assemblies, as the fundamental right to freedom of assembly also involves the arrival and departure of participants (case number 5 B 137/21).

This also belongs on the sign
In order to make the video surveillance measure clearly visible, according to the BDSG and DSGVO, “the circumstance of the observation and the name and contact details of the person responsible (...) must be made recognizable by suitable measures at the earliest possible time“. In most cases, this is done by applying a clearly visible information sign. Here there are already copies that explicitly point out that there is no video recording before, during and after assemblies.

No data protection without data security
In addition to technical and organizational data protection measures, however, the protection of the data itself must not be ignored, for example, protection against unauthorized access or loss. Thus, the GDPR anchors the aspect of data security in Article 32 “Security of processing“ with the requirement of “security by design“. Since video systems are repeatedly the target of cyber-attacks, by which hackers either “leak“ video recordings or gain access to networks of companies or organizations, only video solutions equipped with appropriate security features may be used. These include, for example, physical separation of the corporate and video networks, end-to-end encryption that can be enabled, strong password enforcement, or secure network authentication procedures. In the face of the geopolitical situation cities and municipalities are increasingly choosing video systems that are developed and manufactured in Germany or Europe under constitutional and democratic conditions.

Helpful checklists and best practices
To assist companies and public authorities with legal orientation, official data protection bodies, such as the Data Protection Conference (DSK) or the European Data Protection Committee (EDSA), offer useful guidance and guidelines for the use of video security systems on their websites. It may also be worth asking manufacturers and suppliers of video security technology for more detailed information, guidelines or handouts for video projects in public spaces.

Conclusion: A complex topic, but manageable
Privacy is certainly as old as video technology itself, but high-resolution cameras, varying laws, and recent jurisdictions make the range of issues for video surveillance in public spaces perhaps more complex than ever before. However, through helpful 3D project simulations, innovative technologies such as privacy blinds, and the application of best practices, the complexity of the subject area can usually be managed well. In this way, the security of each individual is consistent with the data protection or the right to informational self-determination in public spaces.

Feel free to join in our discussion on LinkedIn

Do you have any questions? Or would you like to share your thoughts on this subject with us?
We welcome you to post your comments and remarks!