Video Surveillance and Personal Data Protection in Bulgaria
→ Mirena Taskova
There is an increasing trend that Bulgarian companies use video surveillance without being aware that they actually process personal data and, by doing so, risk severe sanctions if they do not comply with the legal requirements for personal data processing.
Until recently, video surveillance systems were used mainly by banks and big corporations in Bulgaria. But now, many small and mid-sized companies prefer to secure their hotels, retail stores, offices, etc. with such systems. Most of these companies are not aware that video recordings containing the face and voice of people store their personal data and that these companies are actually processing such personal data.
Why is video surveillance considered personal data processing?
In most cases, recordings collected via video surveillance contain personal data because the individuals may be identified (eg, by their faces). The Bulgarian Personal Data Commission (CPDP), which is the Bulgarian Data Protection Authority, considers that video surveillance is personal data processing because they are video recordings made via technical means. Such video recordings and the personal data contained therein are likely collected, stored, used, revealed and distributed by the companies and, therefore, fall under the definition of personal data processing in the Bulgarian Personal Data Act (PDPA).
A company may process personal data only if it meets the requirements in the Bulgarian PDPA, failing which it may suffer sanctions of up to EUR 50,000.
What should a company do if it processes personal data via video surveillance?
Register as a personal data administrator or update its registers
Before starting to use video recordings to collect and store personal data, a company should file with the CPDP an application for registration as a personal data administrator, or if already registered, file with the CPDP a new register “Video Surveillance”.
Update its internal rules
The company must undertake appropriate technical and organisational measures to protect the personal data of individuals against unlawful processing, and must implement such measures in its internal rules.
Observe the principles for personal data processing envisaged by the PDPA
Like any personal data processing, video surveillance must comply with principles of lawfulness, expedience and proportionality.
Observe the conditions for personal data processing envisaged by the PDPA
At least one of the conditions permitting personal data processing should be met (eg, consent, protection of the life or health, etc.). Given the nature of video surveillance and the CPDP’s opinion, video surveillance may be used by: (i) persons licenced to pursue private security activities, (ii) government institutions in their activities, (iii) persons processing personal data on the basis of certain legal grounds or (iv) persons who have obtained the explicit consent of the individual. Most companies can only use the last condition, elaborated below.
Obtain the consent of the individual or notify the individuals by a notice board
Prior to the personal data processing, the company may obtain individuals’ consent via a provision in their labour agreement (if employees are subject to video surveillance) or via an agreement, declaration of consent, etc. (if clients are subject to video surveillance). Such consent, however, is often impossible to obtain. Imagine how difficult it would be for a personal data administrator, a retail store chain, to obtain the consent of hundreds of people passing in front of the video camera every day.
To tackle this problem, the CPDP has issued an expert opinion on how the personal data administrators may process the personal data of an undefined number of individuals. They have the option to notify the individuals about the video surveillance via notice boards placed on visible location and containing the contact details and other information identifying the personal data administrator. If individuals are aware of the video surveillance and still enter the site, it is deemed that the individuals have agreed that their personal data be processed in such manner.