Video Surveillance and Personal Data Protection in Bulgaria

→ Mirena Taskova

There is an increasing trend that Bulgarian companies use video surveillance without being aware that they actually process personal data and, by doing so, risk severe sanctions if they do not comply with the legal requirements for personal data processing.

Until recent­ly, video sur­veil­lance sys­tems were used main­ly by banks and big cor­po­ra­tions in Bul­gar­ia. But now, many small and mid-sized com­pa­nies pre­fer to secure their hotels, retail stores, offices, etc. with such sys­tems. Most of these com­pa­nies are not aware that video record­ings con­tain­ing the face and voice of peo­ple store their per­son­al data and that these com­pa­nies are actu­al­ly pro­cess­ing such per­son­al data.

Why is video surveillance considered personal data processing?

In most cas­es, record­ings col­lect­ed via video sur­veil­lance con­tain per­son­al data because the indi­vid­u­als may be iden­ti­fied (eg, by their faces). The Bul­gar­i­an Per­son­al Data Com­mis­sion (CPDP), which is the Bul­gar­i­an Data Pro­tec­tion Author­i­ty, con­sid­ers that video sur­veil­lance is per­son­al data pro­cess­ing because they are video record­ings made via tech­ni­cal means. Such video record­ings and the per­son­al data con­tained there­in are like­ly col­lect­ed, stored, used, revealed and dis­trib­uted by the com­pa­nies and, there­fore, fall under the def­i­n­i­tion of per­son­al data pro­cess­ing in the Bul­gar­i­an Per­son­al Data Act (PDPA).

A com­pa­ny may process per­son­al data only if it meets the require­ments in the Bul­gar­i­an PDPA, fail­ing which it may suf­fer sanc­tions of up to EUR 50,000.

What should a company do if it processes personal data via video surveillance?

Register as a personal data administrator or update its registers

Before start­ing to use video record­ings to col­lect and store per­son­al data, a com­pa­ny should file with the CPDP an appli­ca­tion for reg­is­tra­tion as a per­son­al data admin­is­tra­tor, or if already reg­is­tered, file with the CPDP a new reg­is­ter “Video Sur­veil­lance”.

Update its internal rules

The com­pa­ny must under­take appro­pri­ate tech­ni­cal and organ­i­sa­tion­al mea­sures to pro­tect the per­son­al data of indi­vid­u­als against unlaw­ful pro­cess­ing, and must imple­ment such mea­sures in its inter­nal rules.

Observe the principles for personal data processing envisaged by the PDPA

Like any per­son­al data pro­cess­ing, video sur­veil­lance must com­ply with prin­ci­ples of law­ful­ness, expe­di­ence and pro­por­tion­al­i­ty.

Observe the conditions for personal data processing envisaged by the PDPA

At least one of the con­di­tions per­mit­ting per­son­al data pro­cess­ing should be met (eg, con­sent, pro­tec­tion of the life or health, etc.). Giv­en the nature of video sur­veil­lance and the CPDP’s opin­ion, video sur­veil­lance may be used by: (i) per­sons licenced to pur­sue pri­vate secu­ri­ty activ­i­ties, (ii) gov­ern­ment insti­tu­tions in their activ­i­ties, (iii) per­sons pro­cess­ing per­son­al data on the basis of cer­tain legal grounds or (iv) per­sons who have obtained the explic­it con­sent of the indi­vid­ual. Most com­pa­nies can only use the last con­di­tion, elab­o­rat­ed below.

Obtain the consent of the individual or notify the individuals by a notice board

Pri­or to the per­son­al data pro­cess­ing, the com­pa­ny may obtain indi­vid­u­als’ con­sent via a pro­vi­sion in their labour agree­ment (if employ­ees are sub­ject to video sur­veil­lance) or via an agree­ment, dec­la­ra­tion of con­sent, etc. (if clients are sub­ject to video sur­veil­lance). Such con­sent, how­ev­er, is often impos­si­ble to obtain. Imag­ine how dif­fi­cult it would be for a per­son­al data admin­is­tra­tor, a retail store chain, to obtain the con­sent of hun­dreds of peo­ple pass­ing in front of the video cam­era every day.

To tack­le this prob­lem, the CPDP has issued an expert opin­ion on how the per­son­al data admin­is­tra­tors may process the per­son­al data of an unde­fined num­ber of indi­vid­u­als. They have the option to noti­fy the indi­vid­u­als about the video sur­veil­lance via notice boards placed on vis­i­ble loca­tion and con­tain­ing the con­tact details and oth­er infor­ma­tion iden­ti­fy­ing the per­son­al data admin­is­tra­tor. If indi­vid­u­als are aware of the video sur­veil­lance and still enter the site, it is deemed that the indi­vid­u­als have agreed that their per­son­al data be processed in such man­ner.

The personal data administrators processing the personal data of an undefined number of individuals may notify them about video surveillance via notice boards placed in visible locations.