Restrictions in CCTV surveillance used by municipalities

According to the President of the PDPO, the need to combat crime, including organised crime, and to facilitate the conduct of criminal proceedings are not sufficient reasons that would entitle municipalities to introduce video surveillance enabling the gathering of biometric data and identifying of individuals and vehicle license plates in order to fulfil the purposes specified in Article 9a of the Municipal Self-Government Act (Journal of Laws of 1990, no. 16, item 95), i.e. ensure public order, safety of citizens, and protection against fire and flood.

Pursuant to Article 7 of the Constitution of the Republic of Poland, public authorities may act only on the basis of and within the limits prescribed by law. Thus, public authorities cannot make presumptions as to their powers if such powers do not follow explicitly from law. At the same time, one should bear in mind the restrictions on the processing of special categories of personal data, which include biometric data, set forth in the GDPR. Pursuant to Article 9(1) of the GDPR, it is prohibited to process special categories of data, including biometric data, except for the cases specified in Article 9(2). At the same time, it should be noted that special categories of data are processed on an exceptional which as such should not be construed extensively.

 

One of such cases is indicated in Article 9(2)(g) of the GDPR – when processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; So for this condition to be fulfilled, there must be a legal provision that would allow the processing of special categories of data whenever this is justified by substantial public interest. With this in mind, generally, if a public entity, including a municipality, was allowed to process special categories of personal data, such as biometric data, under the above premise, there would have to exist a legal provision that would allow such processing.

The President of the PDPO holds that Article 6(1)(e) and Article 9(1)(g) GDPR read together with Article 9a(1) and (2) of the Municipal Self-Government Act do not meet that requirement. Pursuant to Article 9a(1) of the Municipal Self-Government Act, to ensure public order, safety of citizens, and protection against fire and flood, municipalities may use technical measures enabling the recording of images (CCTV surveillance) in public areas with consent of the manager of that area or an entity which holds legal interest in that area, or in real properties and structures owned by a municipality or its organisational entities, and on the premises surrounding such real properties and structures, if this is necessary for ensuring public order, safety of citizens or protection against fire and flood. 

As indicated by the President of the PDPO, that regulation does not entitle municipalities to introduce video surveillance which gathers biometric data and identifies individuals, and thus to process the images of individuals through specific technical means allowing the unique identification or authentication of a natural person, i.e. biometric data.

Therefore, for the time being, the processing of biometric data by municipalities is prohibited as there is no sufficient legal basis for doing it.