CCTV in Retail Stores and GDPR: What You Need to Consider

CCTV is a common way to prevent theft, make staff feel safer and investigate incidents after the fact. At the same time, images of people are personal data, so camera surveillance in a store has to comply with the General Data Protection Regulation (GDPR) and, in Sweden, the Camera Surveillance Act (kamerabevakningslagen).

This article is a general overview and not legal advice. In Sweden, the Swedish Authority for Privacy Protection (IMY) is the supervisory authority and publishes guidance on camera surveillance on its website. Read it, and seek help from a lawyer or data protection officer if you are unsure what applies to your business. Outside Sweden, check the guidance from your own national data protection authority.

Why does GDPR apply to cameras in a store?

When a camera records people who can be identified, personal data is being processed. That applies whether the footage is recorded or only viewed live. The store is then the data controller and needs to be able to show that the surveillance is lawful, necessary and proportionate.

Start with the purpose

Before installing cameras, write down why you need them. Common purposes in a store include:

• preventing and investigating theft and vandalism
• improving safety for staff and customers
• protecting tills, stockrooms and high-value goods

The purpose drives every other decision: where cameras are placed, what they record, how long footage is kept and who may view it. Footage collected for one purpose should not be used for something entirely different.

Carry out a balancing of interests

For private businesses, the legal basis for camera surveillance is usually what GDPR calls legitimate interests. This means the store's interest in surveillance must be weighed against the interest of the people being recorded in not being monitored.

Questions to ask yourself:

• Is there a real problem the camera is meant to solve?
• Could the purpose be achieved in a less privacy-intrusive way?
• Can surveillance be limited in time, for example only when the store is closed?
• Can the camera's field of view be restricted to what is genuinely needed?

Document your assessment. It shows that you have thought the surveillance through and makes it easier to answer questions from staff, customers or authorities.

Placement and field of view

Cameras should be placed where they serve the purpose, such as at the entrance, the tills and vulnerable product areas. Avoid recording more than necessary.

Pay particular attention to:

• Staff areas: places such as break rooms and changing rooms are highly privacy-sensitive and should not normally be monitored.
• Toilets and fitting rooms: should not be monitored.
• Public space outside the store: recording the street or pavement calls for particular caution, and IMY's guidance should be read carefully.
• Audio: recording sound is often considered more intrusive than video and requires strong justification.

Your staff

Cameras in a store often record employees too. Staff must be informed about the surveillance, and there may be rules about consulting trade unions. Cameras should not be used to monitor how individual employees work unless that is a stated and acceptable purpose. Check with HR or an employment law specialist if needed.

Signage and information

People being recorded must be informed about the surveillance. In practice that means clear signs at the entrance and where the cameras are located. The sign should state that camera surveillance is in operation and who is responsible, and point to where more information is available, such as on the store's website or at the till.

The full information should describe, among other things, the purpose, the legal basis, how long footage is kept and the rights of the people recorded.

Retention period

Recorded footage should not be kept longer than necessary for the purpose. Decide on a retention period and configure the recorder so that footage is deleted automatically. If an incident needs investigating, the relevant footage can be kept longer and handed to the police. IMY's guidance offers support on how to reason about retention.

Security and access

Recorded footage needs protecting from unauthorised access. Some basic measures:

• Limit who may view live images and recordings.
• Use personal logins and strong passwords.
• Log who views or exports footage.
• Keep recording equipment in a locked space.
• Keep the firmware on cameras and recorders up to date.
• Put the cameras on their own separate network.

If you use cloud storage or a supplier that handles the footage, a data processing agreement is normally required.

Local recording or cloud?

Footage can be stored on a local recorder in the store or in the cloud. Local recording gives you full control over where the footage is held, but the recorder needs to be physically secured. Cloud storage means the footage survives even if the equipment in the store is damaged or stolen, but it requires you to vet the supplier and where the data is stored. Whichever you choose, the same requirements on retention and access apply.

The rights of people recorded

People who have been recorded have rights under GDPR, such as the right to request access to the data concerning them. It is a good idea to decide in advance how such a request will be handled, who is responsible and how other people in the footage are protected if material is released. The store manager and whoever administers the camera system should know the procedure.

Video analytics and privacy

Modern cameras can also be used for analytics, such as heat maps or queue alerts. These features can often be designed to produce statistics only, without storing images of people. Even then, you should assess how the analytics affect privacy and inform people about it.

Checklist

• Define and document the purpose
• Carry out and document a balancing of interests
• Limit placement and field of view
• Inform your staff
• Put up clear signs
• Decide and configure a retention period
• Protect footage and restrict access
• Review the surveillance regularly
• Read IMY's guidance on camera surveillance

How StoreIQ can help

StoreIQ installs IP cameras with recording and a mobile app for stores across Sweden. We help you position the cameras to cover what is needed, put up signage and configure retention periods, user permissions and a separate network for the cameras.

We do not provide legal advice, but we make sure the technology is set up according to the decisions you make based on GDPR and IMY's guidance. Contact us to arrange a store visit.