Embed Size (px)
Citation preview
1
The practice of the Parliamentary Commissioner for Data Protection and
Freedom of Information regarding video surveillance
Presentation bydr. György Halmosdata protection expert
Department for International AffairsOffice of the Commissioner for DP and FOI
8th Annual Conference on ICT Law 04.20.2007
2
The structure of the presentation
• The current Hungarian law in force• Most important areas of video surveillance• Complaints and investigations: number of cases• The recommendation of the Commissioner• Recent records of events
3
The current Hungarian law in force - I.
Article 80 of Act IV of 1959 on the Civil Code provides that:
• „(1) Any abuse of another person's image or recorded voice constitutes a violation of individual rights.
• (2) The airing of an image or voice recording, except for those made at public appearances, is subject to the consent of the subject.
• (3) Images (and voice recordings) of individuals reported missing or under criminal proceedings for a serious crime may be used, on the permission of the authority, when so dictated by the interest of the public or an appreciable private interest.”
4
The current Hungarian law in force - II.
Article 42 of Act XXXIV of 1994 on the Police (Police Act or PA)
• „(1) As part of its official action, the police may take image and voice recordings of persons involved in that action and their environment, including any object and circumstance with relevance to the given action. The Police may also install image recording devices in public areas in such a way as to render them clearly visible for citizens. The population shall be informed of the fact that cameras have been installed and are being operated in those locations. Image and voice recordings made by the Police, and the personal data contained by them, may not be used, except in a procedure brought against a crime or misdemeanor committed on the scene, or to help identify a person under warrant.
• (2) If no criminal or misdemeanor proceeding has been brought in connection with an act recorded on the scene, and provided further that the information contained therein is not of enduring value, then the recording must be destroyed, no later than in six months from the date the recording was made.”
5
Article 7 of Act LXIII of 1999 on Maintaining Law and Order on Public Property:
• (1) The inspector, in the course of performing his functions as determined by law, shall ensure official inspection of the area in his competence on a regular or continuous basis.
• (2) The inspector may take image and voice recordings of persons involved in that action and their environment, including any object and circumstance with relevance to the given action, which recordings can only be used in the given procedure and in compliance with regulations.
• (3) If no procedure is started in connection with an act recorded on the scene, the recording must be destroyed, no later than in six months from the date the recording was made."
The current Hungarian law in force - III.
6
Article 28 of Act CXXXIII of 2005 on Security Services and the Activities of Private Investigators(2) In connection with the guarding of any private property that is open to the general public, the security guard shall post a warning or information sign in a clearly visible place, written in an easily understandable fashion to convey useful information to third persons seeking admission into the property:
c) the use of an electronic surveillance system (outdoor surveillance) in the premises;
d) the purpose for surveillance with the electronic security system and for the use of sound and video recording facilities containing personal data, and the purpose for which they are processed, including legal authorization for processing, the place where the recordings are stored and the period of storage, the person using (operating) the system, the persons authorized to access these data, and the provisions of Act LXIII of 1992 on the Protection of Personal Data and Access to Information of Public Interest (hereinafter referred to as
"DPA") concerning the rights of data subjects and the procedures for enforcing such rights;
The current Hungarian law in force - IV.
7
Article 74 of Act I of 2004 on Sport (non-official translation)• The event organizer in order to protect the security of the spectators being present at the
sport event may monitor the spectators and record the captured images.
• The event organizer shall inform the spectators about the fact of the surveillance, as well as the location of the cameras, the data being processed on a clearly visible billboard placed outside the sport area also on the tickets and season tickets.
• The police may call on the event organizer within 48 hours counting from the closing of the event to store the data recorded for 30 days if the data are needed to start criminal or misdemeanour proceeding that has been brought in connection with the sport event. If the police requires the data the organizer shall deliver the recorded data to the police without any delay.
• If the organizer has not been called on by the police it shall delete the data recorded within 24 hour.
The current Hungarian law in force - V.
8
Act LXIII of 1992 on the Protection of Personal Data and Public Access to Data of Public Interest (DP and FOI Act)
• Interpretative provisions in Section 21.) 'personal data' shall mean any information relating to an identified or identifiable natural person (hereinafter referred to as ‘data subject’) and any reference drawn, whether directly or indirectly, from such information. [...]
9.) ‘data processing’ shall mean any operation or set of operations which is performed upon data, irrespective of the applied procedure, such as collection, obtaining, recording, organisation, storage, alteration, use, transfer, making public, alignment or combination, blocking, deletion or destruction, as well as the barring of their further use. Photographing, sound or image recording, as well as the recording of physical characteristics suitable for personal identification (such as fingerprints, and palm prints, DNA samples and iris images) shall also be considered as data processing.
The current Hungarian law in force - VI.
9
The current Hungarian law in force -VII.
Act LXIII of 1992 on the Protection of Personal Data and Public Access to Data of Public Interest (DP and FOI Act)
• The legal base of processing in Section 3.(1) Personal data may be processed ifa) the data subject has given his consent, orb) decreed by law or by a local authority based on authorization conferred by law concerning specific data defined therein.
• Purpose limitation in Section 5. (1) Personal data shall be processed only for a specified purpose, in exercise of a right or in compliance with an obligation. In the course of the entire processing this purpose shall be complied with. (2) No personal data shall be processed other than those indispensably required for satisfying the purpose of processing and only in a way compatible with that purpose. Data shall not be used excessively and longer than is required for that purpose."
10
Most important areas of video surveillance
• police - on public events• local governments - whole territory of settlements• employers - field of work, scope of activities • enterprises - in banks, office buildings, shopping malls,
sport events, highways / motorways, public transportation facilities
• owners, (neighbours)- in block of flats, privately owned house• etc.
11
Complaints and investigations: number of cases
Total number of cases on surveillance since 1997: 219
Number of surveillance cases per year registered at the Office of the Commissioner for DP and FOI
0
10
20
30
40
50
60
70
1996 1998 2000 2002 2004 2006 2008
Year
Nu
mb
er
of
cases
12
The recommendation of the Commissioner
• The recommendation was issued in 2000
• Available on the website of the Commissioner (www.abiweb.hu)
• The Commissioner identified a variety of purposes for which the devices were used:
to protect persons and property to prevent crimes, enforce law, and help maintain public law and order to monitor and/or document certain procedures, processes and activities
(passing traffic, trials at court, other sessions) to enhance work or operational safety (e.g. monitoring underground
escalators) to monitor security and morale at the work place
13
The recommendation of the Commissioner
Depending on the given aim, there is a variety of ways and technical solutions to operate such image recording devices:
• One type, used by the police, security services, work place supervisors and others in surveillance tasks, involves the monitoring of video transmissions from one or more cameras, without recording them.
• Other systems store the images on video tape or, in digitised form, on computers for a period ranging anywhere from a few hours to several months. Usually, this method also allows for direct monitoring of images.
• Some systems are only suitable to provide general visual information about the area under surveillance, without the capability of identifying individuals.
• An increasing number of image recording devices can now be controlled remotely, allowing them to rotate and zoom in on details on command. These cameras have the capability to record images of individuals in the area under surveillance that are suitable for identification.
14
The recommendation of the Commissioner
The Commissioner made distinctions between the equipments (surveillance methods): non-recording equipments, merely to monitor locations devices enabling recording and storage of images monitoring and only recording when it is necessary recording of images without viewing them directly, screen and
use only when something relevant happens
15
The recommendation of the Commissioner
• Further provisions of the DP&FOIA to consider when installing and operating image recording devices are:
"Section 4. Unless otherwise provided by law, the right of individuals to protection of personal data and privacy shall not be impaired by other interests involved in data processing, including the disclosure of data of public interest."
In relation to this the Commissioner expressed: „There is no doubt that the interests of security and business can be very powerful, however they cannot be allowed to take precedence over basic human rights guaranteed by the Constitution. Consequently, citing such interests – and lacking authorisation by law – cannot warrant the recording of images in violation of the subjects' right to the protection of their personal data.”
16
The recommendation of the Commissioner
In light of the provisions of the DP&FOIA, when installing and operating image recording devices we must make distinction between:
• public areas (that is any property owned by the state or a local government that can be used by anyone according to its purpose), and
• private property open to the public (that is parts of private property identified by the owner or operator as accessible to the public, or private property accessible to everyone on equal terms and conditions)
• private property
17
The recommendation of the Commissioner
In the absence of separate legal authorisation providing for data
processing in the specific form of recording images, the operation of
image recording must meet the following criteria in order to comply
with data protection regulations:
1. data subjects - including visitors, customers, patrons, employees, and other persons appearing in the observed area – must be informed of the operation of the image recording devices;
2. data subjects must be given the opportunity to make a verbal or written statement consenting to the recording, or otherwise provide their implied consent (for instance, by appearing in the observed area or property);
3. data subjects must be allowed to exercise their rights in connection with the processing of their data;
4. equal (informational) position of the data subjects and the data processors must be ensured, allowing equal access to, and use of, the recording in case of a legal dispute or litigation.
18
The recommendation of the Commissioner
In summary, the Commissioner calls on the persons and entities operating image recording devices to consider the following:
1. Lacking authorisation by law, it constitutes a violation of individual rights to operate such equipment in a concealed fashion.
2. Unless provided otherwise by law, and in the absence of the subjects' consent, in public institutions and private property open to the public, the operation during official business hours of image recording devices is restricted to the type used for observation only and unsuitable for the identification individuals, and further subject to informing the subjects of the fact and manner of such observation.
3. In private areas open to the public, and in private property, the recording of images suitable for the identification of individuals is subject to the unambiguous consent of the subjects, who have been informed of the purpose and manner of the recording, the location where the tapes will be stored and the duration of their storage, and also of the entity in charge of those data.
19
The recommendation of the Commissioner
4. Except as authorised by law, whenever images are recorded in public areas or on private property open to the public of the kind that people cannot help but visit or appear in even if they are unwilling to consent to the processing of their data – in these cases, then, steps must be taken to ensure a way for the subjects to have their images deleted with special dispatch.
5. On private property, it is legal to record images for purposes of security and the protection of the property, provided that no one except for the operator or his or her employees are present at the time the recording is made.
6. The duration of storing the images (that is, the deadline for their deletion) must be chosen in such a way that the images will not be kept longer than is strictly necessary for them to accomplish their purpose as determined by the operator; however, a longer period may be determined when expressly requested by the subjects in the interest of enforcing their rights.
20
The recommendation of the Commissioner
7. In respect of the subjects' rights, they must be given the opportunity to request the deletion of recordings bearing on his or her person, regardless of any previous consent.
8. The use of the images, including their transfer to a third party or their disclosure to the public, is subject to authorisation by law or the consent of the subjects.
9. The operation of such image recording devices, as an act of processing data, must be reported to the data protection register.
21
Recent records of events
Surveillance in cemeteries• purpose of surveillance: prevention of graves
• Commissioner for Human Rights : „acceptable
on the grounds of the right to private property”
• Commissioner for DP and FOI: • continuous surveillance is not proportional• (characteristic of cemeteries)
22
Recent records of events
Surveillance of the riots in Budapest (2006 Sept.-Oct.)• Several people charged the Police with violating
human rights– illegal arrests– mistreatment by Police
• People asked for records – rejected– cameras did not work– records were deleted
• Inspection launched by the Commissioner
