Video surveillance

Purpose of processing

Video surveillance serves to protect against criminal acts such as theft and to secure civil law claims in the event of incidents.

Responsible department

Responsibility for video surveillance lies with the security and data protection team or the department responsible for security, as well as the appointed Data Protection Officer (DPO).

Categories of data subjects
Individuals located in the monitored areas, including employees, customers, visitors, and other third parties.

Legal basis for processing under Art. 6 GDPR
The processing of personal data through video surveillance is based on Art. 6 para. 1 lit. f GDPR, with the legitimate interest of the controller being to ensure the safety of individuals and property and to prevent or investigate criminal offenses.

Data categories and special categories with retention and deletion periods

  • Retention Period: Generally 30 days, unless there is a legitimate interest to retain recordings longer (e.g., in the event of an incident).
  • Deletion Period: Data will be deleted after the retention period expires, unless required for incident investigation or legal claims.

Data origin
The data is collected and recorded by video surveillance cameras.

Internal recipients of data

  • Security personnel or employees responsible for monitoring and managing video recordings.
  • Relevant employees in other departments or areas who can contribute to incident resolution, if applicable.

External recipients of data

  • Law enforcement agencies in the event of criminal investigations.
  • Lawyers and courts in the event of civil claims.

Data processing agreements related to this processing activity

  • None

Data transfer to countries outside the EU
No data transfer takes place, nor is it planned.

Balancing of interests for data subjects' interests
The interests of data subjects are taken into account by ensuring that video surveillance is appropriate, no excessive data is collected, and recordings are treated confidentially. Data subjects are informed about video surveillance when they are in monitored areas.

Balancing of interests for the controller's Interests
The controller's legitimate interest is to ensure the safety of individuals and property, prevent or investigate criminal offenses, and assert civil claims.

Information on processing
Data subjects are informed about video surveillance by clearly visible signs when they are in monitored areas. Information about processing and data protection practices is available on the website or in privacy policies.

Security measures
Appropriate technical and organizational measures are taken to ensure the security of recorded video footage, including restricted access to recordings and encryption. Data subjects are informed about video surveillance by clearly visible signs when they are in monitored areas. Information about processing and data protection practices is available on the website or in privacy policies.

Risks
The risks associated with video surveillance include data breaches, unauthorized access to recordings, and processing of data beyond its original purposes.

Measures for video surveillance risk minimization

  • Regular review and updating of surveillance policies and procedures.
  • Training employees in data protection and security when handling video recordings.
  • Limiting access to video recordings to authorized personnel.