Where the use of Closed Surveillance is allowed

The Commissioner for Personal Data Protection Irini Loizidou Nikolaidou, in relation to a multitude of questions received daily about the legality of the use of CCTV (KKBP) but also the role of Management Committees and Companies in The provisions of the Law on the protection of personal data do not apply, in the case of installation of KKBP in private spaces (such as houses / apartment buildings), because, as he notes, the processing is carried out by a natural person and concerns personal or domestic activities.

However, the scope of recording of KKBP, he adds, should not be outside the perimeter of the private space.

"In apartment buildings, the use of KKBP by one tenant should not affect the privacy of others. In case a CCP that has been installed by a tenant affects the privacy of others, the complaints are handled by the Cyprus Police, as my Office does not have the authority to enter private homes to be able to examine the images recorded by the ΚΚΒΠ. In the event that the KKBP will be installed by the management committee, the scope of its registration should be limited to common areas after a decision of the tenants that complies with the provisions of the Articles of Association ", he states.

Notes that based on the Law on Real Estate (Occupation, Registration and Valuation) (KEF.224), as amended, in Part IIA "Shared Buildings", Article 38KST (2) (c) states that, "the Management Committee may to conclude contracts in relation to any issue concerning the maintenance and management of the common building ".

Therefore, he continues, the Management Committee is responsible for the processing and the Management Companies are the performers of the processing, as defined by the FGM.

He points out that the initial collection and storage of personal data of the tenants and / or owners, for the purposes of managing the building, is done exclusively by the Management Committee. The Management Companies, as the performers of the processing, process the necessary data within the framework of their duties.

It states that the video and audio data are personal data. "The recording of image and sound is a processing of personal data, which in order to be legal must be in accordance with the provisions of the General Regulation for Data Protection (GKPD) 2016/679 but also of the National Legislation L. 125 (I) / 2018. "The capture of video and audio using KKPV is allowed only if there is no less intrusive way to achieve the purpose", he adds.

Examples where capturing an image using CCPB is entering / exiting a building, outside an elevator, isolating the image exclusively on it, over a card payment device and / or cash register, isolating the image exclusively on it and parking lot of apartment buildings following a decision of the Management Committee

Examples where it is not allowed to take a picture using KKPB are in waiting areas, inside the elevator and in the indoor / outdoor dining area of ​​a cafeteria, restaurant, etc.

The Commissioner emphasizes that under no circumstances should personal behavior, personal contacts and the efficiency of individuals be monitored through such systems.

"Marking with the use of warning signs is mandatory. Warning signs should be in conspicuous places, sufficient in number and visible to the persons being recorded. These plates must indicate (a) that videotaping is taking place, (b) the purpose of the videotaping and (c) the details of the controller ", it is added.

With regard to the rights of data subjects, according to the GCP, it is stated, persons who are recorded by the KKBP can exercise the right of access.

The data, it is noted, are kept for a reasonable period of time, always in relation to the purpose they serve.

The Commissioner states that in cases where the installation of the CCP may pose a high risk to the rights and freedoms of individuals, an Impact Assessment is required prior to processing, in order to assess the impact of the planned acts.