In recent years, the use of video monitoring has become increasingly prevalent in Georgia. It encompasses public and private settings, including workplaces. This rise in video monitoring has brought about significant legal considerations, particularly concerning the protection of personal data.
The Georgian Law on Personal Data Protection (the Personal Data Protection Law) provides a comprehensive framework for the regulation of video monitoring. It ensures that the rights and freedoms of individuals are safeguarded.
Scope and Purpose of Video Monitoring
The scope of video monitoring is broad. It can include any space where individuals can be identified by their appearance or other distinguishing features. This includes both public and private areas. The technology used can capture and store personal data of all individuals within the camera’s field of view. The Personal Data Protection Law outlines specific conditions for conducting video monitoring.
Specifically, video monitoring is permissible if it aims to achieve the following objectives:
- Prevention or detection of crime
- Public safety
- Protection of personal safety and property
- Protection of minors
- Protection of confidential information
- Examination/testing purposes
The Personal Data Protection Law also allows for other public or legitimate interests that may necessitate video monitoring. However, it is crucial that the need for security, property protection, or information protection arises from a genuinely anticipated threat. Video monitoring must be an adequate and proportionate means to achieve the intended purpose.
Consent and Notification Requirements
One of the fundamental principles for video monitoring is the requirement for consent and notification. Data controllers must inform data subjects about how they process their personal data through video monitoring.
They must provide information on the purpose of data processing, the legal basis for processing, the identity and contact details of the data controller, any third parties sharing the personal data, and the data subject’s rights under the data protection law, including rights to access, rectify, and delete their personal data.
The data controller must ensure that the data subject is informed about the video monitoring process. This includes:
- Obtaining written consent from the data subject and
- Placing a visible warning sign indicating the presence of video monitoring.
Written Consent
The data controller must obtain written consent in advance and make the data subject aware of the specific purpose for processing their data. The consent must be voluntary, informed, and expressed through an active action, such as signing a document or providing electronic consent. The data controller ensures that the consent meets these criteria and adequately informs the data subject about the monitoring process.
The Warning Sign Requirements
The data controller must place a visible warning sign in all areas where video monitoring is conducted. The warning sign must be easily noticeable and understandable to anyone entering the monitored area.
The warning sign must include:
- A clear and easily understandable message and image indicating that video monitoring is taking place
- The name or title of the person responsible for the data processing
- The contact information of the person responsible for the data processing; and
- If the video monitoring operates 24 hours a day, the warning sign must indicate this
When conducting video monitoring of a large area with more than one camera, or if the technical device’s field of view is wide, it is necessary to place several warning signs in each zone under video monitoring. The main requirement is that the data subject must be aware of the boundaries of the area that falls under video monitoring.
Data Processing and Storage Rules
When implementing video monitoring, data controllers must define in writing the purpose, scope, duration, and retention period of the monitoring. They must establish rules and conditions for accessing, storing, and destroying video recordings, and ensure mechanisms are in place to protect the rights of data subjects.
Data controllers must retain personal data only for as long as necessary to fulfil the purposes for which they collected it, and once they no longer need the data, they must securely delete or anonymize it.
Record each instance of access to the video recordings, including the time and the user’s name. Grant access only to a defined group of individuals based on their functions and needs. The responsible or authorized person must periodically check the system’s functionality, monitor access instances, and respond to any unauthorized access or other violations. It is also essential to define the scope of access, including implementing protection for authorizing access to video recordings and restricting physical access to the area where video recordings are stored.
The principle of data minimization requires collecting and processing only the data necessary for the specific purpose. Data controllers must maintain transparency and accountability in their data storage practices, including keeping records of data processing activities and appointing a Data Protection Officer if required. Data controllers must inform data subjects about the storage and processing of their personal data, allow them to access their data, accept requests for corrections, and delete the data when it is no longer necessary.
Penalties for Non-Compliance
Violations related to video monitoring can result in various fines depending on the nature and severity of non-compliance. Penalties can lead to fines of GEL 1,000 for physical persons, public institutions, non-commercial legal entities, and legal entities with an annual turnover not exceeding GEL 500,000. For legal entities exceeding this threshold, the fine may amount to GEL 2,000. Repeated offences or severe breaches can result in higher fines, up to GEL 3,000 for smaller entities and GEL 5,000 for larger ones.
Special Considerations
It is essential to clearly distinguish between video monitoring and audio monitoring, as they constitute two legally and technically distinct forms of surveillance. Despite their inherent differences, these two modalities are frequently conflated. This is primarily due to the integration of audio recording functionalities in many modern video surveillance systems, which further obscures the boundary between them. Audio monitoring has its specific prerequisites and regulations, which are separate from those governing video monitoring.
In conclusion, the legal framework governing video monitoring in Georgia is structured to strike an appropriate balance. It strikes a balance between the legitimate interests of surveillance and the fundamental right to privacy. The Personal Data Protection Law outlines the principles and obligations that must be adhered to. These ensure that video monitoring is conducted in a lawful, proportionate, and transparent manner.
To achieve compliance, both private entities and public institutions must implement adequate data protection safeguards, including:
- conducting legitimate interest assessments where applicable
- Obtaining informed consent when required
- Minimizing data collection
- Securing recorded footage against unauthorized access
- Informing individuals about the presence and purpose of video monitoring.
For expert guidance on video monitoring compliance and data protection in Georgia, contact Andersen today. Our legal specialists provide tailored solutions to ensure your business meets all regulatory requirements while protecting individual privacy. Contact us to safeguard your operations with confidence.