Disclosure of personal data
One of the goals of the sandbox was to assess whether use of Doorkeeper’s technology would have any impact on the assessment of whether an enterprise has a legal basis for the disclosure of video recordings.
Enterprises with video monitoring systems may be asked to disclose recordings, for example, by the police or insurance companies.
The personal data involved in such situations will primarily be related to recordings that have been stored as a result of activation following a registered event.
In purely practical terms, the data minimisation measures in the solution may make such disclosure easier, due to the fact that there is less personal data involved. Even so, for the personal data processed by the data controller, the rules for disclosure will be the same as in any other situation. The legal considerations for disclosure of personal data in connection with use of Doorkeeper’s technology will therefore be the same as for the use of any other camera technology.
Disclosure of personal data is a type of processing of personal data. In order to disclose personal data, one therefore requires a legal basis pursuant to Article 6 of the GDPR. The most relevant option is often to obtain the consent of the person(s) on the recording, but there may also be other legal bases for the disclosure.
Personal data may be reused for new purposes if the new purpose is compatible with the original purpose for which the personal data was collected. There must also be a legal basis for the new processing, see Article 6 (4) of the GDPR.
· Disclosure of personal data to other enterprises
In the sandbox, we discussed whether it would be possible for the data controller to disclose recordings to an insurance company. The Data Protection Authority finds that this issue follows the general provisions in place for all disclosure of personal data. That means an enterprise must have a legal basis for disclosing personal data.
· Disclosure of personal data to the police
If the data controller receives a request from the police for disclosure of recordings of data subjects, they must consider whether they have a legal basis for disclosing this personal data. If the police have an order for compulsory disclosure, the data controller will normally be obligated to disclose the data. In other cases, the data controller should have received sufficient information from the police for being able to consider whether there may be other legal bases for disclosure.
· The data subject’s right of access
The data subject – who has been captured by the camera – has a right of access to their own personal data. This follows from Article 15 of the GDPR. When disclosing recordings to the data subject, the data controller must consider whether granting access has a negative effect on the rights and freedoms of others. In such situations, the censoring of third parties may be a measure that could mitigate such negative effects if other persons are visible in the video feed.