Legal aspects of video surveillance: how to avoid problems with the law

Against the background of the tightening of Russian legislation on personal data, scandals with illegal installation of cameras, bans on video filming and photographing, there are doubts: and if, without knowing it, you accidentally violate someone's rights?

Do you need to worry when buying a camera, installing a video surveillance kit for your store or reserving a cloud archive in a data center located outside the country?
')
In our industry there are two main ways to violate someone's rights: first, in principle, install video surveillance, and then do something with the received video data.

Let us analyze both ways and answer the questions: where is it appropriate to put cameras, and what to do with the video received.

Features of video surveillance in public places

( c )

Let's start with the first question: where you can install video surveillance without any problems?

First, in a public place where the business conducts its activities, and secondly, in the working space of the organization (in the office, in manufacturing, etc.).

Russian legislation does not directly prohibit the installation and operation of video surveillance systems in public places. It also does not provide requirements for the systems used. What it regulates is the use of the footage.

In Part 1 of Art. 152.2 of the Civil Code of the Russian Federation states that consent to receive and use the image of a citizen is not required when the surveillance is conducted in the state or public interests, in public places and at public events ("except when such an image is the main object of use"); if the man posed for the camera on a commercial basis.

In our experience, full compliance of the work of the system with the letter of the law is required to be proved in one case. For example, there is an incident recorded on the recording from the autoregistrar or a surveillance camera, the same theft, and you, having given the case an official move, want to include the video in the evidence base.

According to court practice accepted in Russia, such records are sent for examination in order to reliably determine whether they have been modified: for example, whether separate fragments or frames were cut, or, on the contrary, scenes or image elements were not added during post-processing.

In such situations, the most important criterion for evaluating video is how much time has passed from the moment of the incident to the transfer of the record to law enforcement officers.
For example, if you only realized a week after the incident, experts are more likely to think that the video could be changed during this time. And this will serve as a strong reason not to use the record as evidence.

In some cases, the law directly prescribes the installation of video surveillance:

• Transport infrastructure: airports, sea and river ports, vehicles, transport infrastructure in the field of road facilities
• Objects of the fuel and energy complex
• Sports facilities
• Places of mass stay of people
• Objects (territories) subject to mandatory protection by troops of the National Guard of the Russian Federation
• Objects (territories) of the Ministry of Construction and Housing and Communal Services of the Russian Federation and organizations under its jurisdiction
• Objects (territories) in the field of culture
• Trade objects (territories)
• Hotels and other means of accommodation
• Educational organizations
• Objects of socio-cultural and household purposes, non-residential premises in apartment buildings, in which, according to the design assignment, more than 50 people are to be lumped in any of the premises and during operation of which no special access control regime is provided
• Residential apartment buildings (new buildings)

In principle, in all places of mass gathering of people, which is primarily connected with “ensuring the anti-terrorist security of buildings and structures” (by the way, this is the name of the set of rules with requirements for designing such objects).

Normative acts often regulate both the observation area, and the requirements for video analytics, and the technical characteristics of the image. In addition, such objects can be connected to state security systems, for example, under the “Safe Region” program.

Individuals and organizations are explicitly prohibited videotaping (and video surveillance) in a comparatively small circle of places. These include objects of state secrets , as well as those that are subject to the 57-FZ " On State Protection ".

So we advise you to carefully examine what is around the point of your deployment. Even in the center of Moscow there are secret military units, and this is not an urban legend. In addition, shooting on the territory of some objects of strategic importance, for example, nuclear power plants, is not allowed.


( c )

The lion’s share of commercial enterprises located in public places, including shops and catering establishments, in order to conduct video surveillance in the area where they work, it is enough to hang a noticeable sign with the notice “Attention! A video is being filmed. ” For example, the administration of a shopping center needs to place such a warning at the entrance to the complex.

And if the presence of citizens of any foreign country is supposed to be in such a public place, the inscriptions must be duplicated in their native language. For example, Moscow is one of the most attractive tourist cities in the world, so if you operate in public places here, it’s better to duplicate the video surveillance inscription in English.

At the same time, one should remember about the inviolability of privacy, which is protected by art. 137 of the Criminal Code ("Violation of privacy"). The requirements dictated to it may come into force when a part of the space covered by video surveillance means is definitely not in the category of public places.

If the camera is placed on the landing inside the residential building so that it captures a significant part of the space inside the apartment when its door is open, then the decision is subject to the law. Judicial practice in relation to such situations is ambiguous, but there were precedents when, under similar circumstances, the plaintiffs sought to dismantle the cells.

Video surveillance in the workspace

( c )

Video surveillance inside the office or at the production facility is permissible. Moreover, according to Art. 209 of the Labor Code of the Russian Federation , the workplace must be under the control of the employer.

Video surveillance as a means of compliance with such control is possible, but only under the condition that it does not contradict the basic rights of citizens (in particular, on privacy) and personal data legislation (PD) prescribed by the Constitution.

There are exceptions to the general principle. Indoor video surveillance systems belonging to the organization cannot be used to collect information about a specific person outside the operational-investigative activities. As a result, the camera is not allowed to be mounted in a room where only one person is constantly working.

Certainly, you cannot install video surveillance in toilets, locker rooms, fitting rooms, etc. Another would be a direct violation of Art. 3 of the Constitution of the Russian Federation (“On the inviolability of private life”).

Finally, according to Art. 138.1 of the Criminal Code of the Russian Federation ("Illegal circulation of special technical equipment intended for secretly obtaining information"), covert survey is prohibited. As in the premises belonging to the organization, and in public places.

There is no exhaustive list of banned equipment, but its signs are known (for example, cameras, “camouflaged as household items”, “having a pin-hole”), etc., you will find details in the Government Decree . Compliance with the device even one of these signs means that its purchase and operation violates the law.

Covert surveillance video can only be used by law enforcement officers, including the police as part of operational investigative activities, the FSB, etc.

In order to protect themselves in the organization of video surveillance at the workplace, the employer must notify all employees of its presence - “against signature”. It is necessary to indicate why such supervision is carried out, such as: for security purposes, for the purposes of labor discipline, for the purposes of production discipline. It is advisable to include the corresponding clauses in the internal labor regulations and in the employment contract.

In the above documents, just in case, it is worthwhile to specify the possibility of audio recording (of course, not hidden).

By the way, in some industries, the fixation of visual or audio information when interacting with consumers is gradually becoming a necessity dictated by regulators. In particular, the Central Bank recommended that Russian financial organizations openly record negotiations with customers on video or audio media.

Since the office is a private territory, the business owner has the right to allow or not to allow outsiders, for example, clients. But in order to be guaranteed to protect yourself from claims, you need to knead a sign at the entrance with a warning about video surveillance.

Approaching personal data processing inside the office or at work is required no less meticulously than in the case of video surveillance of public places. Video filming in the workplace is allowed exclusively for business purposes.

In addition to 152-FZ (“On Personal Data”), it is necessary to bear in mind Art. 88 of the Labor Code of the Russian Federation (“Transmission of personal data of an employee), according to which access to personal data of employees is allowed“ only to specially authorized persons, and these persons should have the right to receive only those personal data of an employee that are necessary to perform specific functions ”.

For all of the above, we conclude: in work offices, we need to draw up an internal regulation of the organization on the mode of access to video surveillance systems and archives.

Face recognition and responsibility for the processing of personal data

( c )

The scope of responsibility of a business that somehow collects and processes personal data of citizens has significantly increased in 152-FZ, and the penalties for violating the relevant rules have been increased and now reach 300 thousand rubles.

By law, video is not a carrier of personal data, as it is not capable of unambiguously identifying an individual. In essence, on the video there is only an image of a certain person, nothing more. Therefore, you can store such data without restrictions.

However, if a face recognition system is used in which an identifier is assigned to an image, the named law takes effect. Manufacturers and users of such platforms must obtain a license for the processing of personal data. True, if identifiers are impersonal (say, P1 - “man-1”, P2 - “man-2”), this is not required.

Legislative requirements in the case of face recognition are vague. In particular, the “ hash of a person ” of a certain subject N. does not apply to personal data: no legal norms limit its fixation. But, let's say, when such a hash, along with the name and surname, is entered into the database, a controversial situation arises. In this case, consultation with lawyers is required.

Data storage and archive depth

( c )

The “archive depth” or the shelf life of records obtained through video surveillance systems is legally regulated for some objects subject to measures related to ensuring the anti-terrorism security of buildings and structures.

For example, in accordance with the Decree of the Government of the Russian Federation dated April 14, 2017 No. 447, hotels are obliged to use surveillance cameras and keep records for 30 days. In addition, the video surveillance system, taking into account the number of cameras installed and their locations, should ensure continuous video surveillance of the situation on the territory of the hotel. Technical means of notification should ensure the preservation of performance when the centralized power supply is turned off for at least 6 hours in the standby mode and at least 1 hour in the mode of transmitting signals and alert information.

Also, some organizations follow certain standards that regulate the need and depth of the archive. All banks in Russia follow the PCI DSS (Payment Card Industry Data Security Standard) standard, according to which data obtained from surveillance cameras and / or access control mechanisms are stored for at least three months.

Summary: what to do

Basic installation of video surveillance systems in public places and their use are not prohibited. But further use of records (for promotional purposes, as evidence in court, etc.) may require additional actions and precautions from the business.

If a company is engaged in the processing and storage of personal data, the compliance of the infrastructure on which data is stored to the requirements of 152-FZ is strictly mandatory.

To certify its own infrastructure is a costly and protracted process. It is easier and cheaper to rent resources in the “cloud”, which is already certified for storing personal data.

Deploying video surveillance system in a public place:

• make sure that secret objects or private space of citizens do not fall into the frame;
• place a video surveillance warning plate in a prominent position when entering a building or workspace;
• translate the warning into the languages ​​of those countries whose citizens are objectively likely to visit this place with a high degree of probability.

At the workplace, the employer is also entitled to use video surveillance systems. With the proviso that they cannot be used to gather information for a specific person and violate the right to privacy.

Deploying video surveillance system in your work space:

• place a video surveillance warning plate in a prominent place when entering the workspace;
• familiarize the employees with a “signature” with the fact that video surveillance is conducted on the territory of the office or production facility;
• Be sure to justify the need for video surveillance and include items on video surveillance in the internal labor regulations and labor agreements;
• draw up an internal regulation on the mode of access to video surveillance systems and archives (access should be available only to specially authorized persons);
• Do not install cameras in the toilets and changing rooms (this is contrary to the Constitution), as well as in premises where only one person works constantly (this will be regarded as collecting information for a specific person).

By default, the video is not a carrier of personal data, but if you are not just videotaping, but using a face recognition system, you will have to comply with the requirements of Law 152-. From licensing to infrastructure requirements for data storage.

To remove some of the burden, it makes sense to contact the VSaaS provider: in this case, he will be responsible for certifying the equipment, ensure data security and, among other things, provide a convenient working interface for accessing video recordings.

If you want to get advice or connect video surveillance for business, send us a request.