Video surveillance and the CNDP: what law 09-08 requires

A camera filming identifiable people processes personal data. On that basis video surveillance falls within the scope of law 09-08 and within the CNDP's remit — whether the images are stored or only watched live, as soon as the set-up makes it possible to identify someone.

This guide covers what is established and checkable. Where a point depends on your particular installation, it is flagged as such rather than filled in with an approximate figure.

It is a processing activity, so it gets declared

The starting point is not the camera, it is the purpose. Securing property, protecting people, controlling access: each purpose is a separate processing activity, and it is the purpose that determines what you may film, how long you may keep it, and who may watch.

The ordinary regime is declaration — form F211, or F214 if the activity genuinely fits a simplified framework described by the CNDP. The CNDP issues the receipt within 24 hours, and has 8 days to notify you that it is moving the activity to prior authorisation if it judges that it presents manifest risks to privacy. That move is the Commission's power to exercise — it is not for you to pick the heavier regime as a precaution.

And the point that changes everything: if the file is incomplete, none of these periods run until the CNDP has received the documents it asked for. The detail on forms is in the guide on which CNDP form applies.

Filming at work: the proportionality question

This is the most closely examined case, because it is where the imbalance is greatest. Three principles apply together:

• Proportionality. The set-up must fit the purpose. Securing a stockroom or a till is an admissible purpose; filming a workstation continuously to monitor an employee's output is not.
• Excluded areas. Places where people have a legitimate expectation of privacy — changing rooms, toilets, break rooms — are not to be filmed, whatever purpose is invoked.
• Prior information. Employees must be told that the system exists, what it is for, how long images are kept, and how to exercise their rights. A camera discovered by accident is a legal problem before it is a social one.

Processing of employee data more broadly is covered in our guide on the CNDP and employee data.

Filming a place open to the public

The logic is the same, with two practical differences. The information must be given by a notice visible at the entrance to the cameras' field of view, before a person enters it — not inside, and not in small print. And the field must remain yours: pointing a camera at the public highway or at a neighbour's frontage goes beyond the purpose of securing your own site.

Retention: the period you declare

This is the point on which unsourced pages happily quote a number. What is certain: the retention period must be limited to what the purpose requires, it must be declared, and it must be the one the system actually applies — an automatic purge, not an intention.

A short period justified by the purpose is more defensible than a long one justified by convenience. If your purpose is to be able to establish and report an incident, the necessary period is the time it takes to notice one, not the size of the hard drive. For a particular installation, have the retention period confirmed with the CNDP rather than adopting a figure found online.

What an inspection looks at

A receipt is not compliance. It attests that you declared; it does not attest that the installation does what the declaration says. What gets checked:

• Does the actual field of view match the declared areas?
• Is the declared retention period enforced by a purge that really runs?
• Who has access to the images, under which account, and is that access logged?
• Is the information notice genuinely in place, and legible?
• Are image exports — who made one, when, for what — traceable?

The last point is the one most often missing, and it is also the hardest to add afterwards: a recorder that lets someone copy a sequence onto a USB stick without leaving a trace cannot demonstrate anything.

Where to start

1. List the cameras, their real field of view, and the purpose of each.
2. Remove or reposition anything that exceeds the purpose — it is quicker than justifying it.
3. Set a retention period per purpose, and check that the purge runs.
4. Put the information in place: a notice at the entrance to the field of view, and an internal note for employees.
5. Declare, with the right form and a complete file.

See also the guide on the CNDP declaration and, if all of this has to fit into a system you already run, our CNDP compliance offer. To gauge your exposure in eight questions: the CNDP self-check.