Establishment of video surveillance
+ -The legal basis for the establishment and implementation of video surveillance must be provided in accordance with the General Regulation (Article 6). ZVOP-2 regulates specific issues related to the establishment and implementation of video surveillance in more detail. ZVOP-2 regulates video surveillance in Articles 76-80, namely:
- Article 76 - General provisions on video surveillance and protection of personal data;
- Article 77 - video surveillance of access to official or business premises;
- Article 78 - video surveillance within work premises;
- Article 79 - video surveillance in means of transport intended for public passenger transport;
- Article 80 - video surveillance in public areas.
The general provisions and requirements for setting up video surveillance are defined in Article 76 of the ZVOP-2.
General Conditions in relation to the implementation of video surveillance
The decision to introduce video surveillance shall be taken by the head, director or other authorised individual of the public sector entity or of the private sector entity as operator. The written decision shall state the reasons for the imposition of video surveillance.
According to the provisions of Article 76 of the ZVOP-2, a company in the public or private sector conducting video surveillance must publish a notification.
The notice shall be prominently and clearly displayed so that the individual can become aware of its implementation and refrain from entering the controlled area. In addition to the information referred to in Article 13(1) and (2) of the General Regulation, such notice must contain the following information:
1. a written or unambiguous graphic description of the fact that video surveillance is being carried out;
2. the purposes of the processing, the name of the controller of the video surveillance system, a telephone number or an e-mail address or a website address for the purposes of exercising the data subject's rights relating to the protection of personal data;
3. information on the specific impact of the processing, in particular further processing;
4. the contact details of the authorised person (telephone number or e-mail address);
5. unusual further processing, such as transfers to third country entities, live monitoring, possibility of audio intervention in case of live monitoring.
Instead of publishing a notice in physical form, the information to the data subject may also be provided by the controller publishing the information referred to in Article 13(1) and (2) of the General Regulation and the information referred to in points 3 to 5 above of the notice on a website. In this case, the controller must publish the website address where the information is accessible (the URL address of the website, and also, he can publish a QR code).
The video surveillance footage database contains a snapshot of the individual (image), location information, date and time of the footage, and exceptionally, if necessary, audio.
Video surveillance is not permitted in lifts, toilets, changing rooms, hotel rooms and other similar areas where the individual has a reasonable expectation of privacy. Subject to the principles set out in Article 5 of the General Regulation, video surveillance recordings may be kept for a maximum period of one year from the time of recording. A public or private company conducting video surveillance shall prescribe organisational, technical and logical technical measures for the protection of personal data according to Articles 24 and 32 of General Regulation. For example, the person conducting video surveillance must ensure that the video surveillance system is protected against access by unauthorized persons.
The access, use or disclosure of video surveillance footage is only permissible for the purposes that lawfully existed or were stated in the notification at the time the footage was taken.
The controller of a video surveillance system must ensure the so-called traceability of processing - the possibility of subsequently establishing which recordings have been processed, when and how they were used or to whom they were transmitted, who carried out these processing operations, when and for what purpose or on what legal basis. He must keep these data in the processing log referred to in Article 22 of the ZVOP-2 for two years after the end of the year in which they were created.
Video surveillance of accessing the official office or business premises
In accordance with the provisions of Article 77 of the ZVOP-2, the video surveillance of accessing the official office or business premises may be carried out if it is necessary for the safety of people or assets, for the supervision of entering and exiting their work or business premises or if there is the possibility of threat to employees due to the nature of their work. In these cases, video surveillance is allowed if the owners of the service/business premises, who own more than 70% of the common areas, agree to it.
Video surveillance may only be carried out in a manner which ensures that the interior of residential buildings, which have no effect on the access to the business premises, and the entrances to the apartments are not recorded.
It is necessary to inform all employees in the public or private company who work in the supervised area of the implementation of video surveillance and of all the information to be contained in the video surveillance notice.
The collection of personal data related to the control of access to the office or business premises may contain a recording of the individual (image), the location, date and time of the recording, and exceptionally, if necessary, the sound. In addition, it may contain the date and time of entry and exit to and from the premises, and may also include the personal name of the recorded individual, the address of their permanent or temporary residence, employment, the number and details of their type personal ID and the reason for entry if such personal data is collected with the recording of the video surveillance system.
Video surveillance in residential buildings
Video surveillance of multi-apartment buildings containing only private dwellings (former Article of the 76 ZVOP-1) is no longer explicitly regulated, and the provisions of the General Regulation apply to its establishment and implementation.
Video surveillance in work spaces
The implementation of video surveillance within work spaces can only be carried out in exceptional cases where it is necessary for the safety of people or assets or the prevention or detection of gambling offences or for the protection of classified information and business secrets, and such purpose cannot be achieved with more lenient means. Video surveillance may only be carried out on those locations where the aforementioned interests are to be protected.
It is forbidden to conduct video surveillance in work areas outside of the workplace, unless it is necessary to do so in accordance with the conditions for video surveillance within the workplace.
Under the above conditions, live stream is only permissible if it is carried out by explicitly authorised staff of the controller.
Prior to the introduction of a video surveillance in the work spaces, the employees must be informed thereof in writing. The employer must consult the representative trade union of the employer prior to the implementation of a video surveillance service in the work spaces.
Video surveillance of common areas in commercial buildings is allowed if the owners who own more than 70% of the common areas agree to it.
Video surveillance in means of public passenger transport
Video surveillance in means of public passenger transport may only be carried out in the passenger areas for the purpose of the security of passengers and property, if this cannot be achieved by other measures that are less intrusive on the rights governed by ZVOP-2.
The operator must destroy the recordings no later than seven days after they were recorded. The recordings may be used for the establishment or defence of legal claims or for the performance of police duties.
Video surveillance in public areas Video surveillance in public areas, as defined by the law governing spatial planning, is only permitted where it is necessary to the existence of a serious and justified danger to life, personal liberty, body or health of persons, the security of the controller's property or the protection of the controller's or processor's classified data in transmission, and these purposes cannot be achieved by other means that are less intrusive on the rights whose exercise is governed by ZVOP-2.
Video surveillance in public areas shall also be permitted for the purposes of protecting protected persons and special facilities and their surroundings protected by the police, the Slovenian Armed Forces, the competent authorities in the field of national security, the judicial police, or other premises, buildings or areas which are required to be protected by law, and only to the extent and for the duration necessary to achieve the purpose. Access, use or disclosure of the recordings shall be permissible only for these purposes.
Video surveillance may be carried out only in respect of those adjacent or connected parts of the public area and to the extent necessary to protect the interests referred to above.
Video surveillance in public areas can be carried out by a public or private sector person who manages or legally operates a public area.
Video surveillance in public areas may also be carried out using a body camera for the purpose of protecting persons, classified information in transit, business secrets or high-value property, provided that it is used by a person specially trained for this purpose.
Recordings of video surveillance in public areas may be kept for a maximum period of six months from the time the recording was made.
In the field of video surveillance of road traffic, the operator may only carry out video surveillance on pre-defined sections of the roads under its management, so that there is no systematic surveillance of the movements of individuals or interference with the privacy of individuals. The operator must designate those sections of the road under its management where the necessary and effective protection or management of road traffic cannot be achieved by other means. Before the final determination of the locations referred to in the preceding paragraph, the operator has to draw up an impact assessment containing the location of the road sections and submit it to the Information Commissioner for a preliminary opinion.
The use of automatic number plate recognition systems (ANPR systems) and systems which process biometric personal data is prohibited in public areas; however, in view of the provision of Article 76(1) of the ZVOP-2, this may be laid down by another law.