Video Surveillance: What Rules Must Employers Follow?

Today, video surveillance in the workplace is an essential tool for ensuring the safety of assets and individuals. However, its installation and use are governed by strict regulations to protect employee privacy. Here, we outline the primary rules to follow, especially in line with CNIL regulations, as well as best practices for compliant and effective use. We will also discuss the issues of data retention and access to surveillance footage.

Installing video surveillance cameras in the workplace entails several obligations for the employer. It is essential to comply with these regulations to avoid penalties and ensure the protection of employee rights.

In this regard, the National Commission on Informatics and Liberty (CNIL), the body responsible for safeguarding privacy in France, imposes specific rules on video surveillance. This agency also enables employees to file a complaint in cases of excessive or abusive surveillance.

First and foremost, note that if the premises are not open to the public, no declaration to the CNIL is required. However, this does not exempt the employer from adhering to rules that protect the rights of employees and others present in the building.

Here are the main rules:

• Informing Employees and Visitors: Everyone must be clearly and precisely informed of the existence of the video surveillance system, its purpose, the duration for which footage is retained, and who is responsible for managing it. To ensure this, prominent signage must be displayed.

• Limited Use: It is prohibited to directly film workstations to monitor an employee. However, video surveillance can be used in buildings and corridors, for example. Additionally, cameras must not capture areas such as break rooms, restrooms, or spaces reserved for employee representatives. Their use must be proportional to the objectives pursued (such as the safety of assets and individuals, prevention of theft, etc.).

• Access to Footage: Only authorized personnel may view the footage, and it should not be retained beyond the time necessary to achieve the purpose of the data processing. However, it is the employer’s responsibility to determine the duration of retention.

The use of video surveillance footage for disciplinary purposes is governed by strict rules. An employer can use this footage against an employee only if the employee has been informed about the existence of the surveillance system and the purposes for which it is used. Furthermore, the footage must have been obtained legally, and viewing it must respect the employee’s rights to a defense.

Several companies have already faced sanctions due to the abusive use of video surveillance. For instance, a major e-commerce giant was fined €32 million in 2023 for failing to adequately inform its employees about the surveillance system and for not sufficiently securing the footage.

Only individuals authorized by the employer, typically security personnel, are allowed to view the footage recorded by video surveillance cameras. The employer also has the right to view the footage, as do law enforcement authorities within the context of an investigation following an incident.

Additionally, individuals authorized to access the footage must undergo specific training on video surveillance and privacy rights. This training will equip them to understand legal obligations, best practices for managing recordings, and the importance of protecting individuals’ rights.

Video surveillance can be combined with access control systems to enhance the security of premises. This type of setup allows for filtering entries and exits and restricting access to certain sensitive areas of the company.

Integrating video surveillance with access control systems offers several advantages:

• Enhanced Security: By combining the two systems, the company can better monitor entries and exits and respond quickly in the event of an intrusion or suspicious behavior.

• Access Traceability: Video recordings combined with access control data allow for the reconstruction of events and identification of individuals present at the location in the event of an incident.

• Prevention of Theft and Intrusions: On one hand, access control devices restrict entry to authorized individuals only. On the other hand, cameras help deter intruders and detect illicit behavior.

The retention and access to video surveillance footage are also regulated.

Video surveillance footage in the workplace should not be retained longer than necessary to achieve the purpose for which it was collected. Typically, this duration is one month. After this period, recordings must be deleted, except in the case of an ongoing investigation, where retention may be extended.

As mentioned earlier, access to video surveillance footage must be limited to authorized personnel only. At the same time, it is essential to implement security measures to protect the recordings from unauthorized access, alteration, or disclosure.

This includes the use of passwords, two-factor authentication, encryption systems, and access logs to track entries. Furthermore, it is advisable to appoint an information security officer responsible for overseeing data management and ensuring that all protection procedures are followed.

To ensure the effectiveness of the security measures implemented, it is also recommended to conduct regular audits and internal controls. These checks help ensure that security protocols are being followed and detect any vulnerabilities that could jeopardize the video surveillance recordings.

Finally, in addition to adhering to the initial obligations, monitoring regulations is essential to avoid penalties and ensure the ethical use of video surveillance. Companies must stay informed about legislative developments and adapt their practices accordingly. This includes updating privacy policies, informing employees, and respecting the rights of monitored individuals.

Moreover, adopting these practices enables companies to enhance their security while fostering a climate of trust.

The installation of a video surveillance system must be accompanied by compliance with applicable regulations to make it an effective tool for protecting assets and individuals within the company. At the same time, surveillance should be used responsibly and ethically, ensuring that it does not encroach on employees’ privacy or monitor their work inappropriately. By adopting transparent practices and implementing rigorous security measures, you ensure that video surveillance primarily serves to prevent theft, intrusions, and ensure the safety of all, rather than intrusively monitoring employees. This approach will also help you gain the support of your teams.