Video Surveillance in Public Spaces: GDPR Limits for Private Cameras

Installing video surveillance cameras aimed at public spaces may lead to sanctions if the recording is not justified. As a general rule, private cameras should be limited to the property, premises or facility they are intended to protect.

What the Spanish Data Protection Authority says

The AEPD provides specific criteria in its video surveillance section and in its guide on the use of video cameras. Recording public spaces by private individuals or companies should be minimal and only incidental where necessary to protect private areas.

Common mistakes

• Pointing cameras directly at pavements, roads or third-party common areas.
• Not displaying a visible information sign.
• Allowing unauthorised people to access footage.
• Keeping recordings longer than necessary.
• Using audio recording without a very strong justification.

Checklist before installing cameras

• Review the camera angle and limit third-party areas.
• Display a video surveillance sign with basic information.
• Define who may access the footage.
• Set a retention period, usually no more than one month unless there is an incident.
• Document the purpose and legal basis.

Conclusion

Video surveillance must be proportionate. If a private camera captures public space in a non-incidental way, sanction risk increases. Before installing cameras, organisations should adjust angles, information notices and access controls.