Processing of camera images

Responsible for processing

The local authority and the police both play a role in camera surveillance of public places to maintain public order:

• Local authorities can use camera surveillance to monitor public places if this is necessary to maintain public order. The rules are set out in Article 151c of the Municipalities Act. The mayor, together with the local council, decides in which cases, where and for how long camera surveillance will be used.
• The police are responsible for processing the camera images.

The chief of police is the data controller

The mayor is politically and administratively responsible for camera surveillance. But the mayor is not the data controller when it comes to the processing of camera images. That is the chief of police.

The processing of camera images is governed by the Police Data Act (Wet politiegegevens, Wpg). This means that the camera images are police data. And that the chief of police is the data controller, because the Police Data Act designates the chief of police as the data controller for the processing of police data by the police.

Given that this has been stipulated by the legislator, it does not matter who stipulates the purposes and means of the processing in practice. Even if the mayor stipulates this, the chief of police is the data controller.

Conditions for processing camera images

Important conditions for processing camera images are:

• the processing is necessary;
• a data protection impact assessment (DPIA) is performed in advance;
• there is a duty to provide information;
• specific retention periods apply;
• good security is important;
• a processing agreement has been concluded.

Necessity

The processing of camera images must be necessary for the purpose for which camera surveillance is used. And this purpose should not also be achievable with less drastic measures.

DPIA

One of the situations in which a DPIA is mandatory, is when personal data is processed to track people in a publicly accessible area on a large scale and systematically. This is the case with camera surveillance in public places.

Duty to provide information

Under the Police Data Act, the police must inform data subjects about the processing of camera images. For example, the police must provide information about the purpose of the processing and about the privacy rights of data subjects. Such as the right of access.

By virtue of the Municipalities Act, the presence of cameras must be clear to everyone who enters the area in question. For example, the local authority can put up a sign that lets people know that camera surveillance is in use. The police and the local authority can make agreements on how to fulfil this duty to provide information.

Retention periods

The police may not retain camera images for longer than is necessary for the purpose for which they were made.

Permanent camera surveillance

If it concerns camera images made using permanent camera surveillance (under Article 151c of the Municipalities Act), the police may retain the images for a maximum of four weeks. If there are concrete suspicions that the camera has captured a criminal offence, the police may retain the images for longer to investigate those criminal offences.

Temporary camera surveillance

If it concerns camera images made by the police with temporary camera surveillance (under Article 3 of the Police Act), the police may not retain the images for longer than is necessary for the purpose for which they were made. The rules are set out in the Police Data Act.

Security of and access to camera images

The police must take appropriate security measures to prevent unlawful or unauthorised processing of the camera images. Only persons authorised by the chief of police (as the data controller) have access to the images.

Processing agreement

If the police engage other organisations to process camera images, the police must conclude a processing agreement with those organisations. Consider an external party that views the camera images. In that case, the external party acts exclusively under the instructions of the police.

Note: In addition to the above conditions, all other requirements and obligations under the Police Data Act also apply to the processing of the camera images.

Responsibilities of the police and the local authority

The police are responsible for processing the camera images, and consequently, for compliance with the Police Data Act. The chief of police (as the data controller) must also be able to demonstrate this. It is obvious that the police and the local authority work closely together in the implementation of camera surveillance.

The use of camera images

The police may view and use the camera images to maintain public order. For example, to combat unsafe situations or recurring riots. If the camera has captured incidents such as a fight, the police may also use the camera images to track down the perpetrators of criminal offences.

Temporary camera surveillance: camera images also police data

The police can use temporary camera surveillance. In that case too, the processing of the camera images also falls under the Police Data Act. That means that in the case of temporary camera surveillance too, the chief of police is the data controller, the processing must comply with the Police Data Act, and the chief of police must be able to demonstrate this.

The transfer of camera images

The police may only transfer camera images if this is permitted under the Police Data Act. The local authority does, therefore, not simply have access to the camera images. The police must monitor this.

Performing a DPIA

The fact that the chief of police is the data controller also means they are responsible for performing a DPIA. The chief of police performs the DPIA before the start of camera surveillance and, therefore, before camera images are processed.

Since the mayor decides for permanent camera surveillance where and how long camera surveillance is to be deployed, among other things, the chief of police will obviously involve the mayor in performing the DPIA.

If necessary, the chief of police also asks the Dutch Data Protection Authority (DPA) for prior consultation.

Agreements between police and local authority

It is obvious that the police and the local authority have close contact about the implementation of camera surveillance. For example, about informing citizens, which the local authority and the police are both obliged to do.