Datatilsynet (Norway) - 23/02028
From GDPRhub
| Datatilsynet - 23/02028 | |
|---|---|
 | |
| Authority: | Datatilsynet (Norway) |
| Jurisdiction: | Norway |
| Relevant Law: | Article 6(1)(f) GDPR Article 12 GDPR Article 13 GDPR Article 24 GDPR Article 58(2) GDPR § 3 Regulation on business use of CCTV § 9(6) Working Environment Act |
| Type: | Other |
| Outcome: | n/a |
| Started: | 01.06.2023 |
| Decided: | 07.09.2023 |
| Published: | 07.09.2023 |
| Fine: | n/a |
| Parties: | Fast Candy AS |
| National Case Number/Name: | 23/02028 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Norwegian Norwegian |
| Original Source: | Datatilsynet (in NO) Datatilsynet (in NO) |
| Initial Contributor: | Maximilien Hjortland |
Datatilsynet in Norway carried out an unannounced inspection of a candy store and ordered a ban on CCTV surveillance and transparent information to data subjects, as these were predominately employees younger than 18 years old.
English Summary
Facts
1. June 2023, The Norwegian DPA (Datatilsynet) did an inspection of the CCTV practices on the premises of Fast Candy AS (the contoller), a candy store in Oslo with 27 employees. Prior to the visit, Datatilsynet had received three tips about CCTV affecting employed minors.
19. June 2023, based on Article 58(2)(d) of the GDPR, a preliminary report was sent to the controller in which Datatilsynet notified about the intent to order Fast Candy to bring CCTV processing operations into compliance. The controller did not provide any comments upon receiving the report.
The decisions of the final report, including a series of definitive bans of processing (Article 58(2)(e) GDPR), is outlined below.
Datatilsynet set a deadline for the controller to comply with the ordered measures by 15. November 2023.
Holding
Due to missing legal basis, see Article 6(1)(f) GDPR, Datatilsynet ordered the controller to:
- stop CCTV of the area behind the counter, which is only accessed by employees - stop or adjust CCTV in the storage/office area - stop all actual and potential use of audio recordings - stop all actual and potential use of remote access to CCTV, and - stop any surveillance with the purpose of controlling customer payment and subsequent collection of goods
Fast Candy was equally ordered to document the specific purposes, legal bases, and routines for processing, access, provision of recordings and deletion of CCTV, see Article 24 GDPR.
Also, the controller must provide employees with an information letter explaining the use of CCTV on the work place pursuant to Articles 12 and 13 of the GDPR. A copy of the letter is to be sent to Datatilsynet.
Further, on the basis of Article 13 GDPR, Fast Candy was instructed to more clearly specify that surveillance is occurring and who is the data processor (through an improved notification at the store front).
Lastly, recordings were to be deleted after a maximum retention period of one week, see the Norwegian regulation on business use of CCTV.
Comment
In 2023, Datatilsynet has made unannounced inspections of employers' CCTV practices a priority. The DPA especifically focuses on CCTV surveillance of minor employees.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
Control report
Case number: 23/02028 Control object: Prepared by:
Date of inspection: 01/06/2023 Fast Candy Marte Lindblad Skaslien and
Report date: 05/09/2023 Place: Jeanette Dyrkorn
VIA Vika
Summary
One of the priorities for the Norwegian Data Protection Authority in 2023 is to carry out local camera surveillance where
the camera surveillance affects employees. We have a particular focus on camera surveillance where minors are involved
employees are affected.
As of today, we have received three tips about the camera surveillance in the candy store Fast Candy on Via
Village, Vika.
According to the tips, most employees are under the age of 18, and the cameras are used to monitor employees.
The camera surveillance, including audio recordings, will be used against them in personnel matters.
The most important findings concern the location and angle of the camera, and which functionalities
the cameras had.
1 Introduction
We were to carry out an unannounced inspection in the shop premises of Fast Candy AS, VIA Vika, the
31 May at 13. When we arrived we spoke to the general manager on the phone, and he didn't have any
opportunity to meet us before the following day. We informed him that we would implement
preliminary investigations of the premises, and we agreed on a meeting time for the next day.
During the preliminary investigations on 31 May, we looked over the premises and we took pictures of the two cameras we
found, to document the location and angle of the cameras. We also took pictures of signs
entrance area and two smaller patches by a candy shelf.
We then carried out inspections in the shop premises on 1 June 2023 at 10:50. We have delimited
the supervision of how the cameras affect the employees. That is, the angle of the cameras, which
functions they have, whether and how employees are informed, written routines for camera surveillance
and how the camera surveillance is used in practice.
According to publicly available sources, there are 27 employees in the business. The business was founded
29 March 2021.
According to the general manager, they opened the store at Vika in November 2022. They have subsequently opened a store in
Sandvika, and they previously had a shop in Bekkestua.
In the following, we describe our findings from the inspection of Fast Candy VIA Vika.
The supervisory report forms the basis for the decisions in the case. The business has not had
comments to the preliminary control report we sent on 19 June 2023. The final
the report is therefore essentially similar to the preliminary report.
1 of 15 2 The rules for camera surveillance
2.1 Duty to determine purposes and limit use to specified purposes
Before a business uses camera surveillance, a clearly defined purpose must be established
each individual camera. This emerges from the general rules on processing of
personal data in the personal data protection regulation (GDPR) article 5 no. 1 letter b, cf.
§ 1 of the Personal Information Act.
The camera surveillance cannot later be used for new purposes that are incompatible with those
original purposes.
2.2 The data minimization principle
A basic principle according to the privacy regulations is that you should only collect
personal data that is adequate, relevant and limited to what is necessary
the purposes for which they are processed. This is stated in the personal data protection regulation article 5 no. 1 letter c.
2.3 Legal basis for camera surveillance
Processing of personal data is only legal if the controller can
demonstrate a processing basis (legal basis), cf. the personal protection regulation article 6 no. 1.
There are six different legal bases according to the regulation. For camera surveillance, use of
remote access and use of audio recordings in business must be based on the legal starting point
the personal data protection regulation article 6 no. 1 letter f, the so-called
the balancing of interests provision.
This basis for processing means that the business can
process personal data if it is necessary to safeguard a legitimate interest which
outweighs the consideration of the individual's privacy.
In order for "legitimate interest" to be used as a legal basis for processing, the
Data controllers, firstly, pursue a legitimate interest. This entitled
the interest must be legal, clearly defined in advance, real and factually justified in the business.
1
In PVN-2019-09, the Personal Protection Board has assumed that the legitimate interest must be
legally and factually justified, and both legal, financial or non-material interests can
be eligible. Furthermore, it is in the European Privacy Council's guidelines for
camera surveillance based on protection against theft, vandalism and criminals
actions may constitute a legitimate interest. However, this assumes that the business
demonstrates that the danger is real, and not just based on speculation.
1
2 The Privacy Board is the appeals body for decisions made by the Norwegian Data Protection Authority
Guidelines 3/2019 on processing of personal data through video devices. Version 2.0. Adopted on 29 January
2020.
2 of 15Which interests fulfill this depends on an overall assessment of, among other things, which
benefits the business achieves with the processing, how important the interest is to the business,
whether the processing is in the public interest or safeguards the non-profit interests that come more
for good.
The use of the information must also be necessary to safeguard the legitimate interest.
The term "necessary" implies a strict requirement. If the business considers that the purpose
can be achieved in a way that better safeguards privacy, one must choose the treatment that
is the least invasive.
Thirdly, the fundamental rights and freedoms of the data subject must not exceed it
the interests of the data controller. A concrete assessment of the situation must be made, and the
the specific impact the processing has on the data subjects' privacy. This involves a
objective assessment of data subjects' reasonable expectations; what a neutral third person with
5
reasonableness can expect from monitoring in a given situation.
If a processing does not meet the basic requirements of the Personal Data Protection Ordinance, is
processing illegal. All the conditions must therefore be met for the processing to be permitted
the balancing of interests provision.
2.4 Additional conditions for areas where only the employees travel
Regulation on camera surveillance in business of 20 July 2018 (the camera regulation) applies i
in addition to the general rules, if the camera surveillance affects employees.
Camera surveillance of areas where only a limited circle of people travel regularly is only
Act if, based on the business, there is a need to prevent dangerous situations from occurring and
take care of the safety of employees or others, or otherwise there is a "special need".
This is stated in section 3 of the camera regulations. In other words, there must be a serious need
in order to be able to monitor this type of area.
2.5 Duty to provide information to employees and other notification requirements
The principle of transparency in the personal data protection regulation article 5 no. 1 letter a dictates that the processing
of personal data must be predictable for the individual. This means that each employee
shall receive clear and unambiguous information about the processing of their personal data in accordance with
Article 12 and Article 13. The information must be provided in a concise, open, understandable and easy way
accessible way.
3 Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive
95/46/EC, pages 24 and 25.
4 See for example C-212/13 Rynes, section 28 as highlighted in LB-2020-18230 section 3.4.
5 Guidelines 3/2019 on processing of personal data through video devices, point 3.1.3
3 of 15 With camera surveillance, it must be made clear by signage or other means that the location remains
monitored, whether the monitoring possibly includes audio recordings and who it is
data controller, cf. the camera regulations § 4. The signs must have a size, location and a
number that makes it easy to understand that the area is monitored. They should preferably be put there
where one enters the monitored area.
2.6 Duty to establish internal control and routines
It follows from the personal protection regulation article 24 no. 1 that the controller must
"implement suitable technical and organizational measures to ensure and demonstrate that the processing
carried out in accordance with this regulation."
This means that the business has a duty to establish internal control to ensure that the business
fulfills the law's requirements for the processing of personal data, including camera surveillance.
The business must prepare written routines. The routines must, among other things, ensure that
the camera surveillance is only used for the purposes for which it is intended, that recordings are regularly deleted,
routines for access management and that recordings are not handed out in violation of the law.
2.7 Obligation to delete
According to the camera regulations, recordings must be deleted no later than one week after the recordings have been made.
If it is likely that the recording will be handed over to the police in connection with an investigation
of criminal offenses or accidents, the recordings can be kept for up to 30 days.
Recordings made at outlets that use payment instruments or proof of identity shall
deleted no later than three months after the recordings have been made.
3 Inspection certificate
3.1 General about the cameras
Based on our observations, the two cameras should be of the Nedis Smart IP camera type
with Wi-Fi. The cameras are intended for outdoor home use.
We verified that continuous recording is being done.
Remote access
During the inspection, we got an explanation from the general manager and co-owner that they both had remote access to
the cameras via an application on their mobile phones. This was verified and we took pictures of it
the screen when the general manager was inside the application.
The general manager stated that the security guards are often in other parts of the centre, and it is therefore important that
he has access to the cameras, to be able to follow up on events quickly. He explained that he has
business in another/another country, and he is rarely present even in the shop.
4 of 15 The daily manager explained that they experience a lot of pressure in the store, especially at weekends, and it can be
long lines to get in. There are usually two employees present in the store.
At the time of the inspection, there were two employees present in the store, who appeared calm.
If an incident occurs in the store, the employees contact the general manager, and he follows up
up from where he is.
Sound recording
The general manager explained that there is no sound recording.
We verified that there is continuous audio recording, but they have to actively turn on the function to hear.
Audio recordings can be switched on and listened to through direct streaming and this is also done
continuous audio recording that is saved together with the recording. It was verified that audio recordings are saved.
The general manager stated that he had not thought about it, and had not used the function.
Function for zooming
We verified that the cameras have a function for zooming. The cameras have good image quality, and
possibility to zoom in properly.
Storage time
The general manager stated a storage period of 12 days.
The on-site investigations showed that the camera behind the till saves footage for 15 days. We verified
that it is not possible to change the storage time in the application. The storage time probably depends
of storage card size.
3.2 Especially about the camera behind the box
During the inspection, the camera was angled outwards into the shop premises and downwards towards the checkout.
A sample from the general manager's application showed that the camera captures the area behind the till, and
the area in front of the checkout, in the direction of the entrance. We took a picture of the general manager's screen.
The camera captures one stand-alone candy shelf, and smaller parts of a shelf along one
the wall.
The general manager explained the purposes of the camera surveillance:
- Thefts
- Incidents with pedophiles
- Investigate incidents where customers complain that they have not received an item they have
paid for
5 of 15 The daily manager stated that they had experienced theft in the store on several occasions. The guards
visited the store often. In the beginning, before they had cameras, they experienced thefts 4-5 times per
day. After they installed the cameras, they experience thefts a few times a week.
The general manager also stated that they have had two incidents with pedophiles in the store, and also
these times the guards stopped by. Cases must have been opened, and it turned out that the one
the person was banned from other shopping centres.
Later in the interview, the co-owner stated that they also use cameras if customers complain about discrepancies
between what they have paid for and what goods they have received. Sometimes the customers threaten
police report. The recording is then checked to see if an error has occurred during it
the trade.
3.3 Especially about the camera in the back room
The shop premises consist of one room, where a "back room"/storage room is shielded from the rest of the shop
with a wall without a door. The wall does not go all the way up to the ceiling, and having to physically secure the room
appears as a challenge. Only employees travel in the back room.
Samples from the general manager's application on his phone showed that the camera mainly
captures the entire room. We took a picture of the general manager's screen.
Based on their own observations and the general manager's explanation, they keep stocked sweets,
the employees' bags, and PC, in this room.
The general manager explained the purpose of the camera surveillance:
- Theft
The general manager stated that they had experienced theft in the back room during opening hours. Young people
has entered the shop, and further into the back room.
The general manager stated that it is necessary to monitor the entire back room with cameras, in order to be able to
document how much is stolen. He explained about an incident where bags of goods
was filled up.
3.4 Information about the camera surveillance
We took pictures of the sign at the front door, and of two small notes by a candy shelf. On signs and
notes were a picture of a camera and text that says "The area is under camera surveillance".
The general manager states that they have a "Policy for camera surveillance" on their website.
The general manager states that employees are informed through the employment agreement, and that they are informed
orally upon employment.
6 of 15 3.5 Routines and internal control
The general manager states that they have routines for when they check admissions, but the business could
do not submit this.
The general manager states that he called the Norwegian Data Protection Authority's guidance service and set up
camera in November 2022.
3.6 Use of camera - control of employees?
The general manager was confronted with some of the content of the tips we have received. According to the tips,
the employer controls the employees' work performance, and the camera surveillance is used as
basis against them in personnel matters. The general manager was confronted with a concrete incident where
an employee had been looking at a mobile phone instead of carrying out work tasks.
According to tips we have received, audio recordings from the camera surveillance are also used against the employees in
personnel matters.
We verified that the rear room camera captures the entire room. The camera behind the cash register
captures what the employees do behind the cash register, and what they do if they are in the area in front
the box.
The general manager stated that the reason he knows that employees have been on their mobiles instead of
perform work tasks, is that the co-owner has sat at the dining area on the floor above and observed them
employees.
We verified that some of the seats on the floor above have a view down to the back room and the shop.
The general manager stated that he also receives tips from other employees.
4 Supervisory findings and deviations from requirements in the legislation
4.1 Legal basis for camera surveillance in the customer area
The business must have a legal basis for monitoring the shop area, cf.
the privacy regulation article 6 no. 1 letter f. The additional condition on "special needs" according to
however, the camera regulations do not apply to this area, as it is available to customers.
We refer to the descriptions above when it comes to the business's descriptions of purpose and
requirement of necessity.
In our opinion, the purposes appear to be those relating to theft and protection against unpleasant persons
as eligible. Furthermore, it appears necessary to monitor the shop area to prevent and
7 out of 15 solve thefts. We understand that young employees do not want to confront thieves alone,
and that it may take time before the watchman arrives.
Furthermore, we see that the store is sometimes exposed to "rushes", and that the premises are unclear during such times
periods. The business has also shown that the monitoring has an effect on the number of thefts.
We also believe it is necessary to record the situations in which employees experience ongoing
persons. The condition of necessity is thus fulfilled, but we assume that the business
make regular assessments of what times of the day monitoring is necessary, and
describes this in internal control, see point 5 of the resolution.
We also assume that the employees expect the customer area to be monitored due to theft.
Monitoring of the customer area also appears less intrusive than other areas, although
employees are sometimes also located here. It can also be a security for young employees that it
certain situations are recorded.
This of course assumes that the employees receive clear information about the monitoring. Furthermore, it is
a prerequisite for legality is that the monitoring is only used for the above-mentioned purposes.
In summary, we believe that camera surveillance of the shop premises where customers are located is legal
basis in the personal data protection regulation article 6 no. 1 letter f, provided that the camera is only used
to prevent and solve thefts, or incidents that concern the safety of employees. We see
therefore no reason to make an order regarding this.
However, the company has also stated that customers occasionally complain that they have not received it
with them an item they allegedly paid for. The business therefore uses a camera to check
whether the item has been paid for or whether the customer has received the item. In our opinion, it appears
clear that this purpose is not justified, as it is a form of control of whether the employee has
did the job right. Furthermore, privacy considerations exceed those of the employee anyway
the business's interest in investigating this.
We will therefore order the cessation of monitoring for this purpose, as it has no legal basis,
cf. the personal protection regulation article 6 no. 1 letter f, see the resolution point 9.
4.2 Legal basis for camera surveillance behind the checkout
The business must have a legal basis for monitoring behind the till where the employee is,
cf. the personal protection regulation article 6 no. 1 letter f. Furthermore, the additional condition applies if
"special needs" according to the camera regulations as, as a general rule, only employees are in the back
the purchase counter.
As previously stated, we consider the prevention and investigation of thefts to be legitimate purposes.
The same applies to safety for employees.
However, we cannot see that the area behind the cash register is particularly prone to theft. Here is the employee
large parts of the time, and it is therefore difficult to steal goods from here. We understand that thefts
8 out of 15 can still happen if the employee is alone, and has to go out into the shop or warehouse. This is
however, easily solved by moving any goods behind the counter out into the shop premises.
We therefore believe that it is not necessary to monitor behind the till to prevent and clarify
theft from customers.
We also do not believe that it is necessary to monitor behind the till due to ongoing and
unpleasant people. It is the employee who is monitored behind the counter, and not the one in progress
the person. The rest of the shop area is filmed anyway, and the person in question is captured
here. Monitoring behind the counter is therefore not necessary.
We also believe that monitoring behind the counter is a disproportionate burden on employees. It
employees are then monitored for large parts of the working day, which is burdensome. We mean this
clearly exceeds the employees' reasonable expectations. We also attach great importance to balancing interests
emphasis on the fact that many of the workers are minors or young workers.
In any event, we believe that the additional condition of "special needs" is not met. IN
case PVN-2013-03, the Norwegian Personal Protection Board states that the term "special needs" is a legal standard
which is developed through the practice of the Norwegian Data Protection Authority and the Norwegian Data Protection Authority. The Norwegian Personal Protection Board has its say
agree with the Norwegian Data Protection Authority's guide (2012) where it is stated that:
"If the purpose is to safeguard the employees' health and safety, the monitoring will normally take place
be allowed. There will then be a requirement that the workplace is assessed to have a special one
high security risk. Places where risky production is carried out, or where there are large
chances of robbery, such as banks and post offices, are typical examples. This will nevertheless
only apply to the specific areas where there is a significant risk, such as places
where cash is handled or where safes are located'.
The case concerns the old Personal Data Act of 2000 § 38 which previously regulated the use of
camera surveillance. However, the condition "special needs" has been continued in section 3 of the camera regulations
and practice from before the regulation was in place is therefore still relevant.
We cannot see that your business is exposed to particular security risks, or is particularly so
exposed to dangerous situations. The additional condition on "special needs" according to § 3 of the camera regulations
is thus not fulfilled.
The business thus has no legal basis for monitoring behind the till.
We will therefore order you to stop the camera surveillance behind the till, cf.
the personal protection regulation article 6 no. 1 letter f and the camera regulation section 3. See the decision point
1.
4.3 Legal basis for camera surveillance behind the warehouse/office
9 of 15 In order to monitor the warehouse, the business must have a legal basis in the Personal Protection Ordinance
article 6 no. 1 letter f. Furthermore, the additional condition on "special needs" applies according to
the camera regulations as, as a general rule, only employees are in the warehouse.
As shown above, the business has experienced people stealing from the warehouse as it is difficult
with physical security. The business believes that it is necessary to be able to document how much
which is possibly stolen, and we see that camera surveillance can basically serve to
fulfill this purpose. Camera surveillance to clarify such incidents is in itself one
legitimate purpose.
Camera surveillance must nevertheless be limited to what is necessary. We cannot see that it is
necessary to monitor the entire warehouse to clarify such incidents. It should be possible
monitor the entrance to the warehouse, and to see if there had been unauthorized persons in the warehouse and if they
possibly have taken goods out with them. If the business discovers thefts in the warehouse, admissions can be made
be reviewed.
In addition, consideration for the employees weighs heavily. The area is used as an office and break room.
As a general rule, surveillance in such places is not permitted. We believe that employees have an expectation
about not being filmed in such places, and that such surveillance is perceived as burdensome. Considering
that large parts of the remaining shop area are filmed, it is particularly important that employees have one
free area without surveillance.
With regard to the requirement of special needs according to the camera regulations, we refer to the assessment in
point to the previous point about cash register monitoring, as it also applies here. We cannot see
that the business, and the area behind the warehouse, are exposed to special security risks or
the like.
In summary, we believe that the business has no legal basis for monitoring
storage/break room.
We will therefore order you to stop the camera surveillance of warehouses/break rooms, cf.
the personal protection regulation article 6 no. 1 letter f and the camera regulation section 3. See the decision item
2.
4.4 Legal basis for sound recording
In order to use sound, both in real time and recording, you must show a legal basis, cf.
Personal Data Protection Regulation Article 6 letter f.
The camera surveillance solution makes continuous audio recordings. You have stated that audio recordings
will not be used, and that you were not aware that audio recordings were being made. Neither have you
stated any purpose for making audio recordings.
It therefore appears clear that sound recordings have no legal basis. First of all, you haven't
shown for a factually justified purpose. The requirement of legitimate interests is therefore not met.
10 of 15 Furthermore, we believe that the use or possibility of audio recording is not necessary to clarify or
prevent either thefts or incidents involving people in progress. This applies both in the
specific store, but also on a general basis in general stores.
We also believe that the possibility or use of sound is very burdensome for employees. Employees must have
opportunity to have conversations with colleagues and customers without the risk of being overheard. Customers have
also a clear expectation not to be recorded with sound in shops.
In summary, there is no doubt that the use and possibility of sound has no legal basis, and we see
not that there is reason to make further assessments regarding this.
We will therefore order you to remove all possibility of and use of audio recordings. This implies that
you must have a system that ensures that no sound is recorded under any circumstances, either
in real time or on recording, as this has no legal basis, cf. the Personal Data Protection Ordinance
article 6 no. 1 letter f. See resolution point 3.
4.5 Legal basis for remote access
To use remote access, you must show a legal basis. The relevant legal basis
for the use of remote access is the balancing of interests provision, cf. the privacy regulation
article 6 no. 1 letter f.
According to the general manager, remote access is used when employees call for various events, such as
thefts or ongoing persons. You have stated that it is uncomfortable for young employees to stand
alone in such situations. You therefore use the remote access to get an overview of the situation and
assist the employee, for example by calling scales. We understand you so that the purpose is to have
overview of various situations that arise, including to assist employees.
In our opinion, the purpose of protecting and assisting employees is a factual purpose in itself. For us
it is still unclear how remote access actually contributes to helping the employee. You are
anyway not physically present, and cannot contribute anything other than moral support, or give instructions
regarding the situation. We believe you can undoubtedly achieve this with less
privacy-intrusive measures.
Examples of this are ordinary telephone contact and routines for guard duty where the employee himself can
low weights. We understand that it can sometimes take time before the security guard is in place. Still looking
we do not how remote access helps in anticipation of scales.
Furthermore, the use of recordings is normally sufficient to clarify the situation afterwards or to
hand over recordings to the police. We therefore believe that remote access is not suitable to contribute or is
necessary to achieve the aforementioned purposes. The requirement of necessity has not been met.
6 Cf. the purposes you have stated, such as prevention/detection of thefts and ongoing persons connected to them
pedophilia.
11 of 15 We also specify that remote access is a much greater intrusion into employees' privacy than local access
monitoring or storage. Remote access by telephone means in practice that the owner can follow along
at any time, even without the employee's knowledge. The risk of abuse is therefore great. Although
abuse does not occur in practice, the possibility of remote access constitutes a disproportionate burden
for the employee.
This means that, as a general rule, there must be very compelling reasons for remote access
is allowed. As a general rule, such reasons are not available in general stores and outlets,
nor in the specific case.
We therefore believe under any circumstances that the privacy concerns of the employees exceed
the business's need for remote access.
We conclude that the remote access has no legal basis according to the Personal Data Protection Ordinance
article 6 no. 1 letter f. All use and possibility of remote access must therefore be stopped, cf. the decision
point 4.
4.6 Internal control and routines
Article 24 of the Personal Protection Ordinance requires the business to prepare measures, such as in writing
routines, to ensure that personal data is processed in accordance with the law.
At the inspection, we asked you to submit any internal controls. This was not established.
We will therefore require you to prepare a written internal control. The internal control must list
the purposes for which the camera surveillance is used. Furthermore, the internal control must contain routines
which ensures that recordings are regularly deleted, routines for access management, that the obligation to provide information
towards customers and employees is respected and that recordings are not handed out in violation of the law. We are showing
to the personal protection regulation article 24 and the resolution point 5.
4.7 Information for employees
It is a requirement that employees receive information about the camera surveillance.
At the inspection, we asked you to provide information that had been given to employees. You pointed to
information on the website and the employment agreement of the employees. Both documents state that
the areas are monitored by cameras. You have not given written information beyond this, but you
explained that employees have also received oral information.
In our assessment, you have not made it likely that the employees receive sufficient information
about the camera surveillance in accordance with the Personal Protection Regulation articles 12 and 13. We believe
the information must be more complementary. It is a requirement that the employees receive information about
the following points:
• Who is responsible for processing
• The purpose of the processing
12 of 15 • Legal basis for the processing
• With whom the information may be shared
• Storage time
• The rights of the data subject
We also believe that the information must be in writing to meet requirements for transparency and
availability, cf. the personal protection regulation article 12 no. 1.
We will therefore require you to establish a clear and distinct written information letter for employees
to ensure compliance with the obligation to provide information cf. articles 12 and 13, see point 6 of the resolution.
We specify that the written information should be available in internal control, and not in
employment agreement.
4.8 Signage
When camera surveillance takes place in a business, there is a requirement for notification, by means of signage or
other clear way, cf. section 4 of the camera regulations.
At the inspection, you pointed out that a label/sticker has been put up at the entrance. The
there were also small notes around the room above product shelves. It is stated that the place is under camera surveillance.
In our opinion, the signage is inadequate. The sign does not contain information about who
who is responsible for the camera surveillance. Furthermore, our assessment is that the sticker outside
the entrance is not clear enough.
We will therefore require you to establish a clearer sign at the entrance, which also
contains information about who is responsible for the monitoring. The signage must do it
clear to customers that the place is under camera surveillance, before they enter the area.
cf. section 4 of the camera regulations. See point 7 of the decision.
4.9 Deletion
For camera surveillance in business, recordings must be deleted after one week at the latest, cf.
section 6 of the camera regulations.
At the inspection, we asked you to inform us about how long recordings are stored. You stated that the storage time
was twelve days. Closer examination showed that the storage period was fifteen days.
As the camera surveillance takes place at a workplace, the camera regulations apply. Maximum
general storage time is basically one week, but up to three months if the business
has a payment instrument. Since you have a cash register, you have a payment instrument, and can
in principle store for three months provided this is necessary.
In most cases, however, it is not necessary to store for that long, and the business is obliged
to make an assessment of the necessary storage time.
13 of 15 You had not made an assessment of the necessary storage time, and the storage time was based on them
the accompanying settings.
In our opinion, as a general rule, one week's storage time is sufficient. You have not stated
need for additional storage time after the inspection, or as a note to a notice.
We will therefore require you to adjust the storage time of recordings to one week at the latest, cf. § 6, see
Resolution point 8.
4.10 Use of camera - control of employees?
Based on the general manager's explanation, we cannot assume that the camera surveillance has been
used against the employees in personnel matters.
4. Documentation
As of today, we have received three tips about the camera surveillance at Fast Candy AS.
In summary, the following can be seen from the tips:
- Young workers (mainly under 18)
- Camera surveillance throughout the store, including storage rooms, rooms where employees change
- Used to monitor employees
- Includes microphones and use of audio recording
- Employees are confronted with what they have said to each other, and this is used by management
in personnel matters
- Employees have not received information about the camera surveillance
- Employees do not know when the management sees or listens to the transmissions from the camera and
the microphone.
5. Present during the inspection 7
a. From the supervised object:
- Robert Crnalic, general manager
- Uros Ljiljak, manager
b. From the Norwegian Data Protection Authority:
- Marte Skaslien, supervisor
- Ylva Marrable, section leader
- Jeanette Dyrkorn, senior legal advisor
- Atle Årnes, technologist
7 Ref. Overview of meeting participants
14 of 1515 of 15
