Video Surveillance by Private Individuals

Where private individuals install CCTV cameras, for example to protect people or deter acts of vandalism, this is governed by the Federal Act on Data Protection if people appearing on the recorded images can be recognised. This is the case irrespective of whether the recordings are saved or not. The processes such as the recording, disclosure, immediate or subsequent viewing or storage of the images must comply with the general principles of data protection.

Operating a CCTV system involves the constant processing of personal data. This form of surveillance, depending on the situation, may also involve a serious invasion of the privacy of the persons filmed by the cameras. It is therefore important when planning, installing and operating such systems to pay special attention to the rules on the protection of privacy. This leaflet is intended to explain what this actually means by providing a number of practical examples.

This leaflet covers video surveillance carried out by private individuals in private locations, regardless of whether these places are publicly accessible or not. Where workplaces are filmed, specific requirements must be met. You can find out more about this in the relevant section on our website (in German, French or Italian). Separate information is also provided on the private video surveillance of public areas.

Making preparations

CCTV systems are permitted only if they comply with the principles of legality and proportionality. In specific terms, this means that whenever a CCTV system is installed, the following requirements must be met:

1. Video surveillance is permitted only if an infringement of personal privacy is justified. Either the persons concerned consent to being filmed, there is an overriding public or private interest in surveillance, or surveillance is justified by specific legal provisions (principle of legality).

Examples:

The owner of a jewellery shop has an overriding private interest in preventing burglaries from being committed while the shop is closed. Video surveillance to prevent and assist in the investigation of burglaries is therefore justified.

A bar owner shows live pictures of the bar on his website in the hope of attracting more custom. Here there is no interest overriding that in protecting personal privacy, which means this activity is permitted only with the consent of the persons concerned. Accordingly, only those parts of the bar where there are notices saying that filming is taking place may be filmed, so that customers have the choice of whether they wish to enter the filmed area of the bar or not. If the entire bar is filmed, and customers no longer have this choice, those who are filmed must be made unrecognisable.

In most cases it is not feasible when operating CCTV systems to obtain the consent of all those affected. If there is any doubt, then video surveillance should be conducted only where there is an overriding private or public interest, i.e. primarily for security purposes.

It is also important to note that a private CCTV system that films public areas normally violates the principles of legality and proportionality and is therefore unlawful. For more about this, see here.

2. The form of video surveillance must be suitable for achieving the intended purpose of security, and in particular the protection of persons and/or property. Video surveillance may only be conducted if other measures that are less of an intrusion on privacy, such as additional locks, reinforced doors or alarm systems, prove insufficient or impractical. In addition, the intrusion on privacy caused by video surveillance must be in reasonable proportion to the intended purpose (principle of proportionality).

Examples:

CCTV cameras in a parking garage are generally allowed, as they deter vandalism or can help in the investigation of such offences.

CCTV cameras in fitting rooms or toilets intrude on the privacy of the persons concerned and for this reason alone are unlawful. In addition, a shop owner can prevent thefts using less intrusive methods (e.g. alarm systems). A CCTV system in this situation would therefore be excessive.

Dummy cameras do not process personal data but still make it appear as if data processing is taking place. As the use of dummy cameras can be problematic for other legal reasons (in particular relating to public liability), their use is generally not recommended.

Installation of a CCTV system

The CCTV system should be installed in such a way that even the set-up complies with the principles of proportionality, good faith and transparency. More specifically, this means:

1. The video camera must be positioned so that only images that are absolutely essential for the intended purpose are recorded (principle of proportionality).

Example:

In the video surveillance of an apartment building, it must not be possible to see who is entering which apartment or opening which mail box.

2. Private video surveillance may as a rule only be carried out on a person's private property. The neighbour's property may only be filmed if the neighbour has given his or her permission. The same applies in apartment buildings containing rented or privately owned apartments: tenants or apartment-owners may only monitor that part of the property which they alone use. Permission must be obtained from all occupants of the building before the communally used areas can be filmed. Furthermore, it should be noted that special rules apply when filming public spaces. More information on this can be found in our explanations.

Examples:

The occupants of a privately owned detached house may install video surveillance equipment to monitor their house and garden in order to protect the property against burglars. However, the camera(s) may only film the area up to the property boundary, so long as the neighbour concerned does not agree to the surveillance extending beyond it.

Apartment owners or tenants may film their apartment including the balcony. Video surveillance in the entrance area, stairwell (including the area in front of each apartment's front door), the laundry room or shared garage is, however, only permitted if all occupants agree to it.  

2. Private video surveillance may as a rule only be carried out on a person's private property. The neighbour's property may only be filmed if the neighbour has given his or her permission. The same applies in apartment buildings containing rented or privately owned apartments: tenants or apartment-owners may only monitor that part of the property which they alone use. Permission must be obtained from all occupants of the building before the communally used areas can be filmed. Furthermore, it should be noted that special rules apply when filming public spaces. More information on this can be found in our explanations.

Examples:

The occupants of a privately owned detached house may install video surveillance equipment to monitor their house and garden in order to protect the property against burglars. However, the camera(s) may only film the area up to the property boundary, so long as the neighbour concerned does not agree to the surveillance extending beyond it.

Apartment owners or tenants may film their apartment including the balcony. Video surveillance in the entrance area, stairwell (including the area in front of each apartment's front door), the laundry room or shared garage is, however, only permitted if all occupants agree to it.

 

3. The persons in charge of the video surveillance must inform everyone within range of the cameras of their activities by providing a clearly visible notice about the CCTV system. If the images recorded are part of a data collection (i.e. if they are stored in some form), notice must also be given of who should be contacted for more information if this is not obvious from the circumstances (principle of good faith and the right to information).

Example:

At the entrance to an apartment building, the notice must be clearly visible to any person entering.

 

Operating a CCTV system

1. The data may only be used to protect persons and property, and not for any other purposes (principle of limitation to a specific purpose).

Example:

A shop is not permitted to use security recordings for marketing purposes.

2. The persons in charge must employ appropriate technical and organisational measures to protect the video images from being processed by unauthorised persons (data security).

Examples:

The data must be stored in a secure, locked room and only authorised persons should be given a key.

If the images are transmitted by radio signal to the storage location, the radio signal must be encrypted or made secure through other suitable measures so that unauthorised persons are unable to intercept the signal and view the unencrypted images.

3. As few people as possible should have access to the video images, whether they are live or stored (data security and proportionality).

Examples:

In a night club, only those responsible for security should have access to the video data. Bar staff, for example, should not be allowed access.

The screens of a CCTV system must be positioned so that only authorised staff can see them. Screens that can be viewed by the public are unlawful.

In addition, it must be decided whether the purpose of video surveillance means live monitoring is required or whether it is sufficient for the stored data to be viewed in the event of an incident. If viewing after an incident is sufficient, the images should not be viewed unless an incident occurs.

Example:

The video images of a parking garage taken in order to deter acts of vandalism or assist in their investigation may only be viewed in the event of such an act. If no vandalism takes place, the saved images must be deleted after a reasonable time (see Section 5 below) without being viewed.

4. The personal data recorded must not be disclosed unless the images are handed over to the prosecution authorities to assist in criminal proceedings, or in cases provided for or permitted by law, for example in response to a request from a court (principle of limitation to a specific purpose).

Examples:

A shop must not pass on or sell recorded images to third parties.

It is not permitted to display images taken by a CCTV camera on the internet.

5. The images recorded by a camera must be deleted as soon as possible. Damage to property or personal injuries are normally reported immediately or within a few hours. A retention limit of 24 hours would seem sufficient given the intended purpose, provided no significant incidents come to light during this period.

If there are objective and important grounds that justify a longer retention period, the period may be extended appropriately. In addition, the period may be longer in the case of video surveillance of private areas that are not publicly accessible (principle of proportionality).

Example:

When they go off on holiday, property owners may retain recordings for longer periods than usually permitted, but after they return, they must delete the images as soon as possible.

The longer the images are stored, the higher the data security requirements are. If the retention period is extended, the additional use of data protection technologies (e.g. scrambling) and the encryption of the stored photographic data should be considered.

6. If requested to do so, the persons responsible for video surveillance must provide information to anyone who comes within range of the cameras about the video recordings. For further information on this (in German, French or Italian), see here.

Last update: September 2011

https://www.edoeb.admin.ch/content/edoeb/en/home/data-protection/dokumentation/factsheets/video-surveillance-by-private-individuals.html