Electronic access and control systems, such as those used in ski resorts or other sports facilities, may not display data such as names, dates of birth etc. on a monitor that is visible to the public. If no other control systems can be used, operators may exceptionally display a photograph to verify that the person is the rightful ticket-holder. However, this may only be done in the direct vicinity of the control point.
Skiers are increasingly confronted with modern ticketing and access control systems which also process personal data. When passes are purchased, particularly those with a long validity period, the usual customer data will be stored along with a digital photograph. The purpose of this is to check that the personal pass is actually used by the legitimate owner and not by someone else.
There are many ski resorts where personal data displayed on access control systems are visible to the general public. When customers pass through the turnstile, a large monitor will display their photograph, or at least the photograph of the legitimate ticket-holder. Additional data, such as surname, first name, or date of birth, may also be superimposed. This is done to reduce fraud, and in particular to ensure that personal passes are not used by persons other than their rightful owners. The system thus allows skiers to check up on one another. Cases have been reported to us where the displayed information remained visible for several minutes.
Whenever such systems are used, it is important to bear in mind the proportionality principle. Invasion of an individual's privacy should not go further than is absolutely necessary for the prevention of fraud. Preference should be given to other control procedures which involve less data processing and make less data available to third parties. For example, staff could be instructed to carry out spot checks. If a system involves storing pictures of customers, a solution must be found to install the monitor in such a way that it can be seen by staff but not by members of the public.
If local circumstances make it impossible to control access in any other manner, the customer's picture may be displayed briefly (only for a few seconds) alongside a random ticket number for verification purposes in a public area. Nevertheless, the monitor must be set up right next to the control point and should not be visible to all the persons standing in the queue. By virtue of the proportionality principle, it is not acceptable to display surnames, first names, dates of birth, or any other data.
When personal data are collected, customers must be provided with accurate information about the type of data processing involved and its purpose.
[July 2004]