On 10 July 2019, the European Data Protection Board (EDPB) published draft guidelines on processing of personal data through video devices. The aim of the guidelines is to ensure the correct, consistent application of the EU’s General Data Protection Regulation (GDPR) in cases of video surveillance. The guidelines cover both traditional video devices and smart video devices. They were subjected to a public consultation.

The guidelines first clarify the scope of application. In this context, the GDPR does not apply to processing of data that has no reference to a person, e.g., in cases involving fake cameras, and also not to the processing of data by the competent authorities for law enforcement purposes (where the data protection Directive 2016/680 applies).

Other items addressed by the guidelines include:

• Lawfulness of processing;
• Disclosure of video footage to third parties;
• Rights of the data subject;
• Transparency and information obligations;
• Storage periods and obligations to erasure;
• Technical and organizational measures.

The guidelines may be further refined after the public consultation which ended on 9 September 2019. Guidelines for other GDPR-related areas will follow.