Personal Data Protection as a Civil Right
Among the central guarantees of modern civil rights is the protection of personal data. Article 4 of the Law on Personal Data Protection establishes the principles of processing: data must be processed lawfully, fairly, transparently for the subject and without violating their dignity. Data may be collected only for specific, clearly defined and legitimate purposes and processed only to the extent necessary. They must be accurate and, where necessary, kept up to date; inaccurate data must be corrected, erased or destroyed without unjustified delay. After the purpose is achieved, data must be erased, destroyed or stored in depersonalized form unless storage is determined by law. Appropriate technical and organizational measures must protect the data from unauthorized or unlawful processing, accidental loss, destruction or damage, and the controller must be able to demonstrate compliance with these principles.
Grounds for Processing and Special Categories of Data
Under Article 5, processing is permitted where a statutory ground exists: the subject's consent for one or more specific purposes; performance of a contract with the subject or steps prior to one at the subject's request; processing envisaged by law; performance of duties imposed by legislation; data made publicly available by law or by the subject; protection of vital interests; a significant public interest; the legitimate interests of the controller or a third party, unless the subject's interests, including those of a minor, prevail; or examination of the subject's application. The obligation to substantiate the ground rests on the controller. Article 6 governs special categories of data: processing is allowed only with the guarantees of the subjects' rights ensured and on one of the listed grounds, for example the subject's written consent, direct legal regulation, protection of vital interests where the subject cannot consent, or the sphere of health care. The burden of substantiation again lies with the controller.
The Legal Rules on Video Surveillance
Article 10 of the law regulates video surveillance. It is permitted to prevent and detect crime, for public security, the protection of a person's safety and property, the protection of a minor, secret information, examinations and testing, provided it is an adequate and proportionate means. The controller must define in writing the purpose and scope of monitoring, its duration, the storage period of recordings, and the rules of access, storage and destruction. Surveillance of an employee's work process or space is permitted only as an exception where the aim cannot be achieved otherwise. It is prohibited in changing rooms, hygiene areas and spaces with a reasonable expectation of privacy, and every instance of access to recordings must be logged. Surveillance of the common entrance and common spaces of a residential building is permitted with the written consent of more than half of the owners, and a clearly visible warning sign must display the controller's name and contacts.