Video Surveillance and Video Protection: What Are the Differences and Legal Obligations?

Introduction

The security of people and property is a major concern for both private and public organizations. In this context, camera systems are widely deployed to prevent incidents and facilitate the identification of potential disputes or unlawful acts.

However, it is important to clearly distinguish between video surveillance and video protection, as they are governed by different legal frameworks and involve specific obligations relating to the protection of personal data.

Video Surveillance and Video Protection: A Difference in Context

Video protection systems apply to areas open to the public and public spaces, whereas video surveillance systems apply to areas that are not accessible to the public.

A system will be considered video protection if it is installed, for example, in a street, railway station, shopping centre, commercial area, swimming pool, public entry and exit areas, counters or checkout areas.

Conversely, a system will be considered video surveillance if it is installed in locations such as a store stockroom, warehouses, a private residential complex, storage areas or employee-only workspaces, such as the bakery production area of a bakery.

Who Is Allowed to Record and in Which Areas?

Public roads may only be monitored by public authorities, such as local municipalities, in the circumstances provided for by the applicable regulations.

Companies and public institutions may only monitor the immediate surroundings of their buildings and may not record public streets.

Public authorities and certain private legal entities, particularly retailers, may install cameras in publicly accessible areas exposed to specific risks.

Private individuals may only monitor the inside of their own property and must not capture footage of public roads.

Discover the compliance services offered by DPO Consulting’s Public Sector & Associations division

Similar Objectives but Different Legal Frameworks

In both cases, the objective is to ensure the security of locations, people and property.

However, video protection is subject to more strictly regulated purposes, notably the prevention of threats to security in locations exposed to risks such as assault, theft or trafficking, as well as certain public security missions provided for under the French Internal Security Code, including the detection and recording of offences.

Formalities Applicable to Video Protection

In addition, specific formalities apply to video protection systems. Prior authorization must be obtained from the competent Prefect (or the Paris Police Prefect in Paris), following consultation with a departmental commission chaired by a magistrate. This authorization is valid for five years and can be renewed.

For public authorities, including municipalities, compliance with the RU-074 framework must also be declared in advance where applicable.

By contrast, private legal entities such as retailers, businesses and operators of private sites are not required to seek authorization from the CNIL before implementing a video protection system.

What Are the Obligations Toward Individuals Being Recorded?

Individuals being recorded must be informed clearly and visibly through signs displayed permanently before entering the monitored area.

These notices must be understandable by everyone and include at least:

• a camera pictogram;
• the identity of the controller responsible for the system;
• the retention period of the recordings, particularly for video surveillance systems;
• the purposes of the processing;
• information on the rights of data subjects.

The Second Layer of Information

If all required information cannot be displayed on the sign, a second layer of information must be made available, for example through a privacy notice, QR code, website address or information sheet available on site.

This second layer should specify in particular:

• the legal basis for the processing;
• the recipients of the data;
• the contact details of the controller or Data Protection Officer (DPO);
• the possibility of lodging a complaint with the CNIL;
• how individuals can exercise their rights.

How Long Can Images Be Retained?

The retention period for recordings must be proportionate to the purpose pursued.

As a general rule, a few days are sufficient to investigate an incident or carry out a verification, although the maximum retention period may reach up to 30 days depending on the circumstances.

For video protection systems, the retention period is determined in the Prefectural authorization and may not exceed one month.

Who Can Access the Recordings?

For both video surveillance and video protection systems, access to recordings must be restricted to authorized personnel only. These individuals must be made aware of the rules governing the system.

Video protection is subject to stricter requirements. Only individuals specifically authorized under the Prefectural authorization may view recordings as part of their duties, with enhanced security measures in place and a mandatory access log.

Conclusion

Video surveillance and video protection share the same objective of security but apply to different contexts and are governed by different legal requirements.

It is therefore essential to correctly classify the intended system in order to ensure compliance with applicable regulations, particularly with regard to the GDPR, the French Internal Security Code and CNIL guidance.

Looking to implement or audit a video surveillance or video protection system? Book an appointment with one of our experts