The long-awaited Presidential Decree no. 75 regulating the use of surveillance systems in public spaces has been finally published on 10.9.2020 (G.G. 173/10.9.2020). This Presidential Decree has been issued following the article 14 of Law 3917/2011, and applies in all surveillance systems (video and/or audio-recording or monitoring) installed in public spaces, to the extent that they process personal data.
The legislator has opted for a technologically neutral definition of surveillance systems, which includes all systems and regardless of technical specifications, of whether they use analog or digital technology, if they have fixed, rotating or mobile cameras, etc., so that all relevant technologies can be included therein. This Presidential decree sets down the terms and conditions for the installation and the operation of surveillance systems in public spaces. It also specifies the competent state authorities, procedures and circumstances of surveillance and criteria for compliance with the principle of proportionality. The operation of surveillance systems in public spaces is permitted only for specific purposes mentioned in art. 14 of Law 3917/2011 and art. 3 of this Presidential Decree (national defense, public security - suppression of specific crimes mentioned in the Greek Penal Code, and traffic management) and competent data controllers for such operations are exclusively the following state authorities: Hellenic Police, Fire Brigade and Port Police - Coast Guard. Greek prosecutor has a major role in the operation of surveillance systems in public spaces, since it is the competent authority for safeguarding the legitimate operation thereof in compliance with the present Decree.
The installation of cameras in public spaces is permitted only when such processing activity is strictly necessary for achieving one of the aforementioned purposes. With respect to the prevention and suppression of criminal acts, the operation of surveillance systems is permitted "only in areas where there is sufficient evidence that criminal acts are expected to be committed". Such sufficient evidence is justified by the factual circumstances such as, "in particular, statistical or empirical data, studies, reports, testimonies and information on the frequency, type and specific characteristics of the crimes committed in a particular area and information on the possibility of spread or transfer of the criminal acts to another public space". In light of the above, surveillance is deemed necessary when a reasonable belief is established that there are serious public safety hazards in the specific area; the surveillance cannot be extended in a wider area.
In addition, the Presidential Decree regulates some specific circumstances concerning the operation of surveillance systems of public spaces, which are as follows:
- The operation of portable surveillance systems is allowed only in cases where there is an immediate and serious risk of commission of the crimes referred to in article 3 of the Presidential Decree;
- Zoom functionality of surveillance systems is permitted only for the identification of crimes and under specific circumstances. Again, the approval of the competent prosecutor is necessary for the legitimate operation of cameras with zoom functionality;
- On public gatherings, cameras may be used upon approval of the competent prosecutor and notification of the entity that organizes such gathering. Such operation is legitimate insofar as it is used only for the specific purposes mentioned hereabove and under the condition that the cameras do not focus on people.
Furthermore, the Decree provides for a general prohibition of the processing of audio data in so far as it contains identifiable data. Exceptionally, audio data may be processed upon reasonable decision of the data controller for the sole purpose of identifying persons involved in criminal acts, the investigation of which is impossible or substantially difficult without the processing of audio data. Such decision explicitly mentions the specific circumstances that justify the collection of audio data and is submitted for approval before the competent prosecutor. At this stage, it is highlighted that the Hellenic Data Protection Authority has already mentioned in its Opinion 3/2020 on the use of CCTV and audio recording in public spaces the issues of compatibility that arise between this provision and the constitutional right of privacy of communication.
When an installation and/or operation of a surveillance system is legitimate?
Only upon issuance of the decision on the installation and/or operation of the surveillance system(s), which is notified to the competent prosecutor and contains all necessary information related thereto (i.e. location of cameras, scope of operation, characteristics of surveillance system, justification, etc.). On the one hand when referring to the installation of a surveillance system, the decision is valid for three years and thereafter is subject to reassessment. On the other hand, the decision on the operation of a surveillance system in public spaces is valid only for the specific duration mentioned therein, which can be extended following a new, specially reasoned decision. Besides, an additional transparency obligation is imposed for the decision on the operation of surveillance systems: it has to be communicated to the public by any appropriate means, and in particular with informative signs, as well as with a respective informative note on the website of the data controller.
Both decisions on the installation and /or on the operation of surveillance systems have to be accompanied by the respective DPIAs. Such decisions can be challenged by application for annulment before the Council of State.
Lastly, this Decree contains specific provisions on data recipients, data subject rights, data retention period, and it provides for some minimum technical and organizational measures that data controllers are bound to apply. Regarding the latter provision, it is noted that this is the first time that the national legislator makes reference to specific technical and organizational measures, which must be applied at a minimum.
In overall terms, this Presidential Decree fills a significant gap in the national legal framework on data protection, given that the operation of cameras in public spaces remained for many years unregulated regardless the great impact that it causes on the privacy rights of citizens. As regards the question whether it can efficiently protect personal data and strike a fair balance between the operation of the enforcement authorities and the privacy of citizens, it remains to be assessed in practice.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.