Upon receiving a set of questions from one of the city municipalities Bulgarian DPA has issued a thorough opinion regarding the admissibility of granting ongoing access in real time to the video recordings of the video surveillance system of the municipality to the city police department for the purposes of their tasks related to operational-search, security, investigation and prevention of crimes, as well as effective protection of public order and countering conventional crimes.
Upon detailed legal analysis the DPA has concluded that at the moment there is no legal basis under the applicable legislation for granting permanent, ongoing and unrestricted access to the video surveillance system of the municipality to the city police department.
The current regulatory framework allows the provision of only specific records or time-limited access related to the exercise of police powers only, incl. under conditions of urgency, as well as requested in due course, and the same is realized according to criteria such as e.g. date, time, location, etc. These criteria contribute to guaranteeing the principles of limitation of purposes and data minimization under Art. 5 of Regulation (EU) 2016/679, as well as meet the requirements for disclosure of data laid down in Rec. 22 of Directive (EU) 2016/680.
The video surveillance carried out by the municipality falls within the scope of Regulation (EU) 2016/679, while the processing of the data received by the authorities of the Ministry of Internal Affairs (the police departments), in their capacity as a competent authority within the meaning of Art. 42, para. 4 of the Personal Data Protection Act (PDPA) video recordings, falls within the scope of Chapter VIII of the Personal Data Protection Act, which transposes the requirements of Directive (EU) 2016/680 into Bulgarian legislation.
The municipality and the authorities of the Ministry of Internal Affairs (the police department) process the video recordings for different purposes and on different legal grounds, which determines their roles as independent data controllers. The legal relationship "controller - processor" in this hypothesis is inapplicable, since the authorities of the Ministry of Internal Affairs (police department) do not process the data from the video recordings by assignment and on behalf of the municipality, but process them for the needs of exercising their powers granted to them by law.
Article provided by INPLP member: Desislava Krusteva (Dimitrov, Petrov & Co., Bulgaria)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
