On December 18, 2024, the Data State Inspectorate (DVI) issued guidance on the implementation of video surveillance systems in businesses in compliance with data protection laws. The DVI emphasized that the use of surveillance cameras constitutes personal data processing, requiring adherence to the General Data Protection Regulation (GDPR) and the Personal Data Processing Law. Furthermore, the DVI explained that the guidance aims to clarify the responsibilities of businesses regarding the lawful use of video surveillance.

To ensure lawful data processing when implementing video surveillance, the DVI provided several critical steps that must be followed:

• the purpose of data processing should be clearly established, typically focused on property protection and preventing criminal activities;
• a suitable legal basis for data processing must be applied, most commonly the pursuit of legitimate interests, as it is typically the most effective method for ensuring security;
• a balancing of interests test must be conducted to evaluate whether the benefits of video surveillance justify any potential infringement on the privacy of those being observed. This assessment is necessary to ensure that the surveillance aligns with both the company's interests and the rights of its customers; and
• appropriate technical and organizational measures must be implemented to secure the data, including responsible management, data encryption, restricted access to recordings, secure storage, and careful positioning of cameras within the premises.

The DVI concluded that its guidance serves as a comprehensive framework for businesses looking to adopt video surveillance while remaining compliant with data protection regulations, emphasizing that proper planning and execution are essential to avoid legal pitfalls.

You can read the press release, only available in Latvian, here.