Introduction

The purpose of this article is to provide an overview of the regulations applicable when using camera surveillance in the workplace in Norway. The Norwegian data protection authority ('Datatilsynet') have written a guide on the subject, which is regularly updated and is entitled Camera Surveillance in the Workplace¹('the Guide'). Hence, in this article, we will cover the relevant laws and regulations and the Guide, and provide information on how to comply with the these in practice.

Camera surveillance in general

There are no general regulations on camera surveillance in Norway. However, everyone is entitled to respect for its private and family life under both the Norwegian Constitution, the EU Charter of Fundamental Rights, and the Norwegian Penal Code. Camera surveillance overlooking public areas or other's private property will, as a general rule, constitute a violation of the individual's right to privacy. However, pointing a camera at your own private property is generally allowed.

Additionally, the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') will apply if the camera surveillance captures identified or identifiable persons, and when such recordings are shared. In such cases, the operator of the surveillance must have a legal basis for processing personal data pursuant to Article 6 of the GDPR in order for it to be lawful. If the surveillance has the purpose of processing sensitive personal data, for example where the camera is pointed to a place inextricably linked to anything sensitive such as pharmacies, churches, or similar, an additional legal basis must be found in Article 9. The GDPR does not apply to surveillance performed by a natural person in the course of a purely personal or household activity.

The Section 31 of Law on the Processing of Personal Data (Personal Data Act) of 15 June 2018 ('the Personal Data Act') states that if the use of camera surveillance is not allowed under the GDPR or the Personal Data Act, neither are fake camera surveillance equipment or signs which gives a false impression that the area is under surveillance.

Specific regulation on camera surveillance in the workplace

Camera surveillance in the workplace is specifically covered by the Regulation on Camera Surveillance in the Workplace ('the Regulation'). The Regulation is short and does not regulate every aspect of employers' use of camera surveillance in the workplace and of employees.

Camera surveillance is defined in the regulation Section 1 of the Regulation:

The term "camera surveillance" refers to continuous or regularly repeated personal surveillance by means of a remote-controlled or automatically operating surveillance camera or other similar equipment that is permanently mounted. The term includes both surveillance with and without the possibility of recording audio and video material. The same applies to fake camera surveillance equipment or signs, notices or similar that give the impression that camera surveillance takes place.

The Regulation only applies if the camera surveillance is considered a so-called 'control measure' under Chapter 9 of the Employment Act, which is the collective term for certain measures implemented by an employer that affect the employees. Camera surveillance is normally considered a control measure, unless the surveillance does not, or to a very little degree, impose a burden on the employees' personal integrity. Thus, the camera surveillance triggers certain procedures that the employer must comply with.

The Regulation applies everywhere employees work, e.g. shops, offices, restaurants, and even where employees work remotely outside a permanent place of employment, e.g. in a company owned vehicle. The employees are also protected by the Regulation in cases where the camera is installed by those other than their employer, e.g. where the management of a mall has installed centralised cameras that monitor multiple shops and restaurants. In such cases, it is sufficient that the employer understands that such surveillance takes place, that the surveillance is in the employer's interest, and that the purpose (among others) is to monitor the employer's business.

Conditions to be met prior to commencing surveillance

According to Section 2 of the Regulation, any surveillance of the workplace must comply with Chapter 9 of the Employment Act and the Personal Data Act/GDPR. In practice, this means that the following conditions must be met:

• the employer must have a legitimate interest in the surveillance;
• the surveillance must be necessary in order to fulfill the legitimate interest; and
• the employer's interest must outweigh the employees' right to privacy and the right of others affected by the surveillance (balancing test).

Such assessment must be documented, and should be reviewed annually.

Legitimate interest and necessity

An employer may not implement camera surveillance as a precautionary measure. The fact that the surveillance must be necessary, means that the employer must have a specific interest in, and need for, such surveillance. Workplaces that are generally considered safe, without any specific risks of crime, may therefore normally not install camera surveillance. The fact that such surveillance is 'nice to have' is not sufficient under applicable Norwegian legislation.

This means that if an employer wishes to take camera surveillance in to use in case of crimes, such as robberies or thefts, the employer must substantiate that the surveillance is necessary based on previous incidents or due to the type of business operated. If it is unlikely that crimes will occur, there is no legitimate interest.

Camera surveillance may not be installed if the purpose with the surveillance may be reached with less privacy intrusive measures. The Guide suggests alternative measures, such as attentive staff, routines, access control, guards or alarm systems, or limiting the surveillance to a specific time of the day or on specific days.

Balancing test

The employer's interest in the camera surveillance must outweigh the possible privacy consequences of the employee. Several considerations should be taken into account:

• How important is the surveillance? Which interests are at stake? A high risk to the health and life of the employees will more easily outweigh the employees' interest.
• Which alternative, less privacy intrusive, measures may be taken?
• The total number of measures, including, but not limited to, the number of cameras and their location.
• Any measures to limit the intrusiveness (e.g. time limitations with respect to when the camera is active, restricting what the camera captures in its view, turning off audio recording etc.).
• The number of people (and who) having access to the cameras and to the recordings, and whether appropriate security measures have been implemented.
• Whether there has been any legitimate protests by the employees.
• Whether the employer may remotely view the recordings live (and thereby being able to control the employees), whether the recordings may only be accessed locally on request, or whether the recordings may only be viewed locally in real time.

Workplace areas where only a circle of people pass through regularly

According to Section 3 of the Regulations, additional conditions apply to workplace areas where only a limited circle of people pass through regularly. Such areas may only be surveilled if such surveillance is necessary to (i) prevent dangerous situations from occurring and to safeguard the safety of employees or others or (ii) there is otherwise a special need for surveillance.

The Regulation does not specify what 'an area where only a limited circle of people pass through' is.  According to the Guide, such areas are at least the employees' workstations, offices, checkout areas, warehouses, receptions etc. The amount of people that have access to these areas is not relevant, what is relevant is whether the circle of people is limited. A large amount of employees may for instance pass through a warehouse, but the Regulation will still apply as the circle of people is limited to employees. The parts of the workplace that are open to the public and/or to guests, such as waiting areas, eating areas or shop floors will not be covered by the Regulation. However, whether an area is only accessible to a limited circle of people may vary, based on the time of day, which day it is or the time of year.

The criteria for installing camera surveillance pursuant to Section 3 of the Regulation should be interpreted narrowly, as such surveillance represents a significant privacy intrusion. The purpose of the surveillance must generally be to safeguard the safety of the employees, protecting their health and life, and the security risk should be specific, as opposed to a general one. Examples are building sites or areas in businesses that are particularly vulnerable for robberies. Areas that are considered more private, such as break rooms, dressing rooms, bathrooms and elsewhere where the expectancy of privacy is high, may, as a main rule, not be monitored.

Notification of surveillance

Section 4 of the Regulation requires the employer to notify the employees and others of the following by means of signs:

• that the area is subject to camera surveillance;
• in the event that the surveillance includes audio recording, this shall be specified; and
• who the controller of the personal data is.

In addition, the employer must include information about the camera surveillance in the privacy notice pursuant to Article 14 of the GDPR.

Use and storage of recordings

Camera recordings may be stored if the outcome of the balancing test suggests so. As a main rule, the recordings may only be used for the purpose of which they have been collected. Consequently, recordings collected for security purposes may not be used to control or monitor the employees' performance. However, the recordings may in some circumstances be used for a different purpose if the conditions in Article 6(4) of the GDPR are met.

According to Section 6 of the Regulation, recordings may as a main rule only be stored for one week. If it is likely that the recording will be disclosed to the police for investigation purposes, the recordings may be stored for 30 days.

Recordings of banks or post offices or of areas using payment instruments (such as credit cards) or identity cards/passports, may be stored for a period up to three months.

Additionally, the Datatilsynet may grant dispensation in the event that a longer storage period is necessary.

Pursuant to Section 5 of the Regulation, the employer may only disclose the recordings to third parties in the following situations:

• if the person(s) on the recording consents to the disclosure in accordance with the GDPR;
• disclosure to the police during the investigation of criminal acts or accidents, if statutory duty of confidentiality does not prevent it; or
• if the disclosure is allowed pursuant to applicable law.

Fredrik Wiker Senior Associate
[email protected]
Line Helen Haukalid Managing Associate
[email protected]
Advokatfirmaet Wiersholm AS, Oslo

1. Only available in Norwegian at: https://www.datatilsynet.no/personvern-pa-ulike-omrader/personvern-pa-arbeidsplassen/kameraovervaking-pa-arbeidsplassen/