Camera surveillance – how to get it right from the start

Introduction

Many companies see a great need for camera surveillance to protect premises against burglary, prevent theft or ensure the safety of staff and customers. At the same time, many believe that camera surveillance is a simple solution that can be implemented without any special measures. However, CCTV surveillance requires careful consideration, including with regard to legal basis, proportionality, information provision and documentation. It is particularly sensitive when employees are being monitored.

With regard to the provision of information, it was previously common for information signs about camera surveillance to consist only of a simple camera symbol, without any further information, whereas today it is increasingly common to see correctly designed signs with more comprehensive information. Although awareness has increased, many people still lack knowledge about the rules that apply to camera surveillance.

In this article, we outline the requirements that apply to camera surveillance for private companies and the assessments and considerations that need to be made when a company is considering installing surveillance cameras.

CCTV surveillance – what is it and what applies?

All CCTV surveillance that, without being operated on site, is carried out in a manner that involves continuous or regularly repeated surveillance of persons in Sweden is covered by the provisions of the CCTV Surveillance Act. This is provided that the person carrying out the surveillance is established in Sweden or outside the EU/EEA.

Previously, in certain cases, a licence was required for camera surveillance, but since 1 April 2025, the licence requirement has been abolished. However, the fact that camera surveillance can be carried out without a permit does not mean that surveillance can be carried out freely by anyone who wishes to install a camera. The Camera Surveillance Act still contains requirements regarding, among other things, information about the surveillance, the obligation to negotiate with trade unions and confidentiality, which must be observed by all companies that carry out camera surveillance. In addition, camera surveillance often involves the processing of personal data, which means that those who conduct camera surveillance must comply with the rules of the GDPR and other applicable data protection legislation.

In the event of shortcomings in how camera surveillance is conducted, the Swedish Authority for Privacy Protection (IMY), which supervises camera surveillance, may, among other things, decide that a company that violates the rules should be subject to penalty fees.

CCTV surveillance and the GDPR

Legal basis and balancing of interests

Since CCTV surveillance, in the vast majority of cases, involves the processing of personal data, the provisions of the GDPR must be complied with. This means, among other things, that, as with all other processing of personal data, the processing must be based on a legal basis in order to be permitted. In private companies, where data of general interest is not processed, it is the legal basis of "balancing of interests" that is mainly relevant. For camera surveillance to be permitted, it must be necessary for a legitimate interest and that legitimate interest must outweigh the individual's interest in not being monitored.

In many cases, a legitimate interest may be security and crime prevention purposes, where, for example, the aim is to prevent burglary in a shop or to deal with problems of vandalism or disorder. However, it is important that camera surveillance is not used routinely. Instead, in most cases, it is necessary to be able to show that crimes or other incidents have occurred at the location in question. Pure speculation about what could potentially happen is rarely sufficient, nor is it sufficient to show that incidents have occurred in nearby locations. Typically, documentation is required showing what happened at the location in question and when. The more serious the incidents that have occurred, and the more frequently they have occurred, the greater the surveillance interest. However, particularly serious crimes may warrant greater surveillance interest even if they have occurred infrequently. The legitimate interest (surveillance interest) must then be weighed against the interest of the person being monitored in not being filmed (privacy interest). This assessment must be made before camera surveillance begins.

In order to weigh up the interests, it is necessary to determine in advance the purposes for which the camera surveillance is to be carried out. The purposes that have been determined also set the framework for the future surveillance. The material processed during camera surveillance may only be used for the purposes originally determined and may not subsequently be used for other purposes. This means that a company that has monitored a shop premises for the purpose of preventing shoplifting may not subsequently use the recorded material to monitor the work performance of its employees. In addition, the GDPR requires data minimisation, which means that camera surveillance may only be carried out to the extent justified by the purpose. The footage must not be stored longer than necessary, and the material must be handled securely.

Factors that may influence the assessments made include, for example, how many cameras are needed, where/how they should be placed, which areas should be monitored, on which days and at what times the cameras should be in operation, and what type of surveillance should be carried out (whether surveillance should only take place in real time or whether some storage should take place, and whether both sound and images should be recorded). It is also relevant whether technology that promotes the protection of individual privacy should be used. Surveillance must not be more extensive than is necessary to fulfil the purposes of the surveillance. If other, less intrusive measures have been taken previously without the desired result, this is also relevant.

Camera surveillance in shops can serve as an example of how the assessment can be made in practice. Shop areas and checkouts are generally considered to be crime-prone areas, which means that the interest in surveillance in such places often outweighs the interest in privacy. For areas behind the shop, such as warehouses and offices, the opposite applies – these areas are normally less prone to crime and therefore require stronger justification for surveillance to be considered permissible. Camera surveillance of changing rooms, fitting rooms, toilets or similar areas is typically not permitted. Furthermore, if the purpose of the surveillance is to prevent burglary, consideration should be given to whether the surveillance can be limited to the times when the shop is closed. If surveillance takes place during the shop's opening hours, consideration should be given to whether privacy-enhancing technology can be used, for example by masking faces in real time and only saving unmasked material in the event of incidents. The number of cameras and their location should also be adjusted so that surveillance is not more extensive than is necessary to achieve the intended purpose.

It is important that the assessments and considerations made for camera surveillance are documented and saved. In some cases, a special impact assessment is also required, looking specifically at the risks that may arise as a result of camera surveillance and how such risks can be minimised or managed.

Duty to provide information

Anyone who conducts camera surveillance must inform people that such surveillance is taking place on the premises. IMY recommends that the information be provided in various ways, via so-called information layers. The first layer consists of warning signs containing the most important information about the surveillance. The second layer, with more detailed information, can be provided in other ways. Such more detailed information should be provided in a non-digital format, for example physically in a central location in the premises being monitored, but can also be provided on a website. The warning signs posted on site should in any case include the following information:

• the purpose of the camera surveillance;

• the identity of the data controller;

• contact details for the data controller and its data protection officer, if any;

• information that those being monitored have rights under the GDPR;

• information that may surprise those being monitored, such as whether the surveillance material is stored outside the EU, long storage periods, real-time monitoring or whether sound is recorded;

• information on how long the material is stored; and

• information on where those being monitored can turn to for further information about the surveillance.

Supervision and sanctions

The assessment of whether camera surveillance is permitted is always made on the basis of an overall assessment of the circumstances of the individual case. It is therefore impossible to determine in advance individual situations in which camera surveillance is always permitted. It is IMY that reviews camera surveillance and decides whether the assessments and considerations made are correct. Among other things, IMY may decide that a company that violates the rules of the GDPR must pay an administrative penalty. The size of the penalty depends, among other things, on the type of violation in question and the company's global turnover.

In a number of cases, the IMY has imposed administrative fines on companies for non-compliance, including for failures to comply with the duty to provide information. Administrative fines have also been imposed for security breaches where companies have not taken appropriate measures to ensure an adequate level of protection for personal data in the form of image material.

Furthermore, in a number of supervisory cases, IMY has reviewed camera surveillance in apartment buildings, where camera surveillance is often used to prevent and investigate crime. Conducting camera surveillance to increase the safety and security of tenants, prevent and investigate crime, and protect property can often constitute a legitimate interest. However, IMY considers that camera surveillance in residential environments is, as a starting point, very sensitive from a privacy perspective, which is why special considerations need to be made. Camera surveillance that takes place inside the entrance or in the stairwell of apartments is generally considered to be particularly sensitive from a privacy perspective, as residents are monitored when they arrive at and leave their homes. IMY has only deemed camera surveillance in such locations to be permissible when there have been significant problems with crime in the property, such as drug dealing, theft and extensive vandalism.

Those who conduct camera surveillance have a responsibility to demonstrate that and how GDPR is being complied with. It is therefore important to consider these issues in advance and to carefully document the considerations made.

Special considerations regarding the surveillance of employees

Camera surveillance of areas where staff are present is particularly sensitive from a privacy perspective. It is therefore not permitted to routinely monitor employees to check how they are performing their duties. Instead, other compelling reasons are required for surveillance to be permitted. Camera surveillance of changing rooms, toilets and similar areas is, in principle, prohibited. It is also not normally permitted to use audio recording in conjunction with camera surveillance in the workplace, as this is also considered particularly sensitive from a privacy perspective.

The Camera Surveillance Act contains an explicit obligation to negotiate with the relevant trade union by referring to Sections 11–14 of the Act (1976:580) on Co-determination in the Workplace (MBL). This means that the employer must negotiate with the trade union representing the employees before the employer makes a decision on camera surveillance of the workplace.

When weighing up the interests to ensure that there is a legal basis for the surveillance, it should be taken into account that employees normally have a strong interest in not being camera-monitored in the workplace. This means that the employer must demonstrate strong reasons for the surveillance and that the problems cannot be resolved by less intrusive measures.

As with other camera surveillance, it is important to consider whether the purposes of the camera surveillance can be achieved even if the surveillance is limited. This can be done, for example, by directing the cameras so that workplaces where staff regularly spend time are excluded from surveillance, by limiting surveillance to certain times, or by using technology that masks or anonymises employees.

The scope for using consent as a legal basis for camera surveillance of staff is very limited. This is because there is an unequal balance of power between the employer and the employee in an employment relationship, which means that consent can rarely be considered to have been given voluntarily. As the employee is dependent on their job, it can be difficult for them to refuse surveillance without risking negative consequences. Consent that is not voluntary does not meet the requirements of the GDPR and therefore cannot constitute a valid legal basis for the processing.

Checklist for camera surveillance

Before starting camera surveillance, you should consider the following questions, among others:

✔ What are your purposes for the surveillance?

Camera surveillance may only be carried out for legitimate purposes.

✔ What legal basis do you have for the surveillance?

Identify your legal basis. In practice, the legal basis of "balancing of interests" is often relevant.

✔ How do you plan to conduct the camera surveillance?

Consider how many cameras are needed, where/how they should be placed, which areas should be monitored, during which times the cameras should be in operation and what type of surveillance should be carried out. The surveillance must not be more extensive than is necessary to fulfil the purposes of the surveillance.

✔ Does the camera surveillance involve monitoring employees?

Monitoring employees requires special consideration. As an employer, you may also have a duty to negotiate under the Swedish Co-determination in the Workplace Act (MBL). Initiate negotiations as early as possible and before camera surveillance begins.

✔ Do you need to conduct an impact assessment?

Consider whether camera surveillance could lead to a high risk for the individuals being monitored. If so, a special impact assessment needs to be carried out.

✔ How do you provide information about camera surveillance?

Provide clear information about camera surveillance. Put up signs with the most necessary information and supplement this with information in other appropriate ways.

✔ What material is stored and for how long?

Store less! Consider how you can limit the storage of material.

✔ Who can access the material?

Review security and consider who should have access to the material. Do you use suppliers who have access to the material in any way? If so, consider whether a data processing agreement needs to be drawn up.

✔ How do you protect the rights of those being monitored?

It is important to be aware of and have procedures in place for handling the rights of those being monitored in relation to those doing the monitoring.

✔ Document!

Document the considerations and assessments that are made.

Questions?

Do you need help with questions about camera surveillance or would you like advice on how to best comply with the Camera Surveillance Act and the GDPR? Feel free to contact one of us or your usual contact at Lindahl and we will help you!