Use of Cameras in Retail Locations

These recordings can also contribute to a safer work environment through improved employee training. This includes the use of body-worn cameras for de-escalation and conflict resolution, as well as general surveillance systems to deter theft and improve security. While the objective of recording is to proactively address onsite concerns (equipment damage or dangerous activity) with intelligent detections, real-time alerts, and streamlined investigation, the data collected by these cameras contains personal information.

Improper use of these technologies and the data collected raises significant data privacy concerns necessitating compliance with regulations like the GDPR.

So, what do retailers and physical stores need to know about employing best practices around the use of CCTV and other augmented cameras?

The CNIL (French Data Protection Authority) recently released detailed guidance on the compliance requirements for retailers planning to deploy "augmented" cameras at self-checkout stations. These cameras are designed to detect errors or potential theft by analyzing video footage in real time. Positioned above the checkout area, they monitor the customer, their shopping basket, the scanning zone, and the area where scanned products are placed. Since individuals can potentially be re-identified from the footage, the system cannot be considered anonymous. Since the systems collect personal information, they must therefore comply with the General Data Protection Regulation (GDPR).

Retailers may invoke legitimate interest as a legal basis for using these systems, particularly to reduce revenue losses caused by errors or theft. However, the CNIL encourages the use of less intrusive alternatives, such as weighing scanned items before resorting to augmented cameras. If these alternatives prove insufficient, deploying smart cameras is not automatically prohibited, but it must be accompanied by strong safeguards to protect individuals’ rights.

These safeguards may include minimizing image capture to what is strictly necessary, providing clear and specific information through in-store signage and on-screen notices at the checkout, strict data retention and data usage limits, and where compliant with GDPR—potentially reusing collected data to improve the system’s algorithm.

The UK Information Commissioner's Office (ICO) has also provided guidance on the use of CCTV cameras in public places to ensure compliance with data protection laws. Many of the guidelines provided below are very similar to the guidance provided by CNIL.

Here are some key points and best practices shared by the regulators:

1. Data Minimization: Before deploying cameras, look for less intrusive alternatives and avoid collecting unnecessary data as much as possible. Any data collected by CCTV and other cameras should be necessary and proportionate to achieve specific purposes.

   
   

2. Purpose and Necessity: CCTV and other in-store camera footage should only be used for specific purposes disclosed such as crime prevention and public safety.

   
   

3. Transparency: Clear signage should be displayed to inform the public that cameras are in operation. This includes details about the purpose of the surveillance and contact information for the data controller.

   
   

4. Data Protection Impact Assessment (DPIA): Conducting a DPIA is recommended to assess the impact of CCTV and other in-store cameras on individuals' privacy and to ensure compliance with data protection principles.

   
   

5. Data Security: Measures should be in place to protect the recorded footage from unauthorized access, alteration, or disclosure.

   
   

6. Retention and Disposal: CCTV and other camera footage should be retained only for as long as necessary to fulfill its purpose and should be securely disposed of when no longer needed.

   
   

7. Individuals' Rights: People have the right to access their personal data recorded by the cameras and to request its deletion if it is no longer necessary.

   
   

8. Regular Review: The use of cameras should be regularly reviewed to ensure it remains necessary and effective.

   
   

These guidelines help ensure that the use of cameras in public places is lawful, fair, and respects individuals' privacy rights.