Surveillance Activities

Question 1

When does the data protection impact assessment have to be completed?

Answer 1

• The video surveillance is considered to be high risk;
• it involves the systematic monitoring of a publicly accessible area on a large scale; or
  – if video surveillance has been included by the relevant supervisory authority on the list of data processing operations that requires a DPIA

Question 2

If the DPA indicates that the high risk cannot be sufficiently mitigated, for example, by siting of the cameras and setting the direction they point, what must the data controller do?

Answer 2

The data controller must consult with the supervisory authority prior to the use of the video surveillance. Where public interest is used as the lawful basis of processing, member states may make consultation with the supervisory authority mandatory, regardless of the mitigation (Article 36).

Question 3

What three broad categories of location data does Google use to deliver its services?

Answer 3

• implicit location info
• internet traffic info
• device-based location services