CCTV in your building: where cameras may point, how long you keep it

Footage from the entrance camera expires faster than the milk in the fridge. An association that installs a system hoping to build an archive, just in case something happens one day, tends to find out late that the European standard points the other way: one or two days is the norm, and beyond 72 hours you must be able to explain in writing why the recordings are still there. That threshold comes from the Guidelines 3/2019 of the European Data Protection Board, the document that harmonises how the General Data Protection Regulation applies to cameras across the eleven countries where you are reading this. And it is only one of four decisions worth getting right: where the cameras point, how long footage is kept, what the sign says, and who may watch.

The camera in the hallway is nobody's private business

The Regulation carves out an exception for what each of us does in a purely household context, and plenty of boards assume the building's camera falls inside it. It does not. In the Ryneš case the Court of Justice of the European Union made clear that a home camera which also captures the space outside is caught by data protection law, and a camera in common parts records, by definition, dozens of people going about their day.

Whoever decides why the recording happens and what is done with it is the association, acting as the controller. The firm that installs and maintains the system is not the controller: it is a processor, and that relationship needs a contract setting out what it may and may not do with the footage. If the engineer dips into recordings from the office without that framework, the exposure is not theirs.

The installation itself is approved at a general meeting, by whatever majority each country's law requires, and recorded in the minutes. That is not paperwork for its own sake: it is the first thing anyone asks for when a complaint lands.

Where the camera may point, and where it may not

The principle governing all of this is minimisation: record the least that serves the stated purpose. A camera installed after a run of break-ins in the car park may cover the entry ramp; the same camera turned towards a ground-floor window protects nothing and watches a family.

The limits most often crossed by accident:

• The door or windows of one particular home are off limits, even when that neighbour is the suspect
• Public street may appear only in the narrow strip needed to cover the entrance
• Areas where staff rest or eat are not monitored
• Audio needs its own justification and rarely has one: a camera does not need to hear in order to deter

No camera goes up simply because someone wants it.

The usual lawful basis is the association's legitimate interest, and the Guidelines require a real situation behind it (previous thefts, repeated vandalism, documented incidents) plus the absence of any less intrusive way to achieve the same end. Changing the lock or lighting the entrance properly comes first if that solves the problem. Put that reasoning in writing before installing: it is exactly what gets asked afterwards.

A note on the law: dummy cameras fall outside the Regulation altogether, since they process no personal data. Then again, they deter nobody who looks twice, and a sign presenting them as real can create trouble by other routes. If the association wants deterrence without recording, better to say so plainly.

How long the footage may be kept

This is where most systems breach the rules without knowing it, because the recorder the installer supplies ships configured to loop over a full month. The European criterion runs the other way: one or two days as a rule, and the longer the period, the heavier the argument needed to show it is still necessary.

The logic is straightforward. If nobody has reported anything within three days, that footage no longer serves the purpose that justified the camera; it is simply a log of your neighbours' movements waiting to leak. Automatic deletion when the period expires is not an optional nicety — it is how you demonstrate the system is set up properly.

When something does happen, the right move is to extract and preserve that specific sequence for whoever needs it, not to extend the retention period across the whole system because an incident occurred once.

The sign: what residents must know before they walk in

Information is given in two layers. The first is the sign, placed visibly before anyone enters the monitored area so they can decide whether to walk through it: who is recording, why, how long footage is kept and where to exercise their rights.

The second layer is the full information, which will never fit on a sign and has to sit somewhere reachable: the lawful basis, the exact retention period, who the processor is, whether footage is disclosed to the police and how to complain. A link, a QR code or the notice board all work; "the managing agent has it" does not.

Who may watch the recordings

Fewer people than most assume. Who gets access is decided by the association (the chair, the concierge, the managing agent or the security company) and that designation is worth recording in the minutes, like the rest of the system. Access to the viewer is not a perk of office: it is limited to the person designated, with their own login and, where the system allows, a log of every viewing. And even they do not watch the footage at will, only when there is a concrete reason: an incident, a crime, a police or court request. A chair who scrolls through footage out of curiosity is processing data with no lawful basis, and so is the neighbour who asks to see "who took the bins out last night".

Be careful with a screen at the concierge's desk: in several countries live viewing is reserved for accredited security personnel, and a monitor in anyone's sight turns a compliant system into an infringement. Before installing one, check what local rules require.

Anyone who appears in a recording may request a copy — but only of their own images, and the right is narrower than it sounds: they must provide the day and approximate time so the footage can be located, and if the retention period has already erased it, the correct answer is to confirm the deletion. When the sequence does exist, it is handed over with third parties obscured; and if they cannot be obscured without making the image useless, access can be limited, because a copy may never harm someone else's rights.

And the case everyone has in mind (seeing who scratched the car or who left a sofa next to the bins) is not a right of access at all: those images identify a third party and are handed only to the police or the courts. What the affected neighbour can ask is that the association extract the sequence and keep it for the authorities, not watch it themselves.

An association with well-planned cameras keeps four documents to hand: the resolution from the meeting, the reasoning for why cameras were necessary, the contract with the installer and the wording of the sign. With those, a complaint takes an afternoon to answer. Without them, the camera installed for peace of mind becomes the subject of the next argument in the hallway.

Information is up to date. This article is for general information only and does not constitute legal advice.