February 2024 – The use of body cameras by law enforcement (both police forces and local government) and private security services started almost two decades ago and has been becoming more and more ubiquitous globally.
It is of course a challenge in terms of privacy, as it is not only a relatively new technology where the social discourse has not had the time to form a common societal position, but it is also very invasive as in most cases people interacting with the wearer do not have the choice to use or not use the camera system.
National and international authorities are just starting to form their opinion and issue guidelines on the use of body cameras, that is why it is notable that the Hungarian data protection authority (National Authority for Data Protection and Freedom of Information) (the “Hungarian DPA”) has adopted recently both a guideline and an enforcement decision on this subject.
The guidelines cover the use of body cameras by parking lot attendants (i.e. individuals who are not members law enforcement). This subject poses specific challenges to local privacy laws as the number of violent incidents against parking lot attendants is rising, yet the rules of surveillance in public areas are very strict.
The Hungarian DPA has established that parking lot attendants cannot use body cameras as part of any law enforcement activities (such as crime prevention) and they cannot continuously use it to monitor their employees as it violates their human dignity.
Based on Hungarian constitutional law precedents, the purpose of protection of life and health of the data subject is only acceptable if the danger concerning life and health actually exists, is imminent and not a mere possibility.
Finally, the Hungarian DPA reviewed the possible alternatives of the processing and concluded that the use of body cameras by parking lot attendants is compliant with neither the principle of proportionality, nor the principle of necessity and, therefore, is illegal.
In the enforcement decision, the Hungarian DPA investigated a complaint lodged by taxi drivers against a Hungarian airport. Taxi drivers argued that the data controller failed to properly communicate to data subjects the usage of body camera by security guards. In summary, the Hungarian DPA concluded the following:
- Consent (which was not the only legal bases) cannot serve as legal basis.
- Data minimization permits allows recording sounds in order to establish the communication between the security guard and the recorded person and to evidence that the security guard proceeded lawfully in the given situation. The Hungarian DPA highlighted that the non-continuous usage of the cameras (the security guards only turned the cameras on, when certain requirements were met).
- Transparency requires the same multi-level information provision that is required in case of CCTV systems (brief, but noticeable alert in the immediate area, like a pictogram and a traditional written privacy policy that is available nearby).
Although the regulation of body cameras is in its infancy, these decisions contain elements that will be most likely foundational rules for the future.