Request

GDPR

GDPR

The General Data Protection Regulation (GDPR) is a new regulation under European Union (EU) law regarding data protection and privacy for all individuals within the EU and individuals whose personal data is processed by EU-established organizations. The new regulation imposes new obligations on those who collect, store, and process such data. The GDPR went into effect in all EU countries on May 25th, 2018.

 

While the GDPR was not written expressly with video in mind, video is considered personal data of the subjects captured on camera, and therefore the regulation implies that those who own and operate video surveillance systems must carefully consider, document, and manage the privacy impact of their video surveillance systems.

 

Although technology (such as Avigilon Control Center (ACC) video management software) cannot itself be GDPR compliant, all technology providers must consider how their products and solutions can assist enterprises in deploying and operating a GDPR compliant system. Avigilon has taken care to ensure that its video security solutions include features and functionality that will support GDPR compliance.

 

This page provides a simple framework based on five basic principles of the GDPR to help support compliance of a Data Controller's video system. Additionally, it highlights the specific capabilities within Avigilon's video security solutions that will help enable an organization to be compliant.

 

5 BASIC PRINCIPLES OF THE GDPR

 

Privacy by Design

The GDPR mandates that privacy must be a priority throughout system design and commissioning. The approach taken with respect to data privacy must be proactive, not reactive. Risks should be anticipated and the objective must be preventing events before they occur.

 

Right to Access

Under Article 15, the GDPR gives individuals control over their personal data including the right to see that data.

 

Right to be Forgotten

Under Article 17, the GDPR gives individuals control over their personal data including the right to have their personal data erased if it is no longer necessary for the intended purpose of the system.

 

Security

The GDPR requires organizations have comprehensive policies and procedures ensuring personal data remains within control of the organization at all times. Additionally, personal data breaches must be reported within 72 hours to the competent supervisory authority appointed by their country’s government.