Can we film our premises and grounds?

Video surveillance is usually based on legitimate interest, so a balancing test is carried out before it starts: what the interest is, whether other measures are not sufficient, and whether the interest does not outweigh people's rights. The written test is the main document requested in the event of a dispute.

Monitoring employee behaviour or performance as a purpose almost always fails the balancing test. If the cameras are aimed at workstations, you need a very strong reason and, usually, a different solution altogether.

Zones are drawn so that someone else's property, the street, or a neighbour's windows do not end up in frame. Filming public space is allowed only in exceptional cases and only to the extent necessary for security right at the site.

Cameras must never be placed in rest areas, changing rooms or sanitary facilities: people reasonably expect privacy there. Where video is recorded at the workplace or in premises where employees work, those employees must be informed against signature, or in another way that proves they were informed (Article 5(4) of the Lithuanian Law on Legal Protection of Personal Data, ADTAĮ), and camera monitoring of employees is on the list of processing that requires a data protection impact assessment (order of the State Data Protection Inspectorate No. 1T-35 of 14 March 2019, point 10).

Write down who has access to the footage, how each review is logged, and to whom a recording may be passed on. In practice, it is uncontrolled access, not the cameras themselves, that causes the most problems.

A notice sign is posted at the entrance to the monitored area with the essential information: that surveillance is in operation, who the controller is, and where to find the full notice. The full notice can be on the website or available from the administrator.

If the surveillance is intensive, covers a large number of people, or a publicly accessible area, a data protection impact assessment may be needed before you start. Video surveillance is the most common case where this assessment is genuinely required.

Video surveillance is described in the record as a separate process: purpose, the legitimate interest basis, the zones monitored, the categories of subjects, the retention period for footage, access rights, the surveillance service provider, and whether the footage is passed on to anyone.

The internal policy describes day-to-day practice: who may review a recording, on what basis, how the review is logged, how a recording is preserved if needed for an investigation, and how it is deleted. Two pages are enough, but they have to match reality.

Employees are informed about the surveillance separately, not only through the sign at the door. A signed acknowledgement is the simplest proof that the duty to inform has been fulfilled.