Article
Personal Data Protection Act (Zakon o varstvu osebnih podatkov, ZVOP-2), Articles 76-7
Description
The Personal Data Protection Act (ZVOP-2), issued on 27 December 2022, stipulates the procedure and rules on video monitoring and biometric data collection for businesses.
First, the authorised person must issue a written decision on the use of video surveillance, detailing the reasons. Second, the domain under video surveillance must be clearly designated by a written or graphic description that alerts the subject to the fact that they are being watched. According to Regulation (EU) 2016/679, such notice must include information on the controller, the reasons for surveillance, data processing, and unusual additional data processing (for example, data transfer to third-country entities or live monitoring). However, rather than a full notification, a webpage link (URL and QR code) is adequate. Video surveillance is not permitted in elevators, restrooms, dressing rooms, or hotel rooms. The controller must document all access to and use of surveillance data. In commercial buildings, 70% of owners must approve of the surveillance before its introduction.
The following reasons may justify video monitoring of business premises access: (1) the security of people and property, (2) control of entry to those premises, or (3) the risk of injury to employees due to the nature of their employment. Monitoring should not cover other buildings, for instance, residential houses. Access surveillance may comprise a written record of names, addresses, employments, number of identity documents, and the purpose of the visit, in addition to CCTV data (picture, date, time, and, in exceptional cases, sound).
Within work premises, video surveillance is allowed only on the grounds of (1) security of persons and property, (2) prevention and detection of offences in gambling or (3) protection of confidential information. Surveillance must be limited and should not cover workplaces where employees usually work unless necessary for one of the three reasons. Only controller’s authorised employees can perform direct monitoring.
The employer must notify workers about video surveillance in advance. Before its introduction, the employer must consult the company trade union and works council (or workers’ representative). The consultation should occur at least 30 days before it. If monitoring is to cover workplaces, the consultation must occur at least 60 days before. National security issues and gambling are excluded from the obligation to consultation.
The Information Commissioner issued instructions on the proper use of surveillance at the workplace in the face of the collision of the employee's right to privacy and the right of the owner to property. Surveillance must be proportionate, and it is not allowed to survey employees during the work process because the employer is, for example, afraid of theft. In this case, surveillance monitoring is more necessary during employee absence since stealing is more likely to occur at that time. It is neither possible (and even prohibited) to monitor employees for research purposes or mystery shopping, either directly or by authorising a third party. For monitoring people, one may be criminally liable for breaching human rights to personality, personal and family life.