Finnish Hospitality Association (MaRa) welcomes a possibility to provide comments on the matter. MaRa represents 2 800 member companies in the hospitality industry, with 7 700 outlets. MaRa represents a wide range of companies in the hospitality sector. The combined tumover of MaRa's members is over 80% of the total tumover of the hospitality sector in Finland.

MaRa's position

MaRa considers that guidelines presented diminish the legitimate interest of controllers who are using or plarming to use video surveillance in their premises. Guidelines do not take adequately account the positive effects that video surveillance has on safety, disturbance and crime prevention in working places and customer premises. The requirements for a sign (first layer) informing data subjects on video surveillance is excessive.

The guidelines presented go far beyond the intention of the legislator when drafting the General Data Protection Regulation (EU) 2016/679.

In Finland companies in hospitality sector use commonly video surveillan­ce. The purpose and ultimate goal is to guarantee safety for customers and staff, preventing crime and avoiding conflicts. Therefore a video surveillan­ce and data processed in connection to this is under the legitimate interest of the controllers.

MaRa considers it would be excessive to allow controllers to use video sur­veillance systems only in case an area is considered problematic (ie. high crime or disturbances ). The safety of the customers and the protection of business and staff should be prioritised.

In Finland it is a common practice that premises with video surveillance devices display a sign införming that there is a recording video surveillance in the premises. It is also required by a law. On the hasis of GDPR, infor­mation of data processing in recording video surveillance system to data subjects, shall be provided either in a document (if requested by the data subject) or through a digital source ( e.g. company's website ).

Legitimate interest

In accordance with the guidelines and the GDPR itself, video surveillance is lawful if it is necessary in order to meet the purpose of a legitimate inter­est pursued by a controller or a third party, unless such interests are over­ridden by the data subjects' interests or fundamental rights and freedoms (Article 6 (1) f). Video surveillance can also be regulated in national law. Legitimate interests pursued by the controller can be legal, economic or non-material interests. When data processing is based on legitimate interest, the data subject has according to Art. 21 right to ohjeet processing of his/her data in video surveillance recording system on grounds relating to his or her particular situation. If he/she objects, data related to him/her can be processed in video surveillance system only if there is a compelling legi­timate interest, which overrides the interests, rights and freedoms of the da­ta subject or för the establishment, exercise and defence of legal claims. MaRa agrees with these points.

MaRa strongly disagrees that there needs to be a "real and hazardous situ­ation" in order for the controller (=company using video surveillance) to be in the legitimate interest to use video surveillance and process personal data in video surveillance system. Prevention and security are crucial for the hospitality business. Therefore data controller should be allowed to use video surveillance to prevent any kind of violence, crime, disturbance ( e.g. theft, vandalism) that might occur in the premises or its imrnediate surroun­dings (e.g. where nightclubs security officers uphold an order). In addition, video surveillance might be of crucial importance, in case authorities are willing to investigate any kind of offences that can take place at the hospita­lity premises. These investigations might arise weeks after the incident so guidelines cannot take a too strict approach to a storage period.

MaRa stresses that GDPR does not require a legitimate interest to be stron­ger for the use of video surveillance when compared to other situations. People's safety should be treated as a priority. Controller should be free to use the video device in order to guarantee the safety of customers, the busi­ness itself and their staff.

National legislation in Finland on video surveillance

In Finland installing video surveillance in the work place is done following the "Act on Protection of Privacy in Working Life, 2004/759 ". In this case, the law states the purposes for which video surveillance can be used, the process that must be followed when installing system and in what areas video surveillance cannot be used (Section 16: Preconditions for camera sur­veillance & Section 17: "Transparency when implementing camera surveil­lance"). Law requires that prominent notification of the camera surveillan­ce is displayed in the areas in which the cameras are located.
In MaRa' s opinion video surveillance is clearly legitimated in establish­ments that authorities supervise ( e.g licensed premises, where alcohol is served). In these establishments, authorities can impose sanctions to com­panies if disturbances occur. Finnish alcohol law requires surveillance and maintenance of the order. Under these conditions, employers are responsi­ble for a safe working environment. Video surveillance can contribute to a safe working place.
Data subjects cannot argue that his/her right as a customer overrides the company's legitimate interest to prevent disturbances.
Finally, it is to be mentioned that people are subject to filming and photo­graphing in all kinds of public areas. On the basis of Finnish law people' s permission is not asked or required.

Transparency and information obligations

On the basis of transparency obligation MaRa agrees that data subjects must be informed on video surveillance. In hospitality establishments whe­re video surveillance has been installed, there is a visible sign införming da­ta subjects about the data processing activity: "e.g. video surveillance re­cording". MaRa strongly disagrees that in the sign itself information on da­ta controller and data processing purposes etc. needs to be provided (first layer). This is totally disproportional and a burden to the companies.

In case of recording video surveillance, the information document shall be provided to the customers, if they ask for it, at the premises or it can be ma­de available at the company' s website among other privacy policy material.

MaRa trusts that the Data Protection Board will take these comments into account, and change, accordingly, its preliminary guidelines on processing of personal data through video devices. Otherwise, the safety and security of customers, business and staff might be in danger.


Finnish Hospitality Association


Timo Lappi                                              Veli-Matti Aittoniemi

CEO                                                        Vice CEO