Finnish Hospitality Association (MaRa) welcomes a possibility to provide comments on the matter. MaRa represents 2 800 member companies in the hospitality industry, with 7 700 outlets. MaRa represents a wide range of companies in the hospitality sector. The combined tumover of MaRa's members is over 80% of the total tumover of the hospitality sector in Finland.
MaRa's position
MaRa considers that guidelines presented diminish the legitimate interest of controllers who are using or plarming to use video surveillance in their premises. Guidelines do not take adequately account the positive effects that video surveillance has on safety, disturbance and crime prevention in working places and customer premises. The requirements for a sign (first layer) informing data subjects on video surveillance is excessive.
The guidelines presented go far beyond the intention of the legislator when drafting the General Data Protection Regulation (EU) 2016/679.
In Finland companies in hospitality sector use commonly video surveillance. The purpose and ultimate goal is to guarantee safety for customers and staff, preventing crime and avoiding conflicts. Therefore a video surveillance and data processed in connection to this is under the legitimate interest of the controllers.
MaRa considers it would be excessive to allow controllers to use video surveillance systems only in case an area is considered problematic (ie. high crime or disturbances ). The safety of the customers and the protection of business and staff should be prioritised.
In Finland it is a common practice that premises with video surveillance devices display a sign införming that there is a recording video surveillance in the premises. It is also required by a law. On the hasis of GDPR, information of data processing in recording video surveillance system to data subjects, shall be provided either in a document (if requested by the data subject) or through a digital source ( e.g. company's website ).
Legitimate interest
In accordance with the guidelines and the GDPR itself, video surveillance is lawful if it is necessary in order to meet the purpose of a legitimate interest pursued by a controller or a third party, unless such interests are overridden by the data subjects' interests or fundamental rights and freedoms (Article 6 (1) f). Video surveillance can also be regulated in national law. Legitimate interests pursued by the controller can be legal, economic or non-material interests. When data processing is based on legitimate interest, the data subject has according to Art. 21 right to ohjeet processing of his/her data in video surveillance recording system on grounds relating to his or her particular situation. If he/she objects, data related to him/her can be processed in video surveillance system only if there is a compelling legitimate interest, which overrides the interests, rights and freedoms of the data subject or för the establishment, exercise and defence of legal claims. MaRa agrees with these points.
MaRa strongly disagrees that there needs to be a "real and hazardous situation" in order for the controller (=company using video surveillance) to be in the legitimate interest to use video surveillance and process personal data in video surveillance system. Prevention and security are crucial for the hospitality business. Therefore data controller should be allowed to use video surveillance to prevent any kind of violence, crime, disturbance ( e.g. theft, vandalism) that might occur in the premises or its imrnediate surroundings (e.g. where nightclubs security officers uphold an order). In addition, video surveillance might be of crucial importance, in case authorities are willing to investigate any kind of offences that can take place at the hospitality premises. These investigations might arise weeks after the incident so guidelines cannot take a too strict approach to a storage period.
MaRa stresses that GDPR does not require a legitimate interest to be stronger for the use of video surveillance when compared to other situations. People's safety should be treated as a priority. Controller should be free to use the video device in order to guarantee the safety of customers, the business itself and their staff.
National legislation in Finland on video surveillance
In Finland installing video surveillance in the work place is done following the "Act on Protection of Privacy in Working Life, 2004/759 ". In this case, the law states the purposes for which video surveillance can be used, the process that must be followed when installing system and in what areas video surveillance cannot be used (Section 16: Preconditions for camera surveillance & Section 17: "Transparency when implementing camera surveillance"). Law requires that prominent notification of the camera surveillance is displayed in the areas in which the cameras are located.
In MaRa' s opinion video surveillance is clearly legitimated in establishments that authorities supervise ( e.g licensed premises, where alcohol is served). In these establishments, authorities can impose sanctions to companies if disturbances occur. Finnish alcohol law requires surveillance and maintenance of the order. Under these conditions, employers are responsible for a safe working environment. Video surveillance can contribute to a safe working place.
Data subjects cannot argue that his/her right as a customer overrides the company's legitimate interest to prevent disturbances.
Finally, it is to be mentioned that people are subject to filming and photographing in all kinds of public areas. On the basis of Finnish law people' s permission is not asked or required.
Transparency and information obligations
On the basis of transparency obligation MaRa agrees that data subjects must be informed on video surveillance. In hospitality establishments where video surveillance has been installed, there is a visible sign införming data subjects about the data processing activity: "e.g. video surveillance recording". MaRa strongly disagrees that in the sign itself information on data controller and data processing purposes etc. needs to be provided (first layer). This is totally disproportional and a burden to the companies.
In case of recording video surveillance, the information document shall be provided to the customers, if they ask for it, at the premises or it can be made available at the company' s website among other privacy policy material.
MaRa trusts that the Data Protection Board will take these comments into account, and change, accordingly, its preliminary guidelines on processing of personal data through video devices. Otherwise, the safety and security of customers, business and staff might be in danger.
Respectfully,
Finnish Hospitality Association
Timo Lappi Veli-Matti Aittoniemi
CEO Vice CEO