Security cameras: privacy duties and legality

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Did you install a camera at the office entrance? In a store? On the production line? Before you go on, Israeli law requires several things of you. Not complying with them can lead to fines, to evidence being excluded in court, and to privacy claims by employees. The story does not end with a “filming in progress” sign. That is only the beginning.

When are security cameras “processing of personal data”, and why does it matter?

Security cameras (CCTV, closed-circuit television) record images and video that identify people, so they are considered a means of processing personal information under the Protection of Privacy Law, 5741-1981. Section 2 of the Law states that “invasion of privacy” includes, among other things, filming a person while they are in a private domain (section 2(3)) and publishing their photograph in public in circumstances where the publication could humiliate or degrade them (section 2(4)). The data collected by cameras (images, video, location, time) is “information” as the Law defines it.

In principle, Israeli law allows the use of security cameras for legitimate security needs. But it requires a balance between the security interest and the constitutional right to privacy in section 7 of Basic Law: Human Dignity and Liberty. Breaching this rule can expose the owner of the installation to a civil claim and to enforcement by the Privacy Protection Authority.

How, and to whom, must an employer give notice before installing cameras in the workplace?

An employer who wants to install cameras in the workplace must notify the employees in advance, clearly and explicitly. This notice should state where the cameras are, the purpose of the filming and how long the recordings are kept. Under Privacy Protection Authority guideline 5/2017, the employer must set a clear and detailed policy on how the cameras are used, its scope and its purposes, as far as possible after consulting the employees or their representatives. The employer must display the policy to them on an ongoing basis.

For cameras in a public space (a building entrance, a store, a parking lot), the duty to give notice is usually met by a clear sign at the entrance to the filmed area. Under Privacy Protection Authority guideline 4/2012, the sign should preferably include a camera symbol, the name of the responsible organization, a short description of the purpose of the filming and a way to make contact. The Protection of Privacy Regulations (Data Security), 5777-2017, regulate the security of the databases created from the footage. Among other things, they require the purposes of using the information to be defined, and a check once a year of whether more information is kept than necessary (regulation 2).

Where may security cameras be placed in the workplace, and where not?

The Privacy Protection Authority has set clear limits on the use of security cameras in the work environment. Filming in toilets and changing rooms is a serious invasion, and it is hard to imagine an interest that could justify it. Also, in a room or workstation that is not open to the public, the employee is entitled to expect a private space without constant monitoring (Authority guideline 5/2017). In the work area itself, a camera can be legitimate for a defined purpose: security, protection of property, data security and even supervision of discipline and quality of service. This is subject to the proportionality tests, and the footage may not be used for a purpose beyond the one set in advance.

Cameras with a microphone (recording conversations) are also subject to the Wiretap Law, 5739-1979 (חוק האזנת סתר, התשל״ט-1979). It prohibits listening to or recording another person’s conversation without the consent of any of the parties to it (sections 1–2 of the Law). Breaching this prohibition is a criminal offense. So a camera that picks up conversations of employees to which the employer is not a party requires a legal review in advance.

How long may the videos be kept?

The Protection of Privacy Law has no express provision setting a binding period for keeping CCTV recordings. However, keeping footage after it is no longer needed goes against the principle of purpose limitation. Regulation 2(c) of the Protection of Privacy Regulations (Data Security) requires a check once a year of whether more information is kept than necessary. Under Privacy Protection Authority guideline 4/2012, the retention period is set case by case by the proportionality tests, according to the camera’s purpose and the sensitivity of the information. It is recommended to set automatic deletion at the end of the period.

If a security incident happens that requires keeping the recording for an investigation, the retention period can be extended for the relevant recording only. When it is no longer needed, the data must be deleted permanently and irreversibly. The owner of an installation who stores recordings without a time limit and without justification could be considered to be breaching the Protection of Privacy Law.

Can an employee demand to see the video of themselves?

Under section 13 of the Protection of Privacy Law, every person has a right to inspect personal information about them stored in a database. From this comes the right to ask the owner of the security cameras to view a recording in which you appear. When other people appear in the footage, Privacy Protection Authority guideline 4/2012 suggests blurring them, or allowing viewing on site without handing over a copy. In a database of recordings with no retrieval by the identity of the people filmed, and kept for no more than 30 days, access will usually not be required.

If the owner of the installation refuses to allow inspection without justification, you have two routes. You can file a complaint with the Privacy Protection Authority. You can also appeal against the refusal to the Magistrates’ Court within 30 days of the refusal notice (regulation 8 of the Protection of Privacy Regulations on inspection of information). Note: the right is to inspect information about the person asking, not information about other people.

Example: the timeline of a request to view a recording

On 1 March, the owner of the cameras received a written request from an employee to inspect footage in which she appears, a request to which the right of access applies:

• If he refuses, he must notify her by 22 March, within 21 days of receiving the request (regulation 5(a)). If he has not replied by then, the silence counts as a refusal notice (regulation 5(b)).
• If he agrees, the inspection must take place by 31 March, within 30 days of receiving the request (regulation 2(a)).
• A refusal can be appealed to the Magistrates’ Court in whose jurisdiction the database is located, within 30 days of the refusal notice (regulation 8).

The camera owner’s deadlines can be extended by another 15 days, for a particular matter or a particular database (regulations 2(a) and 5(a) of the Inspection Regulations).

What happens if footage from security cameras was leaked or used without authorization?

If CCTV recordings were leaked or distributed without consent (to social media, to third parties or unlawfully to authorities), the owner of the installation and whoever caused the leak could be liable. The liability is under the Protection of Privacy Law and the Torts Ordinance [New Version]. The person filmed is entitled to sue for “invasion of privacy” under section 4 of the Law, to which the provisions of the Torts Ordinance apply. If the publication could humiliate or degrade, there might also be a cause of action under the Prohibition of Defamation Law, 5725-1965.

If the leak of the recording caused proven financial damage, such as dismissal, loss of customers or harm to a business, the damages could be much higher. In addition, a willful invasion of privacy in some of the ways listed in the Law is an offense (section 5 of the Protection of Privacy Law). Publishing a photograph or film that focuses on a person’s sexuality, without their consent and in circumstances that could humiliate them, could also be sexual harassment (section 3(a)(5a) of the Prevention of Sexual Harassment Law).

Do the data security and privacy rules apply to a government ministry in the same way as to a private body?

Government facilities and public authorities (government ministries, public hospitals, local authorities) are subject to the Protection of Privacy Law and to the Protection of Privacy Regulations (Data Security), 5777-2017. Among other things, these require management of access permissions, and control and documentation of access to the database (regulations 8 and 10). Also, a database whose controller is a public body must, as a rule, be registered, unless it includes only information about the body’s employees (section 8A(a)(1)(b) of the Law).

A government facility that receives a demand from the police or an authorized investigating body to hand over a recording must hand it over within the time set in the order. Beyond this, passing on personal information by a public body, including a recording, is generally prohibited. The exceptions are the consent of the person filmed, information that was lawfully published, or the exceptions in section 23C of the Law (section 23B).

5 steps to installing security cameras lawfully

1. Assess the need: before installing, make sure that cameras are the least intrusive means and that there is a real security need.
2. An open policy for employees: before switching on, a written and detailed policy on where the cameras are, their purposes and the extent of use. It is set, as far as possible, after consulting the employees, and displayed to them on an ongoing basis.
3. Signs in public spaces: a clear sign at the entrance to the filmed area, with the name of the responsible organization, the purpose of the filming and a means of contact.
4. A written retention policy: an internal document that sets out the camera locations, the purposes of the filming and how long the recordings are kept, set according to the camera’s purpose and the proportionality tests.
5. Access control: only people with defined authorization can view the recordings, with an access log (who saw what, and when).

Hidden cameras: prohibited as a rule, with very narrow exceptions

Hidden cameras in the workplace are prohibited as a rule. Under Privacy Protection Authority guideline 5/2017, hidden cameras must not be installed in areas where the employee has a right to a private space, even for a legitimate purpose. Covert filming in the internal areas of the workplace will be possible only in very exceptional circumstances: a real suspicion of serious offenses that cannot be prevented in any other way. Even then, it must be targeted and limited in time and in the area covered. In addition, if the hidden camera records conversations, it also breaches the Wiretap Law and could be a criminal offense.

Material obtained through an invasion of privacy cannot be used as evidence in court without the consent of the person harmed, unless the court allowed its use for reasons to be recorded (section 32 of the Protection of Privacy Law). An employer who based an employee’s dismissal on covert footage without notice could find that the evidence is inadmissible and be exposed to a claim.