VIDEO SURVEILLANCE SYSTEM AND PERSONAL DATA

 1 Basic information

According to paragraph 7, article 4 of the General Data Protection Regulation*, IZUM is the controller of the filing system of personal data collected with video surveillance system procedures in IZUM.

Controller data:

  • Name and address: Institute of Information Science, Maribor, Prešernova ulica 17, Maribor
  • E-mail: podpora@izum.si
  • Director: Dr Aleš Bošnjak
  • Data Protection Officer (DPO): Dr Ema Dornik

Legal background to process personal data collected with video surveillance system procedures in IZUM:

  • Law regulating personal data protection in the Republic of Slovenia;
  • Rules on personal data protection in IZUM of 18 June 2021;
  • Decision to introduce video surveillance in IZUM of 13 March 2007;
  • Organisation and implementation of video surveillance in IZUM of 25 May 2018.

Personal data collected with the video surveillance system procedures in IZUM is collected in two filing systems, which are:

  • video filing system, which includes:
    − a video (without sound) created after motion detection was activated;
    − date and time of the video;
    − location information;
  •  static images filing system, which includes:
    − a static image created after motion detection was activated;
    − date and time of the video;
    − location information.

IZUM alone processes data from the mentioned filing systems with its personnel, technical, and infrastructural resources and it does not outsource individual phases of personal data processing to any other processors for sub-processing, with the exception of the option for viewing real-time video for a security guard of an outside security service at the reception desk next to the main entrance.

Categories of natural persons:

  • IZUM employees,
  • employees of other legal entities hosted at IZUM’s office building,
  • visitors and business partners,
  •  contractors and service providers hired by IZUM, who need to be present in IZUM’s office building or on the premises under IZUM’s management to perform the required tasks.

Users of personal data:

  • employee responsible for the video surveillance system in IZUM,
  • head of computer system support and supported services departments,
  • head of the “Building/logistics” department
  • receptionist and the authorised security service (only real-time view at the reception desk next to the main entrance).

Purpose of processing:

  • ensuring the safety of people and property, including databases (in electronic and physical form) and equipment for their processing;
  • surveillance of entry/exit;
  • surveillance of the lobby, parts of corridors and staircases, garage, data and communication centre;
  • protection of business secret;
  • security of data and its functional accessibility 24/7.

Video surveillance is necessary for the safety of people and property, which cannot be achieved with more lenient means. It is performed exclusively on locations where it is necessary. There is NO real-time monitoring of activities at workplaces (in offices, classrooms, restaurant, etc.)!

Personal data collected with the video surveillance system procedures in IZUM is stored for six months from creation of the video. After this time period, the data is permanently deleted. The storage period can also be changed if so stipulated in the law regulating personal data protection in the Republic of Slovenia.

Access to personal data collected with the video surveillance system procedures in IZUM is only granted to IZUM employees who have the correct privilege. Limited access (real-time view) is also available to the security personnel that physically guards the IZUM building in accordance with a special contract.

Personal data collected with the video surveillance system procedures in IZUM is stored in electronic form on IZUM’s servers in a special data centre. Backups are also stored on secure dedicated off-site locations and are intended exclusively for complete restoring of corrupt, destroyed, or lost data.

Personal data collected with the video surveillance system procedures in IZUM are not
automatically connected with other filing systems, official record, or public registers.

 2 Basic rights of natural persons regarding personal data

 2.1 Provision of information

The subject, whose data is being processed within the framework of the video surveillance system procedures in IZUM, has the right to be provided with all necessary information regarding the procedures for processing his or her personal data. The contact number is +386 2 2520 331, the e-mail address is podpora@izum.si. 

 2.2 Right to rectification

The right of the subject, whose data is being processed in a filing system of data collected with the video surveillance system procedures in IZUM, to obtain from the controller without undue delay the rectification of inaccurate personal data, is not absolute or is irrelevant. Because these are video recordings and static images taken without further technical processing the accuracy and currency are guaranteed with the technical properties of the cameras and photography procedures.

 2.3 Right to erasure

The right of the subject, whose data is being processed in a filing system of data collected with the video surveillance system procedures in IZUM, to erase his or her personal data without undue delay, is not absolute. Even if one of the exhaustively listed reasons in the General Data Protection Regulation applies, the data subject most likely does not have the right to request erasure because IZUM intends to prove that the processing of personal data collected with the video surveillance system procedures in IZUM is necessary to fulfil IZUM’s legal obligations.

 2.4 Right of access

The subject, whose data is being processed in a filing system of data collected with the video surveillance system procedures in IZUM, has the right to learn which of his or her personal data is being processed, in what way, for what purpose, categories of third parties to which the personal data was or will be disclosed, storage period, and all other information listed in the General Data Protection Regulation and the law regulating personal data protection in the Republic of Slovenia. 

The data subject can request a copy of his or her personal data from the filing system of data collected with the video surveillance system procedures in IZUM. IZUM can charge a reasonable fee for each additional copy while taking into account the administrative costs.

 2.5 Right to portability

The right of the subject, whose data is being processed in a filing system of data collected with the video surveillance system procedures in IZUM, to request from IZUM to transfer his or her personal data from the filing system collected with the video surveillance system procedures in IZUM directly to another controller, is irrelevant in the specific case and such situation cannot arise or such a request, even if it is made, will be declined by IZUM. Such a request would namely not meet the conditions from the General Data Protection Regulation, which give the data subject this right.

 2.6 Right to object

The subject, whose data is being processed in a filing system of data collected with the video surveillance system procedures in IZUM, cannot object to the processing of his or her personal data, since the conditions of the General Data Protection Regulation that give the subject this right are not met. IZUM can easily prove necessary legitimate reasons for processing, which overrule the interests, rights, and freedoms of the data subject, or for enforcing, implementing or defending legal requests.

 2.7 Right to restriction of processing

The subject, whose data is being processed in a filing system of data collected with the video surveillance system procedures in IZUM, has a right to obtain from the controller restriction of processing in cases, which are exhaustively listed in the General Data Protection Regulation.

 2.8 Charging of costs

Information and all messages from previous paragraphs sent to the data subject upon his or her request are generally provided free of charge. However, if the requests of the data subject are obviously unfounded or exaggerated, especially if they are often repeated, IZUM can charge a reasonable fee while taking into account the administrative costs for providing information or message, or implementing the requested measure, or declines the requested measures with a justification. The amount of the fee as well as the related rules on charging of costs is specified by the Minister of Justice based on the provisional opinion of the Information Commissioner.

_____________________________________________________

*Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Official Journal of the EU, L 119, 4 May 2016