CCTV in Luxembourg: what the CNPD actually requires

A private individual who films only the inside of their home or their enclosed garden, for strictly personal use, stays within the GDPR “household exemption”. As soon as the camera captures, even partly, the public road, a pavement, a neighbour’s entrance or a shared area, the exemption falls away: the Court of Justice of the European Union ruled so in 2014 (Ryneš, C-212/13), and the rules below apply in full.

A company, a shop, a restaurant, a practice or an association is always concerned, whatever its size. So is a co-owned building that equips its common areas: it becomes the controller, represented by its managing agent.

The CNPD asks you to define precisely the purpose or purposes pursued before installation, and not to divert the system to another use later without informing the people concerned. The accepted purposes are concrete: securing access to the building, ensuring the safety of staff and customers, detecting suspicious or dangerous behaviour, protecting property (buildings, installations, equipment, goods, cash), helping emergency services intervene.

The legal basis is almost always legitimate interest (Article 6(1)(f) GDPR), under three cumulative conditions: a genuine interest (for example protecting stock against theft), necessity (no less intrusive solution reasonably available) and rights of the people filmed that do not prevail. Consent is not a suitable basis: it cannot be collected from every passer-by.

A camera monitoring an entrance must be limited to the strictly necessary area. Outdoor cameras must capture neither the public road nor neighbouring properties; where that is unavoidable, the overlapping areas must be masked or blurred — most IP cameras allow this in their settings, and it is configured at commissioning.

Some places are excluded as a matter of principle, because people legitimately expect not to be filmed there: changing rooms, toilets, showers, break rooms and kitchenettes, permanent workstations (offices, workshops, kitchen interiors), dining areas of restaurants and cafés, staff delegation premises.

Sound is excluded: CCTV covers images only, and recording audio as well is considered disproportionate. Continuous, permanent monitoring of employees is also to be avoided.

The CNPD recommends two-level information. First level: a sign of sufficient size, displayed permanently at the main entrances and exits of the filmed area, readable at head height, with a pictogram. It states the identity and contact details of the controller, the purpose or purposes, the existence of data subject rights, and points to the second level (link, QR code, phone number).

Second level: a full notice with all the information required by Article 13 GDPR (retention period, recipients, rights, complaint to the CNPD, and so on), available in an easily accessible place — at reception, on paper and not only online. For employees, specific information is added (see below).

CCTV must appear in the record of processing activities required by Article 30 GDPR, with all the required entries: purposes, categories of people and data, recipients, retention period, security measures. It is the first document to produce in the event of an inspection or a complaint. We hand over a pre-filled template with every installation.

Footage may be kept, as a rule, for up to 8 days. The controller may exceptionally keep it for 30 days, provided the reasons are documented in the record of processing. Beyond 30 days, retention is generally considered disproportionate.

In the event of an incident or an offence, the footage concerned may be kept longer, as part of its transmission to the competent judicial authorities. The controller must make sure footage is destroyed when the period expires: the CNPD recommends automatic deletion, which we programme in the recorder.

Access to footage must be limited to the people who legitimately need it for their duties: strong passwords, individual credentials, access logging so you know who viewed what, and the technical and organisational measures of Article 32 GDPR.

If a service provider works on the system — installer, monitoring company — a processor contract compliant with Article 28 is required. If footage is stored outside the European Union, including through a cloud service, the international transfer rules apply.

Anyone filmed can request access to the footage concerning them (Article 15 GDPR); the answer is due within one month, protecting third parties who appear in the images. Footage is never posted on social media, even after a theft: it is handed to the police or the courts.

When employees may appear in the images, CCTV is processing “for surveillance purposes in the context of employment relationships”, governed by Article L.261-1 of the Luxembourg Labour Code. The employer must inform the staff delegation in advance, in addition to each employee: a detailed description of the purpose, the way the system is implemented, the retention period or criteria, and a formal undertaking not to use the footage for other purposes.

The staff delegation or, failing that, the employees concerned may, within 15 days of that information, ask the CNPD for a prior opinion on the project’s compliance; the CNPD answers within one month, and the request suspends implementation during that period. An employee may also lodge a complaint with the CNPD, and no complaint can justify a dismissal.

Three purposes are additionally subject to co-decision between the employer and the staff delegation (Articles L.211-8, L.414-9 and L.423-1 of the Labour Code): employee health and safety, monitoring of production or performance where it is the only way to determine exact pay, and work organisation under a flexible schedule.

A DPIA is mandatory when the processing is likely to result in a high risk for individuals, and Article 35(3) GDPR expressly names systematic large-scale monitoring of a publicly accessible area. According to the CNPD, a DPIA will be necessary “in many cases of video surveillance”; the European criteria include the presence of vulnerable people (employees, children, the elderly), scale, systematic nature and innovative technologies.

In practice: for a house or a small shop with two or three cameras on its entrances, the risk is low; for a shop open to the public with many cameras, or as soon as employees are filmed, the assessment must at least be documented.

The CNPD handles complaints, carries out investigations and can impose administrative fines (Article 83 GDPR), as well as ordering compliance or the removal of cameras. It publishes its decisions, several of which concern CCTV systems specifically — for instance cameras aimed at workstations or break areas, missing signage or excessive retention. Its 2024 guidelines take these cases into account.