Privacy notice on the electronic surveillance system (cameras)

PRIVACY NOTICE

ELECTRONIC SURVEILLANCE SYSTEM

Controller details:

At its sites at Erzsébet krt. 6.and Garay u. 5. , the controller operates an electronic surveillance system consisting of a total of 7 cameras , which is indicated at every entry point by a pictogram . The cameras do not record sound.

The position of each camera (the area monitored), the purpose of processing and the persons concerned are described below:

Site at Erzsébet krt. 6.

Camera No. 1: Erzsébet krt. 6.

In addition to recording, an internal staff member assigned to the reception desk also watches the live image.

Camera No. 2: Erzsébet krt. 6.

Camera No. 3: Erzsébet krt. 6.

Camera No. 4: Erzsébet krt. 6.

In addition to recording, an internal staff member assigned to the reception desk also watches the live image.

Site at Garay utca 5.

Camera No. 5: Garay u. 5.

In addition to recording, an internal staff member assigned to the reception desk also watches the live image.

Camera No. 6: Garay u. 5.

In addition to recording, an internal staff member assigned to the reception desk also watches the live image.

Camera No. 7: Garay u. 5.

In addition to recording, an internal staff member assigned to the reception desk also watches the live image.

Related right of employees:

In line with the practice of the supervisory authority, employees may view the exact location of each camera (camera map) and the camera images of the monitored areas at the Mayor’s Office (Legal and Council Affairs Department). These data form a non-public annex to this notice. Other data subjects do not have this right, for reasons of protection of persons and property and of data and secrets.

Legal basis for processing: The legal basis for processing is the legitimate interest of the controller and of its clients (district residents) under Article 6(1)(f) GDPR, which is also a fundamental interest of the data subjects. The main considerations regarding the legitimate interest are as follows:

The Mayor’s Office and the local government serve the needs of some 45,000 district residents and 6,500 businesses and deal with several thousand contractual partners. They perform tasks defined by law and undertaken voluntarily, and process the personal data and business secrets of employees, clients and contractual partners, as well as other legally protected data. 

The safety and smooth running of work and customer service, the protection of the assets supporting them, and the related protection of persons are priority tasks.

The controller has a car park for its exclusive use and also maintains bicycle storage available to both clients and staff. Protecting these assets is also a priority.

For processing based on legitimate interest, a so-called legitimate interest test must be carried out, in which the controller presents its specific legitimate interests, describes the interests and rights of data subjects taken into account, weighs the legitimate interest against those interests and rights, demonstrates the necessity and proportionality of the processing, and informs data subjects of the considerations and safeguards. The processing affects the rights and interests of data subjects. Such interests and rights may include: protection of personal data and privacy, freedom of expression and information, freedom of conscience, thought and religion, freedom of association and assembly, prohibition of discrimination, protection of property, and the right to physical and mental integrity. Data subjects may also have personal, financial and social interests. Their right to move about unobserved does not prevail, but the monitoring is limited in time and space. It is restricted to areas of particular importance for the protection of persons and property (including clients’ persons and property) and of data and secrets. No sound is recorded, rest areas and other private spaces (e.g. washrooms) are not monitored, and the monitoring does not amount to continuous surveillance. Public space is affected only to a narrow, necessary extent. The monitoring also protects the property and physical safety of data subjects and contributes to the controller’s accountable operation.

The controller has weighed its legitimate interests in the processing against the interests and rights of data subjects, with the following result:

The interest in the processing overrides the interests and rights of data subjects and restricts them in a necessary and proportionate manner. In addition, the processing takes place for a short period.

Other information on the electronic surveillance system

Data subjects can expect the processing, i.e. the use of the electronic surveillance system; this is also indicated by pictograms at every entry point and by a privacy notice at the information desk at the entrance.

Place, duration and method of processing: Images are recorded (and in some cases the live image is watched) in the private areas indicated above and, to a limited (minimum necessary) extent, in public space, in all cases without sound. The electronic surveillance system operates 24 hours a day, every day of the week. Data are stored on a server at the controller’s registered office.

Unless used, the controller stores the recordings for 5 days, after which they are deleted. The 5-day period was set taking into account the purposes of processing.

Use means viewing of the live image by the reception staff (where specifically indicated), purpose-limited viewing of the recordings made by the cameras, and their use in connection with enforcing claims or as evidence in court or other official proceedings. Recordings may be reviewed only in a documented manner (using a spreadsheet and minutes). If recordings are used in connection with enforcing a claim, they are kept until the final conclusion of the relevant employment, court or other official proceedings, or for as long as necessary to enforce the legal claim, and processing continues until then. In such cases the recordings may be forwarded to the competent court or authority and to persons involved in enforcing the claim (e.g. a legal representative).

How recordings are viewed and who has access to the data: The Live images, where specifically indicated, are viewed by the reception staff.The recordings made by the electronic surveillance system may be viewed, for a specific purpose only, by the controller’s IT department, the employee involved in enforcing a claim, the data protection officer, if necessary the Notary/Deputy Notary or persons authorized by them, and possibly external legal representatives. Although the controller is the Mayor’s Office, the local government may take part in viewing for a specific purpose where justified.

Each viewing (stating its reason, time and the persons with access) is always recorded in minutes, which must be signed by everyone involved. We emphasize again that recordings are viewed only if it appears likely that a crime (or petty offense) has been committed at the controller’s premises, or if other compelling reasons, in particular the protection of persons, property, data or secrets, justify it.

The controller forwards recordings only if

–          the recordings indicate that a crime (petty offense) has likely been committed, in which case they may be forwarded, for example, to the investigating authority, a designated official of the local government, or a legal representative, or

–          enforcing a claim (e.g. a claim for damages), taking action or initiating other legal proceedings is necessary on the basis of the recordings, in which case they are forwarded to those concerned by the action, claim or proceedings, such as the person causing the damage, the injured party, the competent court or authority, or the legal representative involved.

–          We emphasize again that the local government may participate in the above procedures and in processing the data for a specific purpose.

Data security measures: The controller itself stores the recordings on a server at its registered office, in a closed, password-protected IT system, until they are deleted. Unauthorized persons have no access to the recordings. Access is logged.

Automated decision-making does not take place in this processing.

Data subject rights

How data subjects are informed:

Before data subjects enter an area monitored by the electronic surveillance system, the controller provides two-step privacy information. First, warning stickers have been placed at every entry point before the monitored area. In addition, this full privacy notice of the controller is available in every monitored area. Data subjects may also request further information from the controller at the contact details above.

Which data subject rights can be exercised:

The data subject has the right to be informed that processing is taking place; the right of access to personal data; the right to receive a copy of the personal data processed; the right to request rectification, erasure or restriction of processing of their personal data; the right to object to processing; and the right to lodge a complaint with the supervisory authority. In addition, the data subject may bring an action in court. We particularly highlight the data subject’s right to view a recording and to request a copy, and the right to object to processing. A precondition for viewing and requesting a copy is that the data subject appears on the recording, which the controller checks in advance. Furthermore, no recording may be released on which other persons are visible without being masked.

Data subject rights in detail

Explanation of the data subject’s rights above:

Right to information:

You may ask the controller for information about the processing of your personal data.

The controller must provide you with all information on the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

The controller provides the information in writing without undue delay and in any event within one month of receipt of the request. At the data subject’s request, the information may also be given orally, provided that the identity of the data subject has been reliably proven by other means beforehand.

If requests are complex and numerous, the one-month deadline may be extended by two further months. The controller informs the data subject of any such extension, stating the reasons for the delay, within one month of receipt of the request. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

If the controller does not take action on the data subject’s request, it informs the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Right of access to personal data and to information about the processing:

The data subject has the right to obtain from the controller confirmation as to whether or not their personal data are being processed, and, where that is the case, access to the personal data and the following information:

a)      the purposes of processing;

b)      the categories of personal data concerned;

c)      the recipients or categories of recipients to whom the personal data have been or will be disclosed;

d)      the envisaged period for which the personal data will be stored, or the criteria used to determine that period;

e)      information that the data subject may request from the controller rectification or erasure of personal data or restriction of processing, and may object to such processing;

f)       the right to lodge a complaint with the supervisory authority (NAIH);

g)      where the data were not collected from the data subject, any available information as to their source;

h)      whether automated decision-making (including profiling) takes place at the controller and, if so, in which area, the logic involved, and the significance and envisaged consequences of such processing for the data subject.

The controller again informs the data subject that personal data are not transferred in any form to a third country or an international organization.

Right to receive a copy:

At the data subject’s request, the controller provides a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the request is made by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by the data subject.

However, the right to obtain a copy shall not adversely affect the rights and freedoms of others.

Right to data portability:

The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from the controller, where processing is based on the data subject’s consent or explicit consent or on the performance of a contract, and is carried out by automated means.

Where the above conditions are met, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

However, the right to data portability shall not adversely affect the rights and freedoms of others.

Right to rectification:

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them and to have incomplete personal data completed, including by means of a supplementary statement.

Right to erasure:

The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, and the controller is obliged to erase personal data without undue delay where one of the following grounds applies:

a)      the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

b)      the data subject withdraws the consent (or explicit consent) on which processing is based, and there is no other legal ground for the processing;

c)      the data subject objects to processing based on public interest or legitimate interest and there are no overriding legitimate grounds for the processing, or the data subject objects to processing for direct marketing purposes;

d)      the personal data have been unlawfully processed by the controller;

e)      the personal data have to be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject.

Where the controller has made the personal data public and is obliged to erase them, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the data that the data subject has requested the erasure of any links to, or copies or replications of, those personal data.

Erasure cannot be requested where processing is necessary:

a)      for exercising the right of freedom of expression and information;

b)      for compliance with a legal obligation under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

c)      for reasons of public interest in the area of public health;

d)      for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, insofar as the right to erasure is likely to render impossible or seriously impair that processing; or

e)      for the establishment, exercise or defense of legal claims.

Right to restriction of processing:

The data subject has the right to obtain from the controller restriction of processing where one of the following applies:

a)      the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

b)      the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of their use instead;

c)      the controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; or

d)      the data subject has objected to processing, pending verification of whether the objection is lawful and justified.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent, for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

The controller must inform the data subject in advance before the restriction of processing is lifted.

Right to object to processing:

The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on legitimate interest .

In this case, the controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims.

Right to lodge a complaint:

If any of the above rights are infringed, the data subject has the right to lodge a complaint with the supervisory authority.

The supervisory authority is the National Authority for Data Protection and Freedom of Information (NAIH) (mailing address: 1363  Budapest, Pf.: 9., phone: +36 (1) 391-1400, email: ugyfelszolgalat@naih.hu, website: https://www.naih.hu), where you can lodge a complaint or initiate an investigation by notification, claiming that your rights have been infringed in connection with the processing of your personal data or that there is an imminent risk of such infringement.

Please also note that if your rights have been infringed in connection with the processing of your personal data, or there is an imminent risk of such infringement, you may also go directly to court.

You may also send your comments, questions or complaints, at the contact details given in the introduction to this notice, to the controller’s representative.

Applicable legislation

- General Data Protection Regulation (EU) 2016/679 (GDPR),

- European Data Protection Board Guidelines 3/2019 on processing of personal data through video devices (EDPB),

- Act CXXXIII of 2005 on the rules of personal and property protection and private investigation (Szvtv.),

- Case law of the Hungarian National Authority for Data Protection and Freedom of Information (https://www.naih.hu),

- Case law of the Court of Justice of the European Union.

Date of last amendment of the privacy notice: October 1, 2025