AIP lawyer Fani Davidova comments on the following case referred to AIP:
An internet site offers for sale “spy equipment” (CCTV equipment) – security cameras, microphones, recorders. As an advertisement policy the administrators offer online surveillance through CCTV cameras on several public hot spots in Sofia. A mouse click brings everyone to the most busy intersection in town – one can see who meet with whom, who is in the passing tram, even more, the user can move the camera himself…so one can have a look through the windows of the surrounding buildings.
The CCTV recording constitutes processing of personal data as defined and protected by the Personal Data Protection Act (PDPA). In this case there are bunch of infringements of the PDPA:
1. The citizens, whose personal data is processed, shall know who, when and for what purposes the data is collected.
2. The citizens shall be able to express agreement/disagreement of processing their data – when the CCTV camera is at public place – the citizens shall be warned (in clear and evident way).
3. Personal data shall be processed for specific and legitimate purpose.
4. The data controller shall be unequivocally identified.
5. The personal data processed shall be kept only for certain period of time and destroyed afterwards.
6. Third party access to the personal data collected shall be limited.
* The Bulgarian Commission for Personal Data Protection declared the week between January 23 and January 28 as the Personal Data Protection Week.