The installation of a CCTV system with cameras in private premises requires the submission of a notification to the Hellenic Data Protection Authority (HDPA).
Watch a video describing the most common cybercrime offences:
The same notification obligation applies to any modification of the video surveillance system (e.g. addition, removal or repositioning of cameras).
If such notification does not take place, both administrative and criminal sanctions may be imposed, in accordance with Articles 20 and 22 of Law 2472/1997.
An exception to the rule of mandatory notification arises where the video surveillance system captures and/or records images exclusively from a private, non-professional space, such as a private residence.
As regards the placement of the cameras, they may be installed anywhere within the apartment.
However, it is emphasised that it is prohibited to capture images from external public spaces, such as a camera on a balcony recording images of a street or pavement, as well as from neighbouring buildings (Article 3 of Directive 1/2011).
In the case of a top-floor apartment, the installation of a camera and the related processing are considered lawful, provided that the field of view is strictly limited to what is necessary for protecting the entrance to the apartment.
In other words, the field of view must be confined to surveillance of the apartment door, capturing as little as possible of the common areas, such as staircases and lifts. In this way, the persons most likely to be affected by the processing are those whose purpose is to enter the residence of the top-floor occupant.
The person who has installed the camera is regarded as the data controller for that installation and therefore bears all obligations arising from Law 2472/1997 and Directive 1/2011, namely the obligation to submit notification to the Authority, the obligation to comply with the rights of information, access and objection of data subjects, and the obligation to maintain confidentiality and security of processing.
What applies to the installation of cameras in the common areas of an apartment building?
A camera may be installed in a common parking area, for the surveillance of a vehicle, provided that no such system has been installed by the apartment building. The other residents must, however, be consulted, the camera must focus exclusively on the vehicle, and clearly visible signs must be posted. For this processing, a notification must be submitted to the Hellenic Data Protection Authority (HDPA).
According to Directive 1/2011 of the Hellenic Data Protection Authority, the installation of a video surveillance system requires a decision of the body competent for the management of the apartment building (e.g. General Assembly of owners, as defined in the building’s regulations, with percentages allocated per property, etc.).
If the building’s regulations already provide for the installation of a video surveillance system, then whatever is set out in the regulations is simply followed.
If the installation is not provided for in the regulations, a joint decision of 2/3 of the residents is required. This means that the residents will express their view solely on whether or not they wish the video surveillance system to operate. It is noted that each (inhabited) apartment is entitled to one vote.
Following a positive opinion, the General Assembly of the apartment building is then able to decide on the installation.
Examples:
a) The General Assembly of the apartment building votes unanimously (100%) in favour of installing a video surveillance system, but out of the 20 residents, only 13 agree (a percentage lower than 2/3) while 7 disagree. In that case, a video surveillance system cannot be installed.
b) The General Assembly of the apartment building votes 55% in favour of the installation, and more than 2/3 of the residents wish for it to be installed. In this case, a video surveillance system may be installed (provided that, under the regulations, decisions on such matters are taken by a majority of 50% + 1).
- Read also our article on Cybercrime
- Read also our article on Defamation via Facebook
FREQUENTLY ASKED QUESTIONS ON CCTV CAMERAS IN PRIVATE PREMISES
1. What risks do I face if I install cameras without notification?
Failure to comply with the notification and lawful operation requirements for a video surveillance system triggers both administrative and criminal sanctions. The Hellenic Data Protection Authority (HDPA) may impose substantial administrative fines under the GDPR (Regulation 2016/679) and Law 4624/2019, which as a rule reach several thousand euros depending on the gravity and duration of the infringement.
At the same time, if the camera records images of a neighbour, a common area or a public street, the affected person may file a criminal complaint for unlawful data processing and bring a lawsuit for infringement of personality rights (Article 57 of the Civil Code (AK)), claiming damages and pecuniary compensation for moral damages.
2. Where am I permitted to install cameras in my apartment?
Within an exclusively private, non-professional space (such as a residence) installation is unrestricted and exempt from the notification obligation. There are, however, strict limits as to the field of view. It is prohibited to record images of external public spaces (street, pavement), of neighbouring buildings or balconies, as well as of the common areas of the apartment building without following a specific procedure.
In a top-floor apartment, a camera at the front door is permitted only if the field of view is limited to what is strictly necessary for surveillance of the entrance and recording of staircases or lifts is avoided as far as possible.
3. How do I defend myself against a neighbour’s complaint regarding an unlawful camera?
The defence is structured on two levels. Administratively, a memorandum may be submitted to the Hellenic Data Protection Authority with a technical description of the system, photographs of the field of view, masking applied to areas concerning third parties, and documentation of the lawful purpose (security of the entrance, protection of a vehicle).
On the criminal side, if a complaint has been filed for breach of personal data, the defence focuses on the lack of intent, on compliance with Directive 1/2011, and on the proportionality of the processing. Promptly modifying the field of view following a notice often weakens the charge.
4. How long does it take to legalise an installation in an apartment building?
The procedure includes convening the General Assembly, taking a decision by the required majority (if not provided for in the regulations, the agreement of 2/3 of the co-owners is required), drafting minutes, submitting notification to the Hellenic Data Protection Authority, and posting informational signs. Overall, one to three months are typically required, depending on the willingness of the co-owners.
If a co-owner files an objection, the hearing of interim measures before the Single-Member Court of First Instance extends the procedure.
5. What documents do I need for the lawful installation of cameras?
For private space within a residence, no notification is required. For common areas of an apartment building, the following are required: minutes of the General Assembly with the requisite majority, a copy of the building’s regulations, a technical description of the system (number of cameras, field of view, retention period of records), a data protection policy, informational signs in conspicuous locations, and notification to the Hellenic Data Protection Authority (HDPA).
The appointment of a data controller and the maintenance of a record of processing activities pursuant to Article 30 of the GDPR are also required.
6. What is the role of the lawyer in camera-related cases?
The lawyer reviews the system’s compatibility with the GDPR, Law 4624/2019 and Directive 1/2011, drafts the data protection policy, the information notices and the minutes of the General Assembly decision, and submits the notification to the Authority. In the event of a complaint, the lawyer represents the client before the Hellenic Data Protection Authority, files a memorandum and produces evidence.
If criminal proceedings or a lawsuit for infringement of personality rights are brought, the lawyer takes on the defence before the Court of First Instance, seeking dismissal of the charge or acquittal on the basis of proportionality and the lawful purpose of the processing.