«“Luís Neto Galvão, a Partner in charge of the Digital, Cybersecurity and Data Protection practice at SRS Legal, believes that this ‘is a murky area that remains largely unregulated’.”
The lawyer points out that the main applicable legislation is the ‘General Data Protection Regulation (GDPR)’, meaning that a video recording may constitute the processing of personal data when it allows a person to be identified, either directly or indirectly”. Thus, the lawyer emphasises, “if a parked car captures images of people or vehicle number plates on a public road, it is collecting personal data”.
The fact that there is no one inside the car does not, in itself, alter this situation. “The vehicle manufacturer or the owner, depending on the circumstances, may be responsible for the processing of the images captured by the camera system, should the GDPR apply,” states Neto Galvão.
There is, however, “an important difference between capturing images for the purpose of protecting the vehicle itself and using a camera to indiscriminately monitor public spaces”, points out Neto Galvão, who considers that “a good parallel is that of CCTV in homes, where there are restrictions on capturing images of neighbours’ homes or public roads from one’s own property. The problem with filming from cars – which may serve very legitimate purposes – is that it is not specifically regulated by law”.
When people’s faces or even number plates are captured, “it is impossible to say that there is absolutely no need to process personal data”, but even in the event of an accident, there must be “a balancing of property rights against data protection rights, which take precedence”.
Neto Galvão cites as an example the solution found for the Transport of Passengers for Remuneration in Electronically Booked Vehicles (TVDE), where the law “allows, with the consent of passengers and the driver, the recording of video – but not audio – of the journey”.»