Poland does not have any regulations on the installation of surveillance cameras even though many had demanded them, including the Polish Ombudsman. The Ministry of Administration had taken some legislative initiative, managing to produce several successive drafts which however never became law. As a result, the Polish legal system still lacks laws which would indicate what we are allowed to do (or rather, what we are not allowed to do) with respect to surveillance. Since a person’s image recorded by a camera constitutes personal data and there are no special provisions dedicated to such recordings, the processing of the recordings will be governed by general data protection laws.


GDPR and surveillance

Applying the provisions of the General Data Protection Regulation (GDPR) to the matter of processing personal data as part of surveillance is not an optimal solution. Not all GDPR provisions should be applicable to the processing of data in such form. For example, it is impossible for a data subject to enforce their right to have their data erased or to object to processing.

Another problem lies in determining the specific legal grounds for processing. It is assumed that personal data can be processed based on the legitimate interests of the controller (Article 6(1)(f) GDPR). As regards surveillance, these legitimate interests are the controller’s need to protect their property or human life and health. This means that any decision to install a camera in a specific spot must always be related to the pursuit of such interests. Furthermore, should there be any fundamental rights or freedoms of data subjects that are more important than the controller’s interests, then the processing of personal data on this ground will be forbidden. Therefore, it is generally assumed that cameras should not be installed e.g. in locker rooms as this unduly interferes with privacy.


Surveillance in public buildings

Public authorities face an additional problem with installing cameras. Whereas private entities may process images under their legitimate interests, public bodies may not do so. In buildings that belong to public authorities (that is, e.g., in a town hall building, school or court), the use of cameras is acceptable only when it is permitted or required by law.

The current Personal Data Protection Act allows the use of cameras in, for example, the administrative offices of local authorities or schools and in buildings that constitute state property. Special provisions also allow the recording of Police officers and court hearings.


“Candid camera”

In Poland, it is unacceptable to install cameras without adequately notifying the persons recorded. The area surveyed must be marked. The standard practice is to use stickers with a picture of a moving camera.

Given the GDPR disclosure requirements, the persons monitored should also receive detailed information identifying who installed the cameras, the purpose of and legal grounds for processing the images, the footage storage period and the data subjects’ rights. The controller may provide such information in any way they want. They may display it on a wall of the monitored building or place it on the reception desk.


Workplace surveillance vs Labour Code

Employers installing surveillance cameras must keep in mind that they have additional obligations to meet. First of all, work rules (or collective agreements) must contain provisions concerning “the purpose, scope and manner of surveillance”. Second, the employees must be informed of surveillance systems being introduced at least two weeks before the cameras are switched on.

Employers must also keep in mind that they can store camera footage for a maximum of three months. Longer periods of storage are acceptable only when a given piece of footage constitutes evidence in a case or is retained for incident resolution purposes.

Properly determining the right spots for cameras is also important. The Labour Code directly prohibits surveillance in bathrooms, locker rooms, canteens, smoking rooms and trade union offices. As an exception, cameras may be installed in such rooms only when greater privacy protection levels are ensured (especially to prevent people in the footage from being identified). Also, no cameras can be placed in such spots where they could record doors to trade union offices or the corridor leading only to those offices as this could help identify union members.


Chief Labour Inspectorate to cooperate with the Personal Data Protection Office?

The installation of surveillance cameras can improve security and allows us to identify offenders. However, recording people’s images also interferes with the recorded persons’ privacy (and even their intimate sphere when it comes to cameras installed in locker rooms at gyms or swimming pools). Because of this, every entity that chooses to use surveillance must ensure that privacy is duly protected, especially through adequately choice of the rooms to be recorded and giving the recorded persons a notice of the cameras around. Ensuring high protection levels for IT systems to keep the recordings safe is also essential.

The President of the Personal Data Protection Office has announced that surveillance-using controllers will face inspections. The Chief Labour Inspectorate too can verify whether workplace surveillance is appropriately used. The authorities have even announced their intention to cooperate in this matter (https://serwisy.gazetaprawna.pl/praca-i-kariera/artykuly/1162281,kay-od-pip-i-uodo-za-niewlasciwy-monitoring.html). Inappropriate use of surveillance might not only damage the company’s reputation and cause it to lose its customers’ trust but also lead to heavy fines imposed either of the President of the Personal Data Protection Office and the Chief Labour Inspectorate.



Check what we refer to:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
  • The Labour Code Act of 26 June 1974 (Journal of Laws of 2018, item 917);
  • The Personal Data Protection Act of 10 May 2018 *Journal of Laws, item 1000).