CCTV Cameras: When They Can and Cannot Be Used

The installation of CCTV cameras in businesses, shops, and private spaces has become a common tool to prevent theft, control access, or monitor compliance with work obligations. However, their use is strictly regulated by European and Spanish law, and non-compliance can lead to significant penalties for violating the fundamental right to privacy.

This article analyzes when cameras can and cannot be used, why, and what recent key rulings say.

Main Legal Basis

Organic Law 3/2018 (LOPDGDD)

• Art. 22 LOPDGDD: regulates the processing of data for video surveillance purposes.

• Allows recording to protect the safety of people, property, and facilities.

• Requires prior and unequivocal signage.

GDPR (General Data Protection Regulation)

• Art. 6 GDPR: requires a valid legal basis (legitimate interest in most cases).

• Art. 13 GDPR: obligation to inform.

• Art. 5 GDPR: principles of proportionality, data minimization, and purpose limitation.

Workers’ Statute

• Art. 20.3 ET: allows employers to control work compliance “while respecting the dignity of the employee.”

When Cameras Can Be Used

1) For Security Purposes
Legal when:

• There is legitimate interest (preventing theft, damage, unauthorized access).

• Signage is visible.

• Cameras only capture necessary areas (no invasion of privacy).

➡️ Basis: Art. 6.1.f GDPR + Art. 22 LOPDGDD

2) In the Workplace, to Monitor Compliance
Allowed when:

• Monitoring is proportional.

• No less intrusive methods exist.

• Employees are informed about the presence of cameras.

ℹ️ Key ruling: ECHR – López Ribalda vs. Spain (Grand Chamber, 17/10/2019)
The Court upheld hidden cameras because there was reasonable suspicion of theft, and the measure was proportionate and time-limited.

ℹ️ Spanish case law: STS Social 23/2025 → recognizes evidentiary validity of images recorded by cameras if employees were informed of their existence.

3) Temporary Cameras to Investigate Misconduct
Hidden cameras can only be used when:

• There is serious and reasonable suspicion.

• Recording is time-limited.

• No less intrusive alternatives exist.

➡️ Supported by López Ribalda (ECHR) and STSJ Madrid 2018 (Mutua Cualtis)

When Cameras CANNOT Be Used

1. In Highly Protected Areas

   
   Prohibited in:

• Bathrooms

• Changing rooms

• Break rooms

• Lockers

• Union areas

➡️ Basis: Art. 89 LOPDGDD (enhanced protection in private spaces)

2. To Constantly Monitor Employees

   
   Constant surveillance violates dignity and privacy.
   Example: camera focused on a workstation throughout the entire day without valid reason.

3. Without Proper Signage

   
   GDPR requires:

• Prior information

• Visible notice

• Identity of the data controller

Lack of signage is grounds for AEPD penalties.

4. To Record Audio Permanently

   
   Audio recording at work is far more intrusive.

   
   ➡️ Only allowed if:

• There is a serious security risk

• It is temporary

• Properly justified and documented

AEPD has imposed heavy fines for microphones in shops.

5. For Purposes Other Than Communicated

   
   Example: Installing cameras for security but later using them to evaluate performance or terminate employees → illegal, except in cases of serious suspicion.

➡️ Principle of purpose limitation – Art. 5.1.b GDPR

Key Rulings

• ECHR, López Ribalda vs. Spain, 17/10/2019 → authorizes hidden cameras if suspicion is reasonable and proportionate.

• STS (Social Chamber), 23/2025 → evidentiary validity of images captured by informed video surveillance.

• STSJ Madrid 7/2/2018 (Mutua Cualtis) → allows temporary unannounced cameras to investigate specific incidents.

• STS – Vending Machines Case (2017) → hidden cameras valid for employee vandalism; proportionality is key.

Conclusion

Video surveillance is legal as long as essential principles are respected: proportionality, information, legitimate purpose, and limitation in time and space.

Companies have tools to protect their property and ensure proper business functioning, but always within the strict framework of GDPR and recent jurisprudence.

When the regulations are well understood, it is perfectly possible to use cameras legally, effectively, and in a way that respects fundamental rights.