CCTV in the workplace and in shops: the Dutch privacy rules

In the Netherlands you may use CCTV in a workplace or shop only if you have a specific, documented purpose, such as preventing theft, and the cameras are necessary and proportionate for it. Using cameras to monitor staff performance is not allowed, and if your company has a works council (ondernemingsraad), you need its consent under Article 27(1)(l) of the Works Councils Act (Wet op de ondernemingsraden, WOR) before you install them.

Camera images of identifiable people are personal data, so the GDPR (in Dutch: AVG) applies. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises compliance. Covert filming can also be a criminal offence. This page explains the rules for employers and shopkeepers, and the rights of the people you film.

On what legal basis may you use CCTV?

For a business, the basis is almost always legitimate interest: protecting people, property or goods. Consent from employees does not work, because the dependency in an employment relationship means it is not regarded as freely given.

Legitimate interest requires a three-step test. Your interest must be concrete, for example documented thefts or break-ins. Cameras must be necessary for that interest. And your interest must outweigh the privacy of the people you film. Generic wishes for “more security” do not pass the test. Public authorities cannot rely on legitimate interest at all for their public tasks; they need a statutory task.

When is CCTV necessary and proportionate?

Only when a real problem exists and less intrusive measures, such as better lighting, locks, access control or a security guard, are not enough. Record why those alternatives fell short.

• Point cameras only at areas with a real risk, such as entrances, stockrooms and tills.
• Never film toilets, changing rooms or similar private spaces; avoid canteens and break rooms.
• Do not film the public road or neighbouring property beyond what is unavoidable.
• Limit who may watch live images and who may view recordings.

What does the works council have to approve?

Any arrangement for facilities that are aimed at or suitable for observing or checking the presence, conduct or performance of staff requires the works council’s prior consent (Article 27(1)(l) WOR). A camera system is such a facility, even when its stated purpose is theft prevention.

You submit the proposed decision to the works council in writing, with your reasons and the expected consequences for staff (Article 27(2) WOR). If you introduce cameras without consent, the works council can invoke the nullity of the decision in writing within one month after it learns that you are applying it (Article 27(5) WOR). If the works council refuses, you can ask the subdistrict court (kantonrechter) for permission, which is only given if the refusal is unreasonable or the decision is required for compelling business reasons (Article 27(4) WOR). Without a works council, you still inform staff in advance.

How do you inform people that they are being filmed?

Place clear signs or stickers at every entrance to the filmed area, visible before people enter. The sign states that cameras are in use, who is responsible and where people can find more information.

Your camera policy or privacy statement sets out the purpose, the areas covered, who has access, how long footage is kept and how people can exercise their rights. Include CCTV in your records of processing activities. For employees, put the camera policy in the staff regulations once the works council has approved it.

How long may you keep camera footage?

No longer than necessary for the purpose. The AP’s guidance treats a period of a few weeks as the normal maximum for routine security footage; most systems should overwrite images automatically after that period.

If the footage shows an incident, such as a theft or an assault, you may keep that part until the incident is dealt with, for instance until the police have it or the dispute is resolved. Record why you are keeping it and for how long.

Do you need a DPIA?

Often, yes. A data protection impact assessment (DPIA) is required when processing is likely to cause a high risk, and the AP treats large-scale or systematic camera surveillance as such processing.

The DPIA describes the purpose and scope of the system, tests necessity and proportionality, identifies the risks to the people you film and sets out the measures you take. If a high risk remains that you cannot reduce, you must consult the AP before you start filming (prior consultation).

When may you use hidden cameras?

Only in exceptional cases: when you have a concrete, documented suspicion of a criminal offence such as theft or fraud, other means have failed, and the camera is used for a limited time and only where the suspected conduct takes place.

The criminal law adds a requirement. Under Article 139f of the Dutch Criminal Code (Wetboek van Strafrecht, Sr) it is an offence to make images of a person in a non-public place with a device whose presence has not been made clear, if this is unlawful. Article 441b Sr does the same for publicly accessible places. You should therefore announce in your camera policy, in general terms and in advance, that hidden cameras may be used temporarily in case of a concrete suspicion. That announcement is part of the works council’s consent.

• Record the suspicion and why visible cameras or other measures would not work.
• Set an end date and limit the camera to the place where the conduct is suspected.
• Restrict access to the footage to the people conducting the investigation.
• Delete the footage once the investigation is closed, unless it is needed as evidence.

Footage obtained without these safeguards can still be used in employment proceedings, but the court weighs the breach of privacy, and a dismissal case built on it becomes harder to win.

May you record sound as well?

Almost never. Audio captures conversations and is far more intrusive than images, so it rarely passes the legitimate-interest test; the security purpose can nearly always be met with images alone.

Under Articles 139a and 139b Sr it is a criminal offence to record a conversation with a technical device if you are not a participant and are not acting on a participant’s instructions. An employer that records conversations between staff, or between staff and customers, therefore risks prosecution. A participant who records their own conversation does not commit an offence under these articles.

What rights do people on camera have?

Anyone you film can ask for access to the footage of themselves, object to the filming and ask for erasure. You must respond within one month; for complex requests the period can be extended to a maximum of three months in total.

For an access request, verify the requester’s identity, provide only the images that show them and blur other people. Access is normally free of charge. If the footage has already been overwritten under your retention period, say so. You may refuse erasure if you need the footage to establish or defend a legal claim, for example after a theft.

What should you check as an employer or shopkeeper?

• Have you documented the concrete risk and why lighter measures are not enough?
• Do you have the works council’s written consent under Article 27(1)(l) WOR, or have you informed staff if there is no works council?
• Are there signs at every entrance to the filmed area?
• Does the system overwrite footage automatically after a short, fixed period?
• Have you carried out a DPIA, and is access to images limited and logged?
• Does your camera policy announce the possibility of temporary hidden cameras?

What should you check as an employee?

• Did the works council consent to the camera system, or were you informed in advance?
• Are cameras aimed at work areas with a real risk, and not at toilets, changing rooms or break rooms?
• Is the camera used to check your performance? That is not a permitted purpose.
• Can you see the camera policy, including how long images are kept?
• Have you asked for access to footage of yourself? The employer must respond within one month.

What can we do for you with CCTV and privacy?

Our IT and privacy lawyers and employment lawyers work together on camera surveillance.

• We assess whether your planned camera system has a valid legal basis and draft the balancing test.
• We write your camera policy, signage text and privacy statement.
• We prepare the consent request to the works council under Article 27 WOR.
• We carry out or review the DPIA and, if needed, the prior consultation with the AP.
• We advise on the lawful use of hidden cameras when you suspect theft or fraud.
• We assess access requests and objections and draft the reply within the one-month deadline.

Summary

• CCTV requires a concrete legitimate interest, necessity and proportionality; staff consent is not a valid basis.
• A works council must consent in advance (Article 27(1)(l) WOR); without consent the decision can be declared void.
• Inform people with clear signs and a camera policy; keep routine footage for a short period only.
• Hidden cameras are allowed only temporarily, on a concrete suspicion and after a general announcement; covert images can otherwise be an offence under Articles 139f and 441b Sr.
• Recording conversations you are not part of is an offence under Articles 139a and 139b Sr.

Frequently asked questions