Video Surveillance Regulation

Rule No. 10/2015 (hereinafter, the “Rule”) of the Argentine Personal Data Protection Authority (hereinafter, the “DPA”) was published in the Official Gazette on February 27, 2015. This Rule set forth the legal framework for the use of video surveillance cameras and more specifically the collection of personal data captured by these devices.

The Rule provides that the recording of digital images of individuals through security cameras must be given prior consent by the data subject, except for the following cases:

1. when the images are recorded in the context of a private event;
2. when the images are recorded by the State in due exercise of its authorities;
3. when the data is collected within the premises of a private property, and/or without invading a space made available for public use or owned by third parties. However, if such invasion is unavoidable, the collection of such data must be restricted to the minimum necessary for recording digital images.

Moreover, warning signs alerting about the existence of video surveillance devices must be clearly placed in order to inform the public about the purpose of the data collection and the contact details of the person in charge of the recording. In this regard, the Rule provides a model warning sign created by the DPA, a copy of which can be found at the end of this article.

The recorded images must not be used for a different or incompatible purpose other than that for which they were collected. Furthermore, the images obtained must be strictly related to the predefined purpose in order to prevent, as far as possible, capturing irrelevant details. Accordingly, any violation of privacy rights must be prevented and video surveillance cameras must not be installed in inappropriate places.

All images collected must be erased once the retention term fixed by the person liable for the collection has expired.

Pursuant to the current security and confidentiality measures required by the personal data protection regulations in force, each database or file containing recordings of images must be registered with the National Database Registry managed by the DPA. 

Finally, the person in charge of the database must implement a personal data protection manual or privacy policy to implement all legal requirements concerning the treatment of all captured images.