Bulgarian Watchdog Advises Schools on Giving Parents Access to Surveillance Videos
Bulgaria's data protection authority provided schools with guidance Monday about protecting themselves from General Data Protection Regulation (GDPR) violations when sharing video surveillance footage with parents of children involved in school-related incidents.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Under the GDPR, the identity of bystanders in a video must be protected, the watchdog said. Accordingly, when schools share surveillance footage of an incident with parents, they must protect the identities of students captured in the video who weren't involved in the incident.
Ideally, a school's data protection officer (DPO) will blur or mask images of uninvolved students before sharing surveillance footage with parents. While the GDPR requires that all schools appoint a DPO, not every school has the ability to blur or mask video images, presenting a potential GDPR violation.
As such, the Bulgarian authority advised that the best process for these schools is to develop a protocol for certifying the review of a recording by all interested parties. This helps meet parents' expectations as it allows them to have a complete, realistic look at the circumstances surrounding the incident or conflict, the authority said.
Other procedures include requesting and obtaining explicit written consent from the parents of all children captured in a video before proceeding. An alternative to providing video is to offer still frames containing only the image of student(s) involved in the incident. Another option is providing parents with access to the video through an on-site review; however, parents of all other students in the video must be invited and present.
The DPA also noted that schools shouldn't use protecting third-party rights as a pretext to obstruct parents' lawful access requests to surveillance videos.