Video Surveillance & Data Protection

Who is the data controller?

The business that installs cameras on its premises and decides how the footage is used is the data controller. It is responsible for defining the purposes, completing the formalities with the CNDP, informing the people being filmed and complying with retention and access rules.

VIDEO.MA acts as a solution and hardware provider, integrator and, where applicable, a service provider acting on its customer’s behalf within the scope defined by the contract. VIDEO.MA can advise and support its customers through these steps, but this support is no substitute for advice from their own legal counsel, and deploying a VIDEO.MA solution does not in itself make a system compliant.

Prior formalities with the CNDP

Law No. 09-08 requires prior formalities with the CNDP before personal data is processed, which take the form of either a declaration or an application for authorisation depending on the case. Video surveillance receives particular attention from the Commission, which has issued specific guidance on the subject.

Before installing new cameras or adding an analytics purpose to existing ones, it is advisable to check which formality applies, to describe the intended purposes precisely and, if a system has already been declared, to consider whether adding analytics functions requires an update.

Informing people and signage

People who may be filmed, whether customers, visitors or employees, must be informed that the system exists. In practice, this means clearly visible signs at the entrance to the areas concerned, stating in particular that video surveillance is in operation, who is responsible for it and how to exercise one’s rights, supplemented where needed by more detailed information available on request.

Proportionality, retention and access

A video system must be proportionate to its purpose. A few key principles:

• film only the areas needed for the declared purpose, without covering public roads or neighbouring properties beyond what is strictly necessary;
• never film private areas such as toilets, changing rooms or rest areas;
• keep footage only for as long as strictly necessary, with the retention period defined in advance;
• restrict access to footage and dashboards to authorised people only, and log that access;
• for analytics purposes, favour aggregated indicators over storing footage.

Employees and staff representatives

Where cameras cover workplaces, employees must be clearly informed that the system exists and what it is used for, and staff representative bodies consulted where this is required. A video system must not be used to monitor an employee continuously at their workstation or to assess their individual productivity.

The analytics offered by VIDEO.MA focus on flows and processes (waiting times, occupancy, service durations, throughput in a zone), not on the performance of named individuals.

Our approach: privacy by design

VIDEO.MA designs its solutions to minimise the personal data processed:

• aggregated, anonymous indicators (counts, occupancy rates, average durations) rather than individual data;
• on-site edge processing (Edge AI) wherever possible, so that footage does not need to leave the customer’s premises;
• no facial recognition or biometric identification in our standard offerings;
• no individual monitoring of employee productivity;
• masking zones to exclude irrelevant parts of the image from analysis;
• minimal retention periods, keeping only aggregated results when footage is not needed;
• access control with logging, and secured video streams and equipment (network segmentation, strong passwords, updates).

What we will not deploy

VIDEO.MA does not take on projects intended to film private areas, identify people without their knowledge, track individual employees or use a system for purposes other than those declared. Where a specific requirement falls outside our standard offerings, it is subject to a preliminary study that includes its data protection implications.

People who are filmed: exercising your rights

If you have been filmed in premises equipped with a video system, requests for access, correction or objection should be sent to the business concerned, which is the data controller. You may also contact the CNDP.

For any question about how our solutions are designed, or to prepare a project on the right footing, please contact us via the Contact page (/en/contact).