Installing a camera has never been easier: a video doorbell, a small Wi-Fi webcam, a complete system with cloud recording. That is exactly why it is easy to forget that images of an identifiable person are personal data. Whoever films must follow certain rules, and whoever is filmed has rights.
Private cameras: when the GDPR applies
The GDPR does not apply to processing carried out by a natural person in the course of a purely personal or household activity, as Article 2(2)(c) provides. A camera that covers only the inside of your home or your own garden, without filming people who do not live with you, normally falls within this exemption.
The situation changes when the camera films public spaces or other people's property. The Court of Justice of the European Union, in case C-212/13 (Ryneš), made clear that a home system that also covers part of the public street does not fall within the household exemption. In that case whoever installed the camera becomes a data controller, with the related obligations.
What this means in practice
| Field of view | Rules that apply |
|---|---|
| Inside the home only | Household exemption, except when filming domestic workers or regular guests |
| Your own garden or private entrance, no one else's space | Normally household exemption |
| Shared landing, stairs, common courtyard | Not an exclusive space: caution needed and, as a rule, it should not be filmed |
| Pavement, street, neighbour's entrance | The GDPR applies; filming must be kept to the bare minimum |
The smart doorbell
Video doorbells are the most common case of unintentionally filming other people's spaces. To reduce problems:
- angle the lens so that it covers your door and not your neighbour's, or the whole landing;
- use privacy zones, available on many models, to mask parts of the image that do not concern you;
- turn off continuous recording and keep only recording triggered by a ring or by motion;
- limit how long clips are kept to what is strictly necessary;
- think about audio: recording other people's conversations is particularly intrusive.
The criminal-law limit
Regardless of the GDPR, Article 615-bis of the Italian Criminal Code punishes anyone who, using visual or sound recording devices, unlawfully obtains information or images relating to private life taking place in another person's private dwelling. A camera pointed at your neighbour's windows is therefore not merely an administrative privacy issue.
Shared building CCTV
For the common parts of a building there is a specific rule in Italian law. Article 1122-ter of the Civil Code provides that resolutions on installing video surveillance systems in common areas are approved by the owners' meeting with the majority set by Article 1136, second paragraph, of the Civil Code.
Once the system is approved, the building's owners' association becomes the data controller and must comply with the GDPR:
- A warning sign visible before entering the cameras' range, stating the controller, the purposes and where to find the full privacy notice.
- Specified purposes, such as protecting common property and people's safety.
- Limited fields of view covering the common parts, without filming inside homes or unnecessary outdoor areas.
- Short retention of footage, proportionate to the purpose.
- Access to recordings reserved for authorised persons, for example the building manager, and allowed only when necessary.
The rights of people being filmed
If you are filmed by a system subject to the GDPR, you can:
- ask the controller, under Article 15, for access to footage of you, within the period it is kept;
- object to the filming under Article 21 if you think the field of view is disproportionate;
- request restriction of processing, to stop a recording that could serve as evidence from being overwritten;
- lodge a complaint with the data protection authority.
A concrete example
Your neighbour installs a camera on their balcony that covers the shared driveway and the entrance to your house. The first step is a direct conversation: often it is enough to re-angle the lens or set a privacy zone. If that does not work, you can send a written request citing the GDPR and, as a last resort, turn to the data protection authority. If the footage covers the inside of your home, the matter becomes a criminal one.
In short
- Cameras that cover only exclusive spaces normally fall within the GDPR's household exemption.
- If the view includes the street, common areas or someone else's property, the GDPR applies, as the Court of Justice made clear in the Ryneš case.
- Angle smart doorbells, use privacy zones and limit audio and retention.
- In an apartment building, the system must be approved under Article 1122-ter of the Italian Civil Code and needs a sign and a privacy notice.
- People who are filmed can request access to the footage, object and turn to the authority.