Video Surveillance and the LGPD: Cameras in Public and Private Spaces

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The spread of video surveillance systems in Brazil calls for close attention to the General Data Protection Law, because images captured by cameras are sensitive personal data that require proper legal treatment.

What Counts as Personal Data in Video Surveillance

Under the LGPD (Brazil’s General Data Protection Law, Law No. 13.709/2018), personal data means any information that can identify a natural person or make that person identifiable. Images from security cameras, whether installed in public or private settings, record people’s physical features, behavior, routes and the times they move through a space. Each of these elements, alone or combined, allows a data subject to be identified directly or indirectly. That is why the handling of these images falls under the LGPD.

Modern video surveillance systems also frequently incorporate facial recognition, behavioral analysis and pattern detection. These features make the processing far more intrusive, because they can generate biometric data, which the LGPD classifies as sensitive personal data (art. 5º, II). Processing sensitive data requires more restrictive legal bases, set out in art. 11 of the law, and imposes additional obligations on the controller, such as preparing a Data Protection Impact Assessment (Relatório de Impacto à Proteção de Dados Pessoais, or RIPD).

We note that simply installing a security camera already constitutes a data processing operation. It covers the collection, storage, access and any sharing of the images. Anyone, whether an individual or a company, who operates a video surveillance system therefore acts as a data controller and must fully comply with the LGPD, regardless of the size of the organization or the stated purpose of the recording.

Legal Bases That Apply to Image Capture

The right legal basis for processing security camera images depends on the context in which the images are captured. In private spaces open to the public, such as shopping centers, banks, hospitals and retail businesses, the basis most often invoked is the controller’s legitimate interest (art. 7º, IX, of the LGPD). In that case, the controller must show that the purpose of the monitoring (protecting property, ensuring people’s safety, preventing unlawful acts) is legitimate, that the processing is necessary to achieve it, and that the controller’s interests are balanced against the data subject’s fundamental rights and freedoms.

When the government carries out video surveillance in spaces used by the general public (streets, squares, transit terminals), the applicable legal basis is usually the execution of public policies (art. 7º, III) or the protection of life and physical safety (art. 7º, VII). Even so, the principles of the LGPD still apply, especially purpose, adequacy, necessity and transparency (art. 6º). The government does not have a blank check to monitor citizens indiscriminately in the name of security.

In exclusively private settings (homes, offices with restricted access, internal areas of companies), the data subject’s consent may be required, particularly when cameras capture images of employees in situations that go beyond protecting property. In the employment context, installing cameras in areas such as locker rooms, restrooms and cafeterias is prohibited under well-settled labor case law, because it violates the worker’s privacy and dignity, which are protected by art. 5º, X, of the Federal Constitution.

Installing security cameras without complying with the LGPD can turn a legitimate protective tool into a source of civil and administrative liability for the controller.

We stress that choosing a legal basis is not an arbitrary decision for the controller. The choice must reflect the real purpose of the processing and be documented before any recording begins. Switching legal bases after processing has started is a practice that Brazil’s National Data Protection Authority (ANPD) may treat as irregular, especially if the controller appears to be trying to get around the limits of a more restrictive legal basis.

Controller Obligations and Compliance Best Practices

The controller of a video surveillance system must take a number of steps to ensure compliance with the LGPD. The first is preparing the RIPD, a document that describes the processing activities, assesses the risks to data subjects and sets out mitigation measures. Although the LGPD does not specify every situation in which a RIPD is mandatory, the ANPD may request one at any time (art. 38), and having one shows the controller’s diligence.

Transparency is another fundamental pillar. Data subjects must be informed, clearly and accessibly, that monitoring is taking place, why, how long the images are stored, and how they can exercise their rights. In practice, this means visible notices at monitored locations, up-to-date privacy policies and effective channels for data subjects to reach the controller. Generic signs reading “Smile, you are being filmed” are not enough to meet the duty to inform under art. 9º of the LGPD.

As for storage, it is essential to set retention periods that are proportionate to the purpose of the processing. Images captured to protect property, for example, do not need to be kept for years. Legal scholars generally consider a period of 30 to 90 days reasonable, unless the images are needed as evidence in a judicial or administrative proceeding. In that case, longer retention is justified by the regular exercise of rights (art. 7º, VI).

Technical and administrative security measures are also indispensable. The controller should put in place access controls for the images (limiting viewing to authorized people), encryption for storage and transmission, access logs for auditing, and procedures for responding to security incidents. Leaked security camera footage can seriously harm data subjects and must be reported to the ANPD and to those affected, as required by art. 48 of the LGPD.

It is also worth stressing the importance of periodic due diligence on video surveillance systems. This review should cover equipment upgrades, the purposes of the processing, the suitability of retention periods and the effectiveness of security measures. Companies that acquire or merge with other organizations should include video surveillance systems in their data due diligence, assessing whether existing processing is compliant and what risks they are inheriting.

Facial Recognition and Smart Video Surveillance

Using facial recognition technology in video surveillance systems deserves special attention under the LGPD. Facial biometric data is classified as sensitive personal data, and it may be processed only in the specific situations listed in art. 11 of the law. In most surveillance scenarios in public and semi-public spaces, obtaining the data subject’s specific and prominent consent (art. 11, I) is not feasible. That leaves the controller to ground the processing in other legal bases under art. 11, such as fraud prevention and the data subject’s security (art. 11, II, “g”).

The debate over facial recognition in Brazil is still evolving. Several bills are pending in the National Congress that would regulate the use of this technology by the government and the private sector. Until specific legislation exists, the LGPD, the Marco Civil da Internet (Brazil’s Internet Civil Framework, Law No. 12.965/2014), the Consumer Protection Code and the Federal Constitution itself provide the framework for assessing whether these practices are lawful.

Video surveillance systems that use artificial intelligence for behavioral analysis (detecting suspicious movements, crowds or abandoned objects) also raise significant concerns about algorithmic discrimination and bias. Art. 20 of the LGPD gives data subjects the right to request review of decisions made solely on the basis of automated processing of personal data. When a smart surveillance system automatically labels a person’s behavior as “suspicious” and triggers actions (an alert to security guards, an entry in a database), the data subject may request review of that automated decision.

Organizations that plan to adopt facial recognition or behavioral analysis in their video surveillance systems should carry out a rigorous proportionality assessment, document in detail why the technology is necessary and consider less intrusive alternatives. Adopting these tools without a proper impact assessment can expose the controller to significant administrative penalties, including fines of up to 2% of the company’s revenue (art. 52 of the LGPD).

Data Subject Rights and Civil Liability

People whose personal data is captured by video surveillance systems have all the rights set out in art. 18 of the LGPD. These include the right to confirm that processing exists, to access the data, to correct incomplete data, to have unnecessary data or data processed in violation of the law deleted, and to be informed about sharing with third parties. In practice, a person filmed by security cameras can ask the controller for access to the images in which he or she appears, as well as for information about who has had access to those images and how long they will be stored.

Responding to these requests creates operational challenges for the controller. It may be necessary to find specific footage within large volumes of recordings and to apply anonymization techniques to protect third parties who also appear in them. Despite these difficulties, the controller cannot simply refuse to honor the data subject’s rights by claiming technical impossibility, and doing so exposes it to liability.

On civil liability, the LGPD adopts a regime that may be strict (without proof of fault) in consumer relationships, when read together with the Consumer Protection Code. Harm caused by leaked images, misuse for purposes incompatible with the original one, or recording in places where people expect privacy can give rise to an obligation to pay compensation for non-pecuniary (moral) and material damages. Brazilian courts have recognized presumed non-pecuniary damage (in re ipsa) in cases where improper image capture violated a person’s privacy.

We consider it essential for organizations to maintain a data protection governance program that specifically covers their video surveillance systems. The program should include documented internal policies, regular training for staff who operate or access the systems, incident response procedures and mechanisms for honoring data subject rights. Appointing a data protection officer (DPO), as required by art. 41 of the LGPD, is mandatory, and this person must have specific knowledge of the data protection issues that apply to video surveillance.

This topic is directly related to the LGPD in practice, which we cover in a dedicated article.

This topic is directly related to the LGPD and liability, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.