Camera inspections have begun in restaurants and cafés in Cyprus: filming in dining areas is prohibited

Cyprus’ Commissioner for Personal Data Protection has begun on-site inspections of catering establishments and entertainment venues: inspectors are checking how closed-circuit video surveillance systems are installed and operated. The authority reminded businesses that image recording and audio recording constitute the processing of personal data regardless of whether the material is stored, and are subject to the GDPR and national law.

Cameras may be installed at entrances and exits, in front of lifts if the lens is directed only at the lift cabin, at a cash register or payment terminal — strictly focused on that location — and in car parks.

It is prohibited to film corridors, lift cabins, waiting areas and toilets, as well as the dining areas of restaurants, cafés and similar establishments — both indoors and outdoors. Audio recording, the authority stresses, is prohibited in principle.

Filming is permitted only for the purpose of ensuring security and protecting property — and only when the business’s legitimate interest outweighs the rights and freedoms of visitors, and there is no less intrusive means. Before entering a monitored area, the establishment must display a sufficient number of clearly visible signs stating that video recording is taking place, who is responsible for processing the data and for what purpose it is being carried out.

For systems directed at publicly accessible areas, a data protection impact assessment is generally required, as such processing is considered high-risk. In addition, establishments must ensure visitors’ rights under the GDPR, including access to the recording and its deletion.

Commissioner for Personal Data Protection Maria Christodoulou warned about the inspections at the end of August. At the time, she said she had personally seen cameras in toilets and pointed to the unlawful recording of audio in restaurants.