How to Legally Implement Video and Audio Surveillance in the Workplace: A Comprehensive Guide for Employers in Serbia

As technology advances, the implementation of video and audio surveillance systems by employers is becoming increasingly common. At Stojković Attorneys (STATT), we have received numerous inquiries about the legalities and requirements for establishing such surveillance. This article aims to clarify the conditions under which video and audio monitoring can be implemented in the workplace, as well as the necessary legal steps to ensure compliance with Serbian regulations. Understanding these requirements is essential for employers who wish to protect their assets while respecting the privacy rights of their employees.

Conditions For Establishing Video And/Or Audio Surveillance At The Employer

So, receiving numerous inquiries regarding the introduction of video surveillance by employers, in fact, prompted the writing of this article.

Self-Protective Activities

Legal entities and entrepreneurs can obtain a license for self-protective activities, as specified in Article 45 of the Law, to organize their own security services for maintaining order and protecting their property, business, premises, and people if they meet the general conditions prescribed by Article 10, paragraph 1, points 2)-6) of the Law and have at least two licensed security officers.

The general conditions that an entrepreneur or legal entity must meet to perform self-protective activities, as prescribed in Article 10, paragraph 1, points 2) to 6) of the Law, include:

1. An act on the systematization of job positions, with job descriptions and authorizations for each position.
2. An act that specifies the appearance of the uniform worn by security officers and the appearance of the badge.
3. A responsible person holding a license to perform private security duties, issued to a natural person.
4. Business premises.
5. A designated area for the storage of weapons and ammunition, in accordance with regulations on the storage and security of weapons and fire protection, if security services are performed with weapons.

Article 11 of the Law specifies the types of licenses for natural persons (security officers):

1. Risk assessment license for the protection of people, property, and business.
2. License to perform physical and technical security tasks:
   1. Basic security officer tasks – without weapons.
   2. Specialist security officer tasks – with weapons.
3. License to perform technical security tasks:
   1. Planning technical security systems.
   2. Designing and supervising the implementation of technical security systems.
   3. Installing, commissioning, maintaining technical security systems, and training users.

The conditions for issuing a license to a natural person are specified in Article 12 of the Law on Private Security and include:

1. Citizenship.
2. Residence.
3. Age.
4. Education.
5. Absence of security impediments.
6. Training for handling firearms, if tasks are performed with weapons.
7. Training in accordance with the Law on Private Security.
8. Passing a professional exam.

To obtain a license for performing technical security tasks, planning technical security systems, designing and supervising the implementation of technical security systems, or installing, commissioning, maintaining technical security systems, and training users, a natural person must have at least a secondary technical education.

Professional training for security officers is further regulated by the Rulebook on Programs and Methods of Professional Training for Performing Private Security and Guard Duties (“Official Gazette of RS”, No. 15/2019).

The professional exam for security officers is regulated by the Rulebook on the Professional Exam for Performing Private Security and Guard Duties (“Official Gazette of RS”, No. 74/2019).

A legal entity or entrepreneur can perform risk assessment and technical security tasks for their own needs if they employ security officers with the appropriate licenses.

Engaging an Authorized Legal Entity or Entrepreneur

Legal entities and entrepreneurs providing private security services as prescribed by Article 6 of the Law can hold licenses for the following tasks:

1. Risk assessment for the protection of people, property, and business.
2. Physical and technical protection of people and property, as well as maintaining order at public gatherings, sports events, and other places where citizens gather, in parts not under the jurisdiction of the Ministry of Interior.
3. Planning, designing, and supervising the implementation of technical security systems, installing, commissioning, maintaining technical security systems, and training users.
4. Securing the transport and transfer of money and valuables, in parts not under the jurisdiction of the Ministry of Interior.

Article 9 of the Law prescribes the types of licenses that the Ministry of Interior can issue to a legal entity or entrepreneur for performing private security tasks:

1. Risk assessment for the protection of people, property, and business.
2. Physical and technical protection without weapons.
3. Physical and technical protection with weapons.
4. Securing the transport and transfer of money and valuables.
5. Planning technical security systems.
6. Designing and supervising the implementation of technical security systems.
7. Installing, commissioning, and maintaining technical security systems and training users.
8. Performing self-protective activities.
9. Securing the transport and transfer of money and valuables in self-protective activities.

Article 20 of the Law on Private Security stipulates that an authorized legal entity or entrepreneur can perform private security tasks only based on and within the framework of a written contract with the legal entity, entrepreneur, or natural person to whom they provide services. The obligatory content of the contract is also specified in this article.

A private security service provider, except for risk assessment services for the protection of people, property, and business, cannot conclude a contract with a service user that provides a lower level of security services than those specified in the risk assessment act when this assessment is mandatory according to the Law.

Video Surveillance and Personal Data Protection

Video surveillance falls under technical security systems, and a risk assessment must be performed before introducing the system (unless it involves a micro legal entity), as specified in Article 20 of the Law:

“Risk assessment for the protection of people, property, and business is not required if services are provided to users for the protection of individuals, residential buildings, public gatherings where only guards engaged by the event organizer perform security services, and the protection of micro legal entities and entrepreneurs classified according to regulations governing accounting, accounting documents, business records, and financial reports.”

Personal Data Protection

Article 12, paragraph 1 of ZZPL prescribes the conditions for lawful data processing. We will focus on consent, the legal obligations of the data controller, and legitimate interest.

ZZPL defines “consent” in Article 4, point 12 as any voluntary, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or a clear affirmative action, signify agreement to the processing of personal data relating to them.

Previously, we discussed consent for data processing, and it cannot be considered an appropriate basis for processing when it comes to video surveillance introduced by the employer for two reasons:

1. The revocability of consent.
2. The imbalance of power between the employee and the employer.

Namely, Article 15 of ZZPL states that the person who gave consent has the right to withdraw it at any time. The solution for an employer to obtain consent from employees for video surveillance is not practical because if even one employee withdraws consent, data processing becomes unlawful.

It is also considered that consent for data processing requested from an employee may only be appropriate if benefits are provided to the employee and there are no consequences for withholding consent.

Therefore, in the case of introducing video surveillance, the potential basis for data processing is legitimate interest. To establish data processing on legitimate interest, a Legitimate Interest Assessment Act must be issued. A model of this act and additional explanations on legitimate interest can be found on the website of the Commissioner for Information of Public Importance and Personal Data Protection.

We remind employers that employees have the right to privacy in the workplace, so employers should not record areas where employees take breaks or restrooms. When introducing video surveillance, employers must adhere to data processing principles, including the principle of data minimization. If the purpose of processing can be achieved by other less invasive methods, these should be chosen. Violating data processing principles results in monetary sanctions under Article 95 of ZZPL.

It is necessary to clearly display notices in the premises indicating that the area is under video surveillance, in accordance with Article 23 of ZZPL, so that individuals whose data are being processed are informed.

All stated also applies to audio recording in terms of data minimization. We note that a specific law may establish the obligation for audio and video recording, as is the case with the Law on Games of Chance (“Official Gazette of RS”, No. 18/2020); in such cases, processing is based on the law, not legitimate interest.

Implementing video and audio surveillance in the workplace involves navigating a complex legal landscape. Ensuring compliance with the Law on Private Security and the Law on Personal Data Protection is crucial for employers who wish to introduce these systems. At Stojković Attorneys (STATT), we provide expert guidance to help employers meet all legal requirements, from obtaining the necessary licenses to ensuring proper data processing practices. By adhering to these regulations, employers can safeguard their business interests while maintaining the trust and privacy of their employees. For tailored legal assistance and more information, contact Stojković Attorneys (STATT).