Data protection and video surveillance: For many construction companies, this sounds like bureaucracy that slows down everyday life on the construction site. But is that really true? We spoke to an expert who knows first-hand: Ms. Bielefeld, central data protection coordinator at the Zech Group, is responsible for data protection for one of the largest groups of companies in the German construction industry, with numerous operating units and construction sites throughout Germany.
In the interview, she makes it clear that data protection only becomes a problem if it is considered too late. Those who involve him in the planning early on benefit from legal certainty, more efficient processes and a professional appearance vis-à-vis clients and authorities.
“Data protection is not an obstacle if you think about it in good time”
What motivated Ms. Bielefeld to conduct the interview is a central idea: data protection should not be perceived as a brake. Instead, it should be seen as an integral part of a professional security concept. “Data protection only becomes an obstacle if it is considered too late,” she emphasizes. In practice, she regularly finds that cameras are set up first and then the question of legal compliance arises. A procedure that at best costs time and at worst leads to considerable risks.
Things are different at the Zech Group. Ms. Bielefeld is involved at an early stage as soon as processing that deviates from standard processes or involves risks is planned, for example when it comes to new construction site monitoring. Your team ensures that all units are set up in compliance with data protection regulations and have contact persons for data protection issues.
What principles apply to video surveillance?
For the Zech Group, clear data protection principles apply to video surveillance, which can be derived directly from the GDPR:
Pixelation and anonymization
Providers must be able to automatically make faces and license plates unrecognizable. For Ms. Bielefeld, this is not an optional extra, but a basic requirement.
Limited storage periods
Recordings may only be stored for as long as the purpose requires. In practice, storage periods of up to 72 hours have proven to be appropriate on a regular basis. Longer storage is only permitted in the case of specific incidents.
Documentation
All processing operations must be documented in the record of processing activities in accordance with Art. 30 GDPR, including the perspective of the cameras and affected groups of persons.
Transparency
Both sides, client and service provider, must openly communicate what they can do and what is required.
Before the technology is in place: Asking the right questions
Before a camera is even set up on a Zech Group construction site, the project undergoes a structured inspection. Ms. Bielefeld describes the process as follows:
Risk assessment: What are the specific risks, i.e. theft, vandalism, unauthorized access? Only on the basis of real risks can a viable balancing of interests in accordance with Art. 6 para. 1 lit. f GDPR must take place.
Check the legal basis: In most cases, the legitimate interest of the construction company is the basis, provided that a balancing of interests shows that it outweighs the rights of the data subjects.
Where and when is it recorded? Not every area may be monitored. Public areas, neighboring properties and areas where employees spend time may not be filmed. The time limit also plays a role: ideally, the cameras should only run after the end of working hours.
Who is affected? Construction workers, suppliers, passers-by: all potentially filmed persons must be identified and taken into account in the data protection concept.
Proportionality: Is the planned surveillance appropriate for the specific location? Not every construction site needs the same setup.
What a good provider should deliver right from the start
One of the clearest messages from the interview: Ms. Bielefeld expects providers of mobile video surveillance solutions to see data protection as an integral part of their service offering.
In concrete terms, this means that relevant documents should already be included in the offer, above all an order processing contract (AV contract) in accordance with Art. 28 GDPR and documentation of the technical and organizational measures (TOMs). “Companies that have something like this on offer right from the start take an incredible amount of work off my hands,” explains Ms. Bielefeld. “And it shows that they take the issue seriously.”
She also appreciates service providers who develop individual solutions instead of offering standardized solutions without taking project-specific requirements into account. This includes dealing with the specific construction site, taking operating times into account, adapting camera positions to the location and, in the best case, even visiting the site. “As a client, you can tell pretty quickly whether someone has really dealt with the subject matter,” says Ms. Bielefeld.
Typical problem areas with other providers
Ms. Bielefeld speaks openly about problems she has encountered with various providers of mobile video surveillance, which are unfortunately not uncommon in the industry.
Unclear retention periods
Providers who do not know or do not clearly communicate how long recordings are stored and when they are deleted.
Data protection as a chargeable extra
Ms. Bielefeld reports on providers who offer GDPR compliance as an optional additional service. “Every site manager who has to save money doesn’t tick this box. That simply cannot be an option.”
Lack of anonymization
Cameras that capture the entire construction site, including public areas and neighboring buildings, without pixelation, without a concept.
Lack of service concept
Many providers supply technology, but no advice. A company like the Zech Group expects the service provider to provide proactive information and support.
Lack of ability to provide information
For Ms. Bielefeld, receiving no or evasive answers to basic data protection questions is a clear warning signal. “The GDPR has been directly applicable since 2018. You can’t say: ‘You’re the first to ask something like that’.”
What are the risks of non-compliance?
Data protection breaches in video surveillance are not a theoretical risk. The GDPR provides for fines of up to 20 million euros or four percent of annual global turnover, whichever is higher. According to the supervisory authorities, video surveillance is one of the most frequent grounds for complaint to the data protection authorities.
Ms. Bielefeld assesses the risks pragmatically: “Fines are one thing; in case of doubt, they always affect us as the responsible party.” There is also the threat of project stoppages if a serious breach is discovered, as well as reputational damage, which is almost impossible to calculate for a company the size of the Zech Group.
What is particularly relevant here is that responsibility under data protection law always lies with the client, i.e. the construction company itself, not the service provider. Even if an external provider technically operates the mobile video surveillance, the construction company remains the controller under data protection law within the meaning of Art. 4 No. 7 GDPR.
From the field: When customization makes the difference
Ms. Bielefeld describes a situation that shows how crucial the responsiveness of a provider is. In one project, it turned out that the signage did not meet the requirements and certain information obligations under Art. 13 GDPR were not fully met.
The requirements were clearly formulated in consultation with the provider, and the necessary adjustments were made and implemented to the satisfaction of all parties involved. “This was not highly critical, but it showed how important it is that a provider responds to our specifications and really implements them.”
In contrast, it also reports a case in which it had to end its collaboration with another provider because basic data protection requirements could not be met. “My recommendation was to replace the provider with a professional. Although this results in higher costs in the short term, these are secondary compared to the potential reputational risk.”
Three recommendations from the data protection expert
At the end of the interview, Ms. Bielefeld summarizes her most important advice for companies that want to use a solution like VIDEO GUARD:
1. integrate data protection at an early stage: Don’t install first and ask questions later, but think about the issue from the outset. Those who take data protection into account in the planning phase will save themselves corrections, conflicts and costs later on.
2. concept before technology: Before cameras are installed, a clear concept is needed: Which areas are to be monitored? At what times? Who is responsible? Which legal basis applies? Technology is only as good as the concept behind it.
3 Prevention pays off: The following applies to both theft protection and data protection: investing beforehand will save you many times over afterwards. The costs of a professional monitoring system are disproportionate to the potential follow-up costs of an incident or data protection breach.
Zech Group: Responsible, risk-aware, legally compliant
When asked what the Zech Group stands for when it comes to data protection and security, Ms. Bielefeld has a clear answer:
“Responsible, risk-aware and legally compliant solutions, without actionism.”
This guiding principle is reflected in the entire collaboration: no hasty decisions, but well thought-out concepts that take into account both the protection of the construction site and the rights of all parties involved.
Conclusion: Data protection as a quality feature
The conversation with Ms. Bielefeld clearly shows that data protection-compliant video surveillance is not an insurmountable hurdle, but a quality feature of professional construction site security. Companies that rely on GDPR-compliant solutions at an early stage not only protect their construction sites from theft and vandalism, but also protect themselves from legal and financial risks.
For providers of surveillance solutions, this means that those who see data protection as part of their service promise and proactively provide the right documentation, advice and individual adaptations will gain the trust of demanding customers.
This is exactly where VIDEO GUARD comes in: with GDPR-compliant systems, automatic pixelation, German data processing, ISO 27001-certified operation and its own 24/7 control center in Germany. Because real security begins with trust. Trust begins with transparency.
Would you like to find out what data protection-compliant construction site monitoring can look like for your project? Get in touch with us, we will advise you individually and without obligation.
Frequently asked questions about the control center in construction site monitoring
Is mobile video surveillance permitted on construction sites?
Do I need a data protection impact assessment (DPIA)?
What documents should a video surveillance provider provide?
How long can video recordings be stored on construction sites?
What fines can be imposed for data protection violations?
The GDPR provides for fines of up to 20 million euros or four percent of annual global turnover. Video surveillance is one of the most frequent grounds for complaint to data protection authorities. Added to this are possible project stoppages and reputational damage.
