I. Controller of Personal Data and Purpose of Processing
The controller, Municipality of Kranj, Slovenski trg 1, 4000 Kranj, carries out video surveillance for the purpose of monitoring entry to and exit from business premises and ensuring the safety of individuals and property.
II. Contact Details of the Data Protection Officer
The Data Protection Officer can be contacted at: dpo@kranj.si
III. Legal Basis for the Processing of Personal Data
The processing is based on the controller’s legitimate interest pursuant to Article 6(1)(e) GDPR, as the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, in connection with Articles 76, 77, 78 and 80 of the Slovenian Personal Data Protection Act (ZVOP-2).
The controller justifies the overriding public interest for introducing video surveillance on the grounds that it is necessary, appropriate and proportionate for the purpose of protecting individuals and property. The video surveillance does not disproportionately interfere with the rights of individuals, who are informed about the processing and their rights.
Upon request, individuals may access the public interest assessment at the controller’s registered office or request that it be sent electronically to: dpo@kranj.si.
IV. Types of Personal Data Processed
Image/video recording of an individual, location data, date and time of recording, vehicle registration number.
V. Categories of Personal Data Recipients
The video surveillance service is carried out by an external contractor, a security service provider, with whom the controller has concluded a data processing agreement pursuant to Article 28 GDPR.
Recordings from the surveillance cameras may also be disclosed to other recipients where they demonstrate an appropriate legal basis and where such disclosure is consistent with the purpose of processing (e.g. police authorities or public prosecutors for the purpose of criminal investigations).
VI. Information on Transfers of Personal Data to Third Countries or International Organisations
Personal data is not transferred to third countries or international organisations.
VII. Specific Impacts and Unusual Further Processing
The controller has the possibility to monitor events in real time (live monitoring).
VIII. Retention Period
Recordings are retained for a maximum period of 30 days.
IX. Rights of the Data Subject
By submitting a written request at the controller’s registered office or via email to dpo@kranj.si, you may request access to recordings in which you appear.
You may also object to the processing and request restriction of processing or deletion of data.
In order to exercise your rights, you must specify the date and approximate time at which you were recorded. For the purpose of verifying your identity, additional information may be requested from you.
X. Complaint
You may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana (email: gp.ip@ip-rs.si, telephone: +386 (0)1 230 97 30, website: www.ip-rs.si), if you believe that your personal data is being processed contrary to the regulations governing personal data protection.