Cyprus's Commissioner for Personal Data Protection, Maria Christofidou, has revealed that cameras have been found even in toilets at restaurants and other businesses, announcing a campaign of on-site inspections at hospitality, entertainment and hotel venues.
Speaking on Politis Radio's Morning Briefing programme with Katerina Eliadi, Christofidou said the installation of cameras in toilets is prohibited because such areas are directly linked to individuals' private lives.
"An on-site inspection campaign will begin in September in restaurants and entertainment venues because we have indications that there are cameras in toilets," she said.
Asked whether the information stemmed from complaints, Christofidou replied that she had personally seen such cases.
"I have seen them myself," she said.
Asked whether the issue involved only restaurants or also hotels, she clarified that concerns had also been identified in hotel establishments, while noting that some businesses operate lawfully and have submitted the required data-protection impact assessments.
Audio recording also prohibited
Christofidou also addressed the recording of sound through surveillance systems, stressing that audio recording is prohibited.
She said incidents involving restaurants had come to her attention and expressed hope that audio recording was not taking place alongside video surveillance.
The Commissioner said her office has already designed the framework for the inspection campaign.
Asked why inspections had not yet begun, she attributed the delay in part to understaffing, noting that new officers had recently been recruited and that the necessary departments to conduct inspections were still being established.
What applies to municipal cameras
The discussion arose from a request by the Paphos municipality to install surveillance cameras in parks and other public spaces because of vandalism and damage.
Christofidou explained that municipal legislation allows local authorities to install video-surveillance systems on public roads and in public areas as part of plans aimed at preventing vandalism, fires and environmental risks.
However, she stressed that this does not mean municipalities are free to install cameras without restrictions.
Compliance with both the General Data Protection Regulation (GDPR) and national legislation remains mandatory.
Municipalities must prepare and submit a data-protection impact assessment specifying, among other things:
- The locations of cameras.
- Their field of view.
- Operating hours.
- Previous incidents of vandalism.
- Measures already taken to address the problem.
The Commissioner added that she met the Union of Municipalities in February to discuss the issue, but said delays continue in the submission of the required information and in the consultation process.
Cameras appearing in public spaces
The discussion also touched on surveillance cameras that have appeared in public areas without it being clear whether the required procedures had been followed.
Christofidou stressed that cameras installed without the required consultation with her office cannot be considered lawfully installed.
Regarding Paphos, she said there is a case where cameras were installed following approval from her office after an assessment.
In contrast, when asked about cameras near sports facilities in the Polemidia municipality, she said no such approval had been granted.
The Commissioner stressed that all surveillance systems must operate under specific limitations.
Retention periods for recorded footage must be restricted and records must be kept of who has access to the data.
Rules for homes and businesses
Referring to cameras installed by private individuals at their homes, Christofidou said the key issue is the scope of coverage.
Property owners have the right to protect their own premises, but not to record neighbouring properties, public roads or pavements beyond what is strictly necessary.
She encouraged citizens who discover cameras directed at public spaces or neighbouring properties to photograph the installations and submit complaints to her office so investigations can be carried out.
As for businesses, she said cameras may, under certain conditions, cover building entrances, cash registers and parking areas.
However, unrestricted recording is not permitted in areas where people have a heightened expectation of privacy, with toilets being the clearest example.
