Yes. Images captured by surveillance systems, even when not accompanied by a name or contact, can allow the direct or indirect identification of a person, therefore, they are personal data and are subject to compliance with the GDPR and principles such as purpose limitation, proportionality, and minimization.
In the work context, the Labor Code (Article 20) continues to expressly prohibit the use of remote surveillance means to control workers’ performance. Additionally, Law 58/2019, of August 8 (Article 19) states that:
- Cameras cannot focus on areas of continuous work (warehouses, workshops, desks, etc.).
- It is prohibited to capture sound, except during periods when the facilities are closed.
- Areas reserved for workers (canteens, changing rooms, restrooms) are expressly excluded.
- The employer must ensure prior and adequate information to workers, complying with Article 13 of the GDPR.
Image capture will only be legitimate if it is necessary for the safety of people and property but never as a tool for labour surveillance.
Additionally, images can only be used in criminal proceedings. Only later, and under certain conditions, can they be used for disciplinary proceedings.
In conclusion: if you intend to install a CCTV system in a work context, it should be thought of as a security tool, not a supervision tool.