NOTICE ON THE PROCESSING OF PERSONAL DATA THROUGH VIDEO SURVEILLANCE SYSTEMS (CCTV)
Introduction
This Notice concerns the processing of personal data through video surveillance systems (closed circuit television – CCTV) operating in individual facilities and areas of the Municipality of Rhodes (hereinafter referred to as the “Municipality” or “Municipality of Rhodes” or “we”).
This Notice is addressed to any natural person who enters or is in video-surveilled areas of the Municipality of Rhodes, in particular to citizens, visitors, associates and employees (hereinafter jointly referred to as “data subjects” or “you”).
For reasons of security and protection of persons, facilities, goods and assets, as well as for the prevention and management of security incidents, the Municipality of Rhodes has installed and operates video surveillance systems through closed circuit television cameras. The operation of the systems involves the capture of images of persons and, consequently, the processing of personal data.
The Municipality of Rhodes respects the privacy and fundamental rights of data subjects and is committed to processing personal data in a lawful, fair and transparent manner, in accordance with applicable data protection legislation. This Notice aims to provide you with clear and understandable information on how and why data is collected and used through video surveillance systems, the period of their retention, their recipients, the protection measures applied, as well as your rights.
“Personal Data Protection Legislation” means in particular the General Data Protection Regulation (EU) 2016/679 (GDPR), Law 4624/2019, Directive 1/2011 of the Hellenic Data Protection Authority on the use of video surveillance systems, as well as the relevant guidelines of the European Data Protection Board (EDPB).
Data Controller
The Controller of personal data through video surveillance systems is the Municipality of Rhodes, which determines the purposes and manner of processing the data collected.
Contact details:
Municipality of Rhodes
Eleftherias Square, Rhodes, 85100, Greece
Tel.: +30 22413 61200
Email: info@rhodes.gr
Website: https://www.rhodes.gr
Obligations of the Data Controller
The Municipality of Rhodes, as Data Controller, complies with the obligations arising from the General Data Protection Regulation (EU) 2016/679 (GDPR), Greek Law 4624/2019 and the relevant directives and decisions of the Hellenic Data Protection Authority (HDPA), in particular Directive 1/2011 on the use of video surveillance systems.
The Municipality of Rhodes ensures that the processing of personal data through video surveillance systems is carried out in accordance with the principles of legality, transparency, necessity and proportionality and that appropriate technical and organizational security measures are taken.
The specific regulations concerning the exercise of the rights of data subjects, as well as the applied security measures, are described in detail in the corresponding sections of this information.
Purpose of Processing, Necessity of Operation and Legal Basis
The MUNICIPALITY’s video surveillance system has been installed and operates in accordance with the principle of necessity and proportionality, exclusively for the purposes of the security of persons and property and, in particular, for the prevention, deterrence and documentation of incidents that may constitute criminal acts or security violations on MUNICIPALITY premises.
The operation of the system is part of the exercise of the MUNICIPALITY’s responsibilities and the fulfillment of a duty performed in the public interest. The MUNICIPALITY ensures that the operation of the system is organized and implemented in accordance with the principles of necessity, proportionality, legality, transparency and data minimization, taking the appropriate technical and organizational protection measures.
The data collected through video surveillance systems are used exclusively for the above purposes and are not used for monitoring work, evaluating the behavior or efficiency of employees, in accordance with article 27 of law 4624/2019.
The legal basis for the processing of Personal Data through video surveillance systems is the performance of a task carried out in the public interest or in the exercise of public authority vested in the Municipality of Rhodes, in accordance with article 6 par. 1 lit. e of the General Data Protection Regulation (GDPR) and the applicable national legislative framework.
Video-Surveilled Areas
The video-surveilled areas concern selected points of the Municipality’s infrastructure and facilities, which have been identified based on the needs for the safety of persons and property. The cameras have been placed in appropriate positions so that monitoring is limited to areas related to the intended purpose of the processing, while the Municipality takes care to limit recording to the absolute minimum and to regularly review the operation of the system.
Camera operating hours
Some cameras of the video surveillance systems of the Municipality of Rhodes operate on a continuous basis (24 hours a day, 7 days a week), while others operate at specific time intervals, depending on the security needs of each area. These cameras may operate both during working hours and outside of them, especially during night hours and holidays, in order to enhance the protection of the facilities and prevent and respond to security incidents.
Video Surveillance Data
Video surveillance systems record the movement in the video-surveilled areas in combination with the date and time of recording. The image from the cameras operating at any time may be available in real time (live image) at authorized points of the Municipality, exclusively for security purposes.
Video surveillance systems collect only image data and do not record audio.
Recipients
The material collected through video surveillance systems is accessible exclusively to a limited number of competent and authorized personnel of the Municipality of Rhodes, who are responsible for the security of the premises and act within the framework of their responsibilities.
Video surveillance data are not communicated or transmitted to third parties, unless this is provided for by applicable legislation and in particular in the following cases:
a) to competent judicial, prosecutorial or police authorities, upon lawful request and in the context of exercising their powers, in particular for the investigation of criminal acts,
b) to competent judicial, prosecutorial or police authorities, when the data is necessary for the prevention or response to security incidents,
c) to the person depicted in the data, under the conditions set out by law, in particular when it concerns a victim or a person involved in a security incident and provided that the rights and freedoms of third parties are not affected.
Retention Period – Storage Duration
Personal data collected through video surveillance systems are kept for a maximum period of fifteen (15) days, after which they are automatically deleted.
If, within the above period, an incident related to the safety of persons or goods is detected, the relevant part of the recorded material is isolated and kept in a separate and secure file, exclusively for the purpose of investigating the incident.
Specifically:
• in the event of an incident concerning the Municipality of Rhodes (e.g. damage to facilities or assets), the relevant material may be kept for up to thirty (30) days,
• in the event of an incident concerning a third party (e.g. a citizen, visitor or employee), the relevant material may be kept for up to three (3) months, in accordance with Directive 1/2011 of the Personal Data Protection Authority.
In cases of criminal acts or upon a lawful request by competent judicial, prosecutorial or police authorities, the material may be kept for as long as required within the framework of the respective procedure, in accordance with applicable legislation.
Access to the recorded video surveillance material is strictly limited to a small number of authorized persons.
Video Surveillance Data Protection
The Municipality of Rhodes takes appropriate technical and organizational measures to protect personal data collected through video surveillance systems, in order to prevent unauthorized or unlawful access, use, alteration, loss or disclosure.
The data is kept in information systems with limited and controlled access, installed in controlled and classified access areas. Access to video surveillance systems and the data they collect, including live images and recorded material, is allowed only to a small number of clearly defined and authorized persons, exclusively for purposes related to security and the exercise of their official duties.
Access rights are determined based on roles and responsibilities, in accordance with the principle of necessity and minimum access, so that each user has access only to the information necessary to perform their duties. All persons who have access to the system are bound by an obligation of confidentiality.
Rights of Data Subjects
In accordance with the General Data Protection Regulation (GDPR), you have the following rights in relation to the processing of personal data concerning you through the video surveillance systems of the Municipality of Rhodes:
• Right to information. You have the right to be informed about the processing of your data, in particular regarding the purpose and legal basis of the processing, the period of retention of the data, their recipients, as well as the manner of exercising your rights, through this information, the relevant signage in the video-surveilled areas and the information available on the Municipality’s website.
• Right to access. You have the right to know whether data concerning you are being processed and, where applicable, to receive information regarding such processing and, where feasible, a copy of the relevant material, provided that the rights and freedoms of third parties are not affected.
• Right to restriction of processing. You have the right to request the restriction of processing, under certain conditions.
• Right to object. You have the right to object to the processing of your data, for reasons related to your particular situation, in accordance with the conditions set out in the GDPR.
• Right to erasure. You have the right to request the deletion of data concerning you, provided that the legal conditions are met and subject to the condition that the data is not necessary for the fulfillment of legal obligations of the Municipality or for the establishment, exercise or support of legal claims.
These rights are exercised either by submitting a document (a Formal Declaration validated via gov.gr or validated for the original signature via Citizens Service Centre (KEP) to the Municipality’s protocol at the address: “Municipality of Rhodes”, (1 Plateia Eleftherias Street, P.C. 85100, tel. 22413 61200) – Attention: Data Protection Officer, in which the request will be described as well as the method of communication with the interested party, or by sending an email to the address: dpo@rhodes.gr to which the above Responsible Declaration will be attached.
The Data Controller shall provide the Data Subject with information without undue delay and in any case within one month of receipt and identification of the request. This deadline may be extended by two more months, if necessary, taking into account the complexity of the request and the number of requests.
To facilitate the examination of requests concerning images from video surveillance systems, you may be asked to specify, as far as possible, the time and place where you were within the range of the cameras, as well as to provide identification information, in order to enable the identification of the relevant data and the protection of the data of third parties that may be depicted.
Alternatively, you may be given the opportunity to demonstrate the images in which you appear on site, if this is deemed appropriate.
The exercise of the rights of objection or deletion does not automatically entail the deletion of data or the cessation of processing. Each request is examined on a case-by-case basis and responded to within the deadlines provided for by the GDPR.
Restrictions and protection of third parties
In cases where the images include third-party natural persons, the Municipality of Rhodes takes appropriate measures to protect their rights, such as, for example, hiding (blurring) images or partially satisfying the request, in accordance with applicable legislation.
If a criminal act has been recorded through video surveillance systems in which a person is involved as a victim or perpetrator, the relevant material may be provided under the conditions and restrictions provided for by law and the existence of any prohibition by a competent judicial authority.
Right to file a complaint
If you consider that the processing of your data violates the legislation on the protection of personal data or that your request has not been lawfully satisfied, you have the right to file a complaint with the Personal Data Protection Authority (PDPA), as the competent supervisory authority in Greece. The Authority’s website is located at https://www.dpa.gr.
Data Protection Officer (ΥΠΔ – DPO)
The Municipality of Rhodes has appointed a Data Protection Officer (ΥΠΔ – DPO), with whom you can contact for any issue concerning the processing of personal data and the exercise of your rights, at the following email address:
dpo@rhodes.gr
Amendments to this Notice
The Municipality of Rhodes may amend or update this Notice, when necessary, in particular in order to respond to changes in the applicable legal and regulatory framework, to changes in the way video surveillance systems operate or to related organizational needs.
Any amendment or update to this Notice shall enter into force on the date of its publication. The most recent version is always available on the official website of the Municipality of Rhodes, at the following addresses:
https://www.rhodes.gr/cctv
https://www.rhodes.gr/cctv-en
This Notice is dated so that data subjects can determine when it was last revised.
Date of last update: 30 January 2026
