Kildare County Council

Resources Guidance Decisions Law Blogs Podcasts Publications Case Studies Inquiry into Kildare County Council Area: Public Authority Topic: LED Articles: 5 , 13 , 32 DPC Reference: 05/SIU/2018 Decision Date: 16 January 2023 This inquiry sought to assess whether Kildare County Council was processing personal data in compliance with the GDPR and the Data Protection Act 2018. The inquiry examined a number of the Council’s processing operations including its use of CCTV cameras in public places used for the purposes of prosecuting crime or other purposes. The findings made in the decision include: The Council had no legal basis for personal data collected via CCTV cameras at two locations for the purposes of the prevention of criminal offences. The Council had no legal basis for personal data collected via CCTV cameras for the purposes of traffic management. The Council infringed Article 5(1)(a) GDPR by sharing the live feed of traffic management CCTV cameras with An Garda Síochána without a valid legal basis. The Council lacked a lawful basis to carry out surveillance with CCTV cameras which employed Automatic Number Plate Recognition technology. The Council did not fulfil its transparency obligations under Article 13 by failing to erect signage in respect of its CCTV processing operations. The Council infringed Article 32(1) of the GDPR by failing to maintain a data log that recorded user specific accesses of the CCTV camera views and recorded footage from Naas Garda Station.