Scenario: A shop owner decided to install a video surveillance system to protect the property against theft. However, the cameras also capture a…

Under Article 2 of GDPR, the regulation applies whenever personal data is processed by automated

means, including CCTV footage that captures identifiable individuals.

Option C is correct because GDPR applies when surveillance cameras capture public or third-party

areas beyond the shop owner’s premises.

Option A is incorrect because community privacy requirements do not override GDPR.

Option B is incorrect because GDPR applies even if the risk is low, as long as personal data (images of

identifiable individuals) is processed.

Option D is incorrect because GDPR applies to security cameras unless used solely for personal or

household purposes (Recital 18).

Reference:

GDPR Article 2(1) (Material scope includes video surveillance)

Recital 18 (Household exemption does not apply to public monitoring)