Right to restriction of processing

The Data Subject may, with reference to Article 18.1 of the GDPR, claim the right to restriction of processing. In a basic VMS scenario, the Data Subject may claim that the VMS processing is unlawful, for example if the Data Subject is unaware that video surveillance of a public space is performed with privacy mask protection. It is recommended to use the Data Subject Request example to document the claim (see Data Subject request).

The claim should be processed within a reasonable time-frame, faster than the retention period to avoid automated retention or deletion of the VMS evidence in the claim. It is generally advised to seek legal counsel concerning restriction of processing. One way to handle such a request is to let the VMS Administrator limit VMS Supervisors or Operators by role assignment to only be able to playback recordings within a short time after they have been recorded – for instance, four hours or one day (see What should you do?: "Consider restricting access to recorded video for operators, either completely, to only the video recorded in the past few hours, or only with dual authorization"). Limitations of playback also apply to evidence locks. If further restrictions of processing are required, it is recommended to conduct both a business impact assessment and a Privacy Impact Assessment (see Conducting an impact assessment) as part of the claim handling.