The European Data Protection Board has issued guidance on the use of video surveillance.

• The monitoring purposes of cameras should be documented in writing.
• Data subjects must be informed of the purpose(s) of the processing: “safety” or “for your safety” is not sufficient
• The most likely legal bases for video surveillance are: legitimate interest and “necessary in the public interest.”
• Data subjects’ consent can only serve as a legal basis in exceptional cases.
• When blurring the picture with no retroactive ability to recover the personal data the picture previously contained, the personal data are considered erased in accordance with GDPR.
• The notice under Article 13 should be provided in a layered manner – first layer (warning sign) and second layer (other location).
• Controller should implement technical measures to fulfill an access request without revealing the identities of other people (e.g. image-editing such as masking or scrambling).
• If the video footage is not searchable, data subject should in its request, specify when, within a reasonable time frame, he or she entered the monitored area.

[View source.]