Peru: Municipality sanctioned for illegitimate use of personal data in video surveillance system
On 14 July 2022, Peru’s La Victoria Municipality was sanctioned by the Personal Data Protection Authority of Peru for not complying with security measures in the use of surveillance cameras.
The sanction follows an investigation instituted as a result of a complaint lodged by civil society organisations Access Now and Hiperderecho in 2019 relating to the existence of facial recognition cameras in the municipality, which the organisations alleged were processing biometric data in contravention of Peru’s Personal Data Protection Law.
The investigation found that the cameras could be used to record and store images and videos to identify criminal activity and report it to the National Police of Peru (NPP), but that the facial recognition software was not currently in use. Because there was no agreement between the NPP and the municipality, the images and videos were not shared, and no personal information was processed. Despite the biometrics being inoperative, the Authority recognised the danger that may arise in future as a result of the storing of personal data captured in the municipality’s biometric system and sought to put in place corrective measures.
The resolution published by the Data Protection Authority stated that no safeguards had been put in place to secure the images captured, nor was information available on how the images would be stored and which entities could access them. In addition, the resolution found that the municipality’s conduct fell short of provisions in the Personal Data Protection Law relating to verification and management procedures for personal information.
As a result, a fine was administered to the municipality by the Director of Personal Data Protection for committing a minor infraction. The municipality was also directed to take corrective measures to put in place appropriate documentation concerning the management of privileges and periodic verification of those privileges for the processing of personal data carried out within the video surveillance system, to be done within 55 business days.
The Resolution by the Personal Data Protection Authority of Peru can be accessed here.
The Press Release by AccessNow on the resolution can be accessed here.
The Case Note by Hiperderecho can be accessed here.
Please note: The information contained in this note is for general guidance on matters of interest and does not constitute legal advice. For any enquiries, please contact us at [email protected].
