Data protection commissioner launches surveillance audits in hospitality sector

The Data Protection Commissioner's Office in Cyprus has announced the commencement of onsite audits targeting catering and entertainment businesses. The primary objective of these inspections is to evaluate compliance with the General Data Protection Regulation (GDPR), specifically regarding the operation of closed-circuit television (CCTV) systems. The move follows an increase in daily inquiries and public complaints concerning the legality of surveillance in restaurants and recreational venues.

Commissioner Maria Christofidou clarified that while cameras may be installed to protect property at entrances, exits, cash registers, and parking areas, recording customers while they dine or in corridors is strictly prohibited to protect personal privacy. Furthermore, the commissioner emphasized that audio recording by surveillance systems is explicitly banned. Both image and sound are classified as personal data under the law regardless of whether they are actively stored.

The authorities have warned that failure to comply with these regulations can lead to enforcement actions. Depending on the severity of the infringement, the Commissioner's Office may issue formal reprimands, mandate corrective measures, or impose administrative fines. These audits are intended to ensure transparency, security, and adherence to established privacy frameworks for all citizens.