# Large-Scale Monitoring PIA — Standards and Legal References

## Primary Legislation

- **GDPR Article 35(3)(c)** — Mandatory DPIA for systematic monitoring of a publicly accessible area on a large scale.
- **GDPR Article 6(1)(f)** — Legitimate interests as lawful basis for monitoring; requires balancing test against data subject rights.
- **GDPR Article 5(1)(c)** — Data minimisation principle applicable to monitoring scope and data collection.
- **GDPR Article 5(1)(e)** — Storage limitation; monitoring data retention must be justified and time-limited.
- **GDPR Article 22** — Automated individual decision-making restrictions applicable to behavioural analytics derived from monitoring.
- **ePrivacy Directive 2002/58/EC Article 5** — Confidentiality of communications; applicable to internet and communications monitoring.
- **ECHR Article 8** — Right to respect for private and family life; applies to workplace and public space monitoring (Barbulescu v Romania, 2017; Lopez Ribalda v Spain, 2019).

## Regulatory Guidance

- **EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices** — Comprehensive guidance on CCTV surveillance including legal basis, transparency, retention, subject rights, and facial recognition.
- **EDPB WP248rev.01** — DPIA criteria; systematic monitoring (C3) and large scale (C4) as mandatory DPIA triggers.
- **EDPB Guidelines 8/2020 on Targeting of Social Media Users** — Monitoring and profiling of individuals through social media platforms.
- **ICO Employment Practices Code (2011)** — UK guidance on monitoring at work including CCTV, email, internet, and vehicle tracking.
- **ICO CCTV Code of Practice** — Practical guidance for organisations operating CCTV and surveillance camera systems.
- **CNIL Guidance on Workplace Monitoring (2023)** — French DPA requirements for employee surveillance systems.
- **UK Surveillance Camera Code of Practice** — Statutory code under the Protection of Freedoms Act 2012 Section 29.

## Case Law

- **Barbulescu v Romania (ECtHR Grand Chamber, 2017)** — Established criteria for assessing proportionality of employee communications monitoring under ECHR Article 8.
- **Lopez Ribalda and Others v Spain (ECtHR Grand Chamber, 2019)** — Covert video surveillance in the workplace; conditions under which covert monitoring may be permissible.
- **Antovic and Mirkovic v Montenegro (ECtHR, 2017)** — Video surveillance in university lecture halls violated Article 8; monitoring of professional activities in a public space still engages privacy rights.

## Industry Standards

- **ISO/IEC 27001:2022** — Information security management applicable to monitoring system security.
- **ISO/IEC 27701:2019** — Privacy information management supporting proportionality assessments for monitoring.
- **BS 7858:2019** — Security screening of individuals employed in a security environment.
- **EN 50132 series** — European standards for CCTV surveillance systems for use in security applications.
- **NIST SP 800-53 Rev. 5 AU controls** — Audit and accountability controls applicable to monitoring systems.