# Large-Scale Monitoring PIA — Workflows

## Workflow 1: Monitoring Inventory and Classification
1. Identify all monitoring systems operated by the organisation (CCTV, email monitoring, GPS tracking, internet logging, badge access, behavioural analytics).
2. For each system, document: technology used, coverage area/scope, data types collected, retention period, number of data subjects affected.
3. Classify each system by monitoring type: video surveillance, communications interception, location tracking, internet monitoring, behavioural profiling.
4. Determine if the monitoring covers a publicly accessible area (Art. 35(3)(c) trigger).
5. Assess the scale: number of individuals, geographic scope, continuous vs periodic, data volume.
6. Record results in the monitoring register.

## Workflow 2: Necessity and Proportionality Assessment
1. Document the specific, concrete purpose for each monitoring system (not generic "security" but specific threat being addressed).
2. Assess whether the purpose could be achieved without monitoring (alternative measures analysis).
3. Evaluate less intrusive monitoring alternatives: reduce coverage area, limit hours, reduce resolution, mask non-relevant areas.
4. Conduct the EDPB balancing test: legitimate interest of controller vs fundamental rights and freedoms of data subjects.
5. Consider reasonable expectations of data subjects in the monitoring context.
6. Document the proportionality conclusion with supporting reasoning.

## Workflow 3: CCTV Compliance (EDPB Guidelines 3/2019)
1. Document the lawful basis (typically Art. 6(1)(f) legitimate interests; Art. 6(1)(e) public task for public authorities).
2. Verify signage at the boundary of monitored areas: camera pictogram, controller identity, monitoring purpose, reference to full notice.
3. Ensure full privacy notice is accessible (QR code, website link, reception desk).
4. Set retention period: default maximum 72 hours; document justification if longer retention needed.
5. Define access controls: who can view footage, under what authorisation, incident-related access procedure.
6. If facial recognition is used: verify explicit consent or substantial public interest legal basis and DPIA.
7. Implement privacy masking for areas not relevant to the monitoring purpose (neighbouring properties, public footpaths).

## Workflow 4: Employee Monitoring Compliance
1. Identify all employee monitoring activities and their purposes.
2. Conduct Barbulescu proportionality assessment: prior notification, extent of monitoring, legitimate reasons, less intrusive alternatives, consequences for the employee, adequate safeguards.
3. Provide clear employee monitoring policy distributed to all staff.
4. Consult works council or employee representatives where required by national law.
5. Ensure monitoring does not capture protected activities (trade union, whistleblowing, legal privilege).
6. Restrict covert monitoring to exceptional circumstances (reasonable suspicion of criminal activity, no alternative means, time-limited, authorised at senior level).
7. Document the employee monitoring assessment.

## Workflow 5: Monitoring Data Subject Rights
1. Establish a process for data subjects to exercise access rights to monitoring data (e.g., CCTV footage of themselves).
2. Define identity verification process for subject access requests to monitoring data.
3. Implement a process to redact third-party data from monitoring records before disclosure.
4. Establish the right to object process: assess objection against legitimate grounds for monitoring.
5. Document and track all monitoring-related data subject requests.

## Workflow 6: Retention and Deletion
1. Define default retention periods for each monitoring system.
2. Implement automated deletion at retention period expiry.
3. Define the exception process: incident-related retention freeze with justification, time limit, and authorisation.
4. Conduct periodic audit of retention compliance.
5. Document retention decisions and deletion confirmations.