Personal Data Processing through CCTV system monitoring

The facilities of Athens International Airport “Eleftherios Venizelos” are subject to monitoring by a number of cameras of a dedicated Closed-Circuit TV System (CCTV) that has been permanently installed, in full operation, with live streaming in dedicated screens and integrated recording system. 

AIA, holds the right of usufruct of the Airport, constituted by the Greek State (as per the Airport Development Agreement (ratified by L. 2338/1995), as this has been amended and further ratified by L. 4594/2019. Within this regulatory framework, AIA is the competent entity for the management of airport operations and therefore is legally obliged to ensure airport safety and security, in compliance with the National Civil Aviation Security Regulation (NCASR) and the Technical Guidelines issued and updated by the Hellenic Civil Aviation Authority (HCAA). 

Airport CCTV system data processing is appropriate and necessary for compliance with the legal obligations - under the ADA and the ratifying laws - to which AIA is subject, but furthermore is necessary for the purposes of the legitimate interests pursued by AIA, aiming to ensure safety, security and efficiency at the Airport, for both travelers and visitors. 

In case of an incident, CCTV related recording will be stored in a separate, secure file for a period of 30 days. Still, if the incident requires further investigation, AIA will proceed with prior consultation with the Hellenic Data Protection Authority for the required retention period.   

Finally, if the required incident refers to a third person who requests from AIA to have access to the related material, AIA will retain the requested data for a period of 3 months. 

  1. Data Controller: "Athens International Airport S.A." (AIA) whose corporate seat is at Spata Attica, Administration Building (B17), P.C. 190 19, holds all rights and obligations reserved for such capacity under the European Regulation 2016/679 (GDPR) and the Greek Law 4624/2019.  
    AIA authorized representative: Director, Security Services & Director, Aviation Business Unit.

    Jointly with ΑIA, Hellenic Police - Athens International Airport Policing Directorate (Airport Police) has real-time access to CCTV system with simultaneous viewing and recording, using the same technical means and resources. Airport Police is the competent State Authority for the prevention, investigation, detection and prosecution of criminal offenses and the execution of criminal sanctions, including protection against threats to public security and their prevention, in accordance with Law 4624/2019 (A' 137/ 29.8.2019) and Directive (EU) 680/2016. More information regarding the processing of personal data by Hellenic Police can be found at: www.astynomia.gr. 
  2. Contact Details for AIA’s Data Protection Officer: 
    Manager Data Protection & Compliance 
    Athens International Airport S.A. (AIA) 
    Administration Building (17) 
    P. C. 190 19 Spata, Attica 
    tel.: +30.210.3531000 
    E-mail: [email protected] 
    https://www.aia.gr/en/privacy-notice-for-website-users 
  3. Purpose and lawfulness of processing:  
    The processing of personal data via CCTV applies as a preventive measure to ensure the efficient operation, safety and security of Airport facilities, persons and goods within, thus minimizing risk of unlawful actions.
  4. CCTV system operators: 
    CCTV is operated by AIA’s specialized personnel (operators), who have received relevant training and are responsible for the uninterrupted and efficient system operation. This staff is located in dedicated, restricted Airport areas and is accountable to assess all information, (footage) as to maintain the high level of security and efficiency in all airport airside and landside-commercial operations at the Airport. 
  5. Data processing by third parties: 
    AIA may be required to share CCTV content with the competent State Authorities, without the consent of the data subjects involved, as may be lawfully requested, in the exercise of their duties. Such information may serve as evidence in the investigation of any unlawful act being committed at the Airport, the identification and pursue of perpetrator and/or victim, as well as any other legal situation.
  6. Security of processing: 
    AIA acknowledges and respects the importance of privacy and applies adequate organizational and technical measures to ensure data confidentiality, availability and integrity and system resilience. Detailed description of CCTV system operation is presented in the corporate procedure "Management of the closed-circuit video surveillance of the Athens International Airport, SES-010205-CP". 
  7. Data retention: 
    CCTV material is retained in the system for 14 days, and thereafter automatically deleted, provided that in the aforementioned period,no incident has been identified or reported that justifies data export and storage in an area other than the system. 
  8. Data subject rights: 
    Personal data legislation in force provides rights to be exercised by the data subjects, asto affirm that personal data are being processed lawfully and securely. Persons/Data Subjects who have been at the Airport facilities have the right to request for information, access to data, deletion, objection and restriction of processing. Said person’s requests must be addressed to AIA’s Data Protection Officer. The exercise of any of the above rights is subject to applicable regulatory, or operational restrictions. 
     
    Furthermore, data subjects have the right to judicial remedy and may exercise their right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr), if they consider that AIA’s data processing infringes the applicable legislation.