Information notice on the Use of Surveillance Cameras at Harpa Concert and Conference Centre
Surveillance cameras monitor the premises of Harpa. The processing is based on the company’s legitimate interests in ensuring safety and protecting Harpa’s property.
The footage is not processed nor disclosed to third parties without the data subject’s consent and in consultation with the Icelandic Data Protection Authority (Persónuvernd). In the event of an accident or suspected criminal activity, the police may be provided with the footage. In such cases, all other copies are deleted by Harpa.
Controller of the surveillance system
Harpa Concert Hall and Conference Centre
Austurbakki 2, 101 Reykjavík
Tel: +354 528 5000
Email: fasteignasvid@harpa.is
Data Protection Officer
Harpa’s Data Protection Officer is attorney Gunnlaugur Garðarsson at Local lögmenn.
If you have any questions or comments about data protection, please contact: personuvernd@harpa.is.
Purpose of the Surveillance
Surveillance cameras form an essential part of Harpa’s security system. The building and surrounding area are electronically monitored, and signage is placed at entrances and indoors to inform staff and guests of this monitoring.
The purpose of the surveillance is to ensure the safety of staff, guests, property, and data, and to promote a secure and responsible environment in and around Harpa.
Legal Basis for Processing
The surveillance is carried out in accordance with Harpa’s legitimate interests in protecting property and security, cf. Article 9(6) of Act No. 90/2018 on Data Protection and the Processing of Personal Data, and point (f) of Article 6(1) of Regulation (EU) 2016/679 (GDPR).
Types of Personal Data Processed
The processing involves video recordings captured by the surveillance system, showing individuals who have passed through the monitored areas and their activities.
Recipients
All footage is accessible to Harpa’s Security Department, which oversees the surveillance system's operation. Recordings related to accidents or suspected criminal activity may be disclosed to the police. Footage may also be disclosed to an insurance company if necessary for an insurance claim.
For further details, see Articles 5 and 10 of Regulation No. 50/2023 on Electronic Surveillance.
Retention Period
Recordings are retained for 30 days before being deleted. Recordings may be kept for longer if necessary to establish, exercise, or defend a legal claim or for other legal reasons. If footage is provided to the police, all other copies are deleted.
For additional information, see Article 5(2), point 2, and Article 11 of Regulation No. 50/2023 on Electronic Surveillance.
Rights of Individuals
Individuals have the right to access footage in which they appear and to obtain a copy of such footage, provided that this does not infringe upon the rights and freedoms of others.
Other rights are governed by Chapter III of Act No. 90/2018 on Data Protection and the Processing of Personal Data, and by Chapter III of Regulation (EU) 2016/679 (GDPR).
Right to Lodge a Complaint with the Data Protection Authority
Individuals subject to electronic surveillance have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd) if they believe that the processing of their personal data is in violation of data protection legislation.