Camera above the bar and GDPR: what the operation must comply with

If you want to install a camera above the bar, you will encounter several layers of legislation: GDPR (EU Regulation 2016/679), Act No. 110/2019 Coll. On the processing of personal data, and primarily Section 316 of the Labour Code regarding employee monitoring. This article will guide you through what you actually need to comply with.

1. Basic rule: Section 316 of the Labour Code

Paragraph 2 is the key one: The employer must not, without serious grounds arising from the special nature of its activities, infringe upon an employee's privacy at the workplace and in common areas by subjecting the employee to open or covert monitoring, eavesdropping, recording of telephone conversations, checking of electronic mail, or inspection of postal correspondence addressed to the employee.

In plain terms: for camera monitoring of a bar you need serious reason. For bars, this typically involves asset protection and shrinkage prevention, 20% of average losses is a critical figure for the venue's economics.

2. Legal basis: legitimate interest, not consent

The correct legal basis is legitimate interest (Article 6(1)(f) of the GDPR). You must provide this with a document. DPIA (Data Protection Impact Assessment), where you will describe:

• Which risks do you want to cover with monitoring (shrinkage, theft, consumption control)?
• What other less invasive methods did you consider (manual inventory, scales) and why were they insufficient?
• How privacy intrusion is minimised (overhead camera, no faces, only shelves and hands).

3. Information obligation

You must give employees verifiable notice in advance. Not verbally, not "there's a sign somewhere in the kitchen". Specifically:

1. In writing (attachment to the employment contract or a separate document with a signature).
2. The information includes: monitoring scope, purpose, legal basis, record retention period, and access rights.
3. Mark the area with a pictogram with the notice "area is monitored" and a link to the responsible person.
4. If the camera also records guest areas, guests must be informed as well (sign at the entrance, notice in the menu, on the website).

4. What cameras may and must not do

• ✅ Aim at work surfaces and shelves (objects, not people).
• ✅ Record hand movements and pouring actions (verifiable reason).
• ❌ Recording faces without a strong reason (each face = another DPIA).
• ❌ Deploy in back-of-house areas (staff rooms, toilets, kitchens outside alcohol service points).
• ❌ Transferring records to the cloud without security (ideally process on edge, send only metadata to the cloud).

5. Retention and access

A typical reasonable retention period for records is 7-14 days. Longer only with justification (e.g., incident investigation). After expiry, the recording is automatically overwritten.

Access to the record is restricted to a narrow circle of individuals: the owner or an external Data Protection Officer. Maintaining an access log is mandatory.

6. Pre-installation checklist

• ☐ Completed DPIA (have a lawyer draft it; 2-3 pages suffice for the first version).
• ☐ Record of processing activities (Article 30 GDPR).
• ☐ Signed information document for employees.
• ☐ "Monitored" pictogram at the bar entrance.
• ☐ Technical settings: overhead camera, no faces, edge processing.
• ☐ Retention policy (7-14 days default).
• ☐ Contract with an AI subcontractor (processing agreement under Article 28 of the GDPR).

7. Risks and sanctions

For breaches of information obligations, the ÚOOÚ imposed several fines in the tens of thousands of Kč between 2023 and 2025 (MOS). Systematic violations without a DPIA can result in penalties up to 4% of global turnover / 20 million EUR under GDPR. In practice, for a small bar, this usually means a warning and an order to rectify, but the legal risks in a dispute with a former employee are real, and costly.

Conclusion

A camera above the bar is legal and commonly accepted if you meet the procedural requirements. Good news: most of the work is done once during installation; afterwards, you only need to maintain retention and awareness. BarBee provides this part in the pilot package, so you don't have to deal with paperwork.

← Back to blog