Recorded image and sound is personal data if individuals can be identified from them. The operator of recording camera surveillance (e.g. a company or authority) processes personal data with the camera system and is thus a controller, regardless of the storage time of the recordings. The camera surveillance operator is considered a controller even if the recordings are only kept for an hour.
It is impossible to issue universal guidelines for the locations of surveillance cameras or justification of camera surveillance. Each case must be evaluated on its individual merits. From the perspective of legality, the key issues are the purposes and methods of the camera surveillance, whether the subjects are informed of the surveillance and how the recordings (personal data) would be processed.
The processing of personal data always requires a basis for processing defined in the General Data Protection Regulation. The camera surveillance operator is responsible for the legality of its activities.