Video surveillance on legitimate interest needs an interest that actually exists now, not one that is speculative: a real situation of distress such as past damage or serious incidents should exist before surveillance starts, and controllers are advised to keep a record of incidents (when, how, what was lost) and of any criminal complaints. Local evidence of danger (neighbouring premises, area-specific statistics) can suffice, but national crime figures alone cannot. The interest and the necessity should be reassessed periodically, for instance yearly. Protecting property from burglary, theft or vandalism can be a legitimate interest in a real, hazardous situation; where the data subject objects, processing can continue only on compelling legitimate grounds or for legal claims. Public authorities performing their tasks cannot rely on legitimate interest.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.