Martyn Walley, group technical manager with Scolmore, looks at the implications of the new data protection act for those organisations that use CCTV systems to protect their premises and offers advice on how businesses can ensure they are acting compliantly.
The issues surrounding GDPR have been well documented in the run up to and post the implementation of this new legislation in May this year, but how many in the industry are aware of the implications for operators of CCTV systems?
Under the new regulations, every organisation or sole trader (excluding private domestic users) that processes personal information is required to pay a data protection fee to the ICO (Information Commissions Office), unless they are exempt – and this also includes CCTV.
When is CCTV covered by the General Data Protection Regulation?
Most uses of CCTV will be covered by GDPR. The data protection regulation gives you the right to see information held about you, including CCTV images of you, or images which give away information about you (such as your car number plate). It also sets rules which CCTV operators must follow when they gather, store and release CCTV images of individuals. The Information Commissioner can enforce these rules.
CCTV filming carried out by others
The CCTV operator must let people know they are using CCTV. Signs are the most usual way of doing this. The signs must be clearly visible and readable, and should include the details of the organisation operating the system if not obvious.
What must a CCTV operator do?
- Make sure someone in the organisation has responsibility for the CCTV images, deciding what is recorded, how images should be used and who they should be disclosed to.
- Have clear procedures on how to use the system and when to disclose information.
- Make regular checks to ensure the procedures are followed.
When can CCTV images be disclosed?
You have the right to see CCTV images of you and to ask for a copy of them. The organisation must provide them within 30 calendar days. You will need to provide details to help the operator to establish your identity as the person in the pictures, and to help them find the images on their system.
- CCTV operators are not allowed to disclose images of identifiable people to the media – or to put them on the internet – for entertainment. Images released to the media to help identify a person are usually disclosed by the police.
- An organisation may need to disclose CCTV images for legal reasons – for example, crime detection. Once they have given the images to another organisation, then that organisation must adhere to the Data Protection Act in their handling of the images.
How long can an organisation retain CCTV images?
Organisations should have a retention policy. They should only keep the images for as long as necessary to meet the purpose of recording them.
Head of Enforcement at the ICO, Steve Eckersley, commented on a recent case where a company faced substantial fines for breaking data protection laws by failing to comply with an Information Notice. The company also failed to register with the Information Commissioner’s Office (ICO), despite it being a criminal offence to do so.
He said: “Not registering with the ICO, and, in addition to this, not complying with an information notice are criminal acts – let it act as a stark warning to other companies who flout the law that we will take robust action.”
Here is a quick CCTV compliance checklist to help you ensure you and your clients are operating lawfully:
- Signage should be clearly visible and readable. It will also need to show details of the organisation operating the system, the purpose of its use and who to contact if there are any queries.
- Signs should be an appropriate size in relation to its context.
- If the sign needs to be seen by a car driver it should be bigger, and if it is in a shop then a small sign would be more suitable.
- All staff should know what to do and who to contact if a member of the public enquires about the CCTV system. Any signs in a public area must show the organisation or authority responsible for the systems.
- Take care when it comes to positioning your CCTV cameras. Although your cameras may be positioned on site, they may still capture images of people walking by. If this is the case your CCTV signage should be visible outside the business too.
- As a business user or sole trader, make sure you register your system with the ICO.
For further information, contact ESP on 01527 515150, email info@espuk.com or visit www.espuk.com
