Most uses of CCTV will be covered by the Data Protection Act
The Data Protection Act gives you the right to see information held about you, including CCTV images of you, or images which give away information about you (such as your car number plate).
It also sets rules which CCTV operators must follow when they gather, store and release CCTV images of individuals. The Information Commissioner can enforce these rules.
If you are concerned that CCTV is being used for harassment, anti social behaviour or other matters dealt with under the criminal law, then these are matters for the police.
Law enforcement covert surveillance activities are covered by a separate Act – the Regulation of Investigatory Powers Act (RIPA) 2000 and the Regulation of Investigatory Powers (Scotland) Act (RIPSA) 2000.
CCTV filming carried out by others
What can I expect?
The CCTV operator must let people know they are using CCTV. Signs are the most usual way of doing this. The signs must be clearly visible and readable, and should include the details of the organisation operating the system if not obvious.
CCTV should only be used in exceptional circumstances in areas where you normally expect privacy – such as in changing rooms or toilets, and should only be used to deal with very serious concerns. The operator should make extra effort to ensure that you are aware that cameras are in use.
Conversations between members of the public should not be recorded on CCTV. (There are some specific exceptions to this, such as a panic button in a taxi cab or the charging area of a police custody suite).
What must a CCTV operator do?
- Make sure someone in the organisation has responsibility for the CCTV images, deciding what is recorded, how images should be used and who they should be disclosed to.
- Register with the Information Commissioner’s Office (check our public register).
- Have clear procedures on how to use the system and when to disclose information.
- Make regular checks to ensure the procedures are followed.
When can CCTV images be disclosed?
You have the right to see CCTV images of you and to ask for a copy of them. The organisation must provide them within 40 calendar days of your request, and you may be asked to pay a fee of up to £10 (this is the maximum charge, set by Parliament). This is called a Subject Access Request. You will need to provide details to help the operator to establish your identity as the person in the pictures, and to help them find the images on their system.
- CCTV operators are not allowed to disclose images of identifiable people to the media – or to put them on the internet – for entertainment. Images released to the media to help identify a person are usually disclosed by the police.
- An organisation may need to disclose CCTV images for legal reasons – for example, crime detection. Once they have given the images to another organisation, then that organisation must adhere to the Data Protection Act in their handling of the images.
- Public authorities are subject to the Freedom of Information Act 2000, or the Freedom of Information (Scotland) Act 2000. This Act allows members of the public to request official information by writing to the public authority, who must respond within 20 working days. If the images are those of the person making the request, then the request would be handled under the Data Protection Act as a Subject Access Request. If, however, other people are identifiable in the CCTV pictures, then the images would be considered personal information and it is likely they would be exempt from the Freedom of Information Act.
How long can an organisation retain CCTV images?
Organisations should have a retention policy. They should only keep the images for as long as necessary to meet the purpose of recording them.
Using CCTV on your property
CCTV used on your property will be exempt from the Data Protection Act unless you are capturing footage of individuals outside your property.
However, regardless of whether your CCTV system is exempt, the ICO recommends that you use CCTV in a responsible way to protect the privacy of others.
How can I use CCTV on my property responsibly?
The guiding principle throughout the deployment of your CCTV equipment should be checking at each stage that its use is necessary and not disproportionate. For example – ask yourself:
- Do I really need a camera to address my security concerns?
- Would extra lighting or sensor lighting be as effective?
- Is there an alternative to a camera?
- Is there anyone who could advise me about alternatives?
- What is the most privacy friendly way to set it up?
- Can I avoid intruding into my neighbours’ property?
What if my camera captures footage of individuals beyond the boundaries of my property?
You must consider whether it is necessary for your camera to operate beyond the boundary of your property.
If your camera covers, even partially, any areas beyond the boundaries of your property, such as neighbouring gardens or the street, then it will no longer be exempt from the Data Protection Act (DPA) under the domestic purposes exemption. This does not mean that you are breaching the DPA but it does mean that you might need to take some steps to comply with it.
What can I do to make sure that what I’m doing complies with the DPA?
First, think about the problem you are trying to address and the best solution to it. This will usually be to safeguard you and your property against crime. Check your local police advice about crime prevention. Better locks or security lighting may be a more effective and less expensive way of securing your property.
If you decide to use CCTV cameras, you should:
You should remember that your use of a CCTV system may be appropriate but publicly uploading or streaming footage of individuals will require further justification and in most cases will not be justifiable.
As the data controller for this footage, individuals do have the right to request a copy of it from you under the DPA, if you collect their personal data.
What other considerations are there?
If you cannot rely on the domestic purposes exemption, you will need to register with the ICO under the Data Protection Act.
The UK is recognised as a leading user of CCTV and the public are used to seeing CCTV cameras on virtually every high street. Such systems continue to enjoy general public support but they do involve intrusion into the lives of ordinary people as they go about their day to day business and can raise wider privacy concerns.
We know from our research that the public expect CCTV to be used responsibly with proper safeguards in place. We have therefore issued guidance to help organisations who use CCTV to comply with the Data Protection Act 1998 and to help them inspire public confidence that they are using CCTV responsibly.
Images of people are covered by the Data Protection Act, and so is information about people which is derived from images – for example, vehicle registration numbers. Most uses of CCTV by organisations or businesses will be covered by the Act, regardless of the number of cameras or how sophisticated the equipment is.
Many CCTV systems now come with audio recording facilities. Audio recording is particularly privacy intrusive and in the vast majority of cases where CCTV is being used on domestic properties it should be disabled.