It is estimated there are now over 5.2 million CCTV cameras in the UK, that is, one camera for every 13 people. Whilst it is now common for businesses to have CCTV in place as part of their security and protective measures, many do not understand the privacy and data protection rules involved in filming others. Because CCTV captures visual (and sometimes audio) recordings of individuals and it is used in both public and private settings, it is impacted by the Data Protection Act 2018 (‘DPA’).
To help companies comply with the regulations, The DPO Centre has published a new white paper which aims to facilitate a better understanding of the requirements under the DPA that need to be complied with when implementing CCTV for workplace purposes. The fines issued under the DPA follow a two-tiered structure prescribed in the General Data Protection Regulation (GDPR) 2016. Fines for the misuse of CCTV fall under the higher tier, meaning that companies could be fined 4% of annual turnover or €20 million (£17 million), whichever is higher, for failing to comply.
Lenitha Bishop, Head of DPOs at the DPO Centre said “Many organisations are unaware that if you install a CCTV system on your premises, which can record individuals, you are deemed a “data controller” as you determine the means and purpose of why CCTV is needed and hold ownership of the data. As a data controller, you have responsibility for how you collect personal data in the first place and the purpose the data is to be used for. Many businesses don’t realise how much is involved, which is why we produced the CCTV white paper, as it clarifies some of the most common misconceptions.”
As well as the set-up of CCTV cameras, there are other considerations under the DPA that need to be addressed. For example, have you installed the appropriate signage required for CCTV where needed? Have you implemented a CCTV policy? Furthermore, as a business you will need to understand the process to deal with a Data Subject Assess Request (DSAR), which is when someone requests a copy of the data you hold on them. If you have CCTV cameras, this will include CCTV footage.
Another factor to consider is that if your business CCTV system allows for wireless communication, the signals should be encrypted to ensure compliance with the data security principle. Recently, there has been an increase in the use of live footage accessed via mobile phone apps. Where this is the case, access to these apps should be limited to only those individuals within your organisation for which it is completely necessary.
For any business unsure about its CCTV responsibilities, the following 9 questions will help to assess how well your organisation complies with the requirements on CCTV contained in the DPA:
- Have you carried out a Data Protection Impact Assessment for CCTV?
- Have you paid the relevant data protection fee?
- Have you implemented CCTV policies and procedures?
- Is clear signage on display and available where appropriate?
- Have you implemented a procedure on how to respond to Data Subject Access Requests (DSARs) for CCTV?
- Have you ensured you have an appropriate retention period for CCTV images?
- Have you ensured the CCTV images are of a high quality and clear?
- Are CCTV images securely stored with limited access?
- Have you implemented CCTV awareness training to all staff?
The ICO – the UK’s supervisory authority for data protection – recommends that organisations intending to install CCTV should carry out an assessment before doing so. This assists organisations to demonstrate compliance with the DPA and to maintain the safety and security of personal data at all times.
The ICO can carry out an inspection and audit on your CCTV practices to determine your level of compliance and where changes will need to be made. For any business, the start of a new year is a good time to check its data and privacy protections are in place, including a policy for CCTV.
For further guidance download a copy of the DPO Centre’s whitepaper “Looking through the lens: A guide to CCTV and data protection.” CCTV White Paper – Outsourced Data Protection Officers GDPR and Data Protection Compliance (dpocentre.com)“.
