The need for investing in CCTV cameras is becoming ever more important, both for domestic and commercial use. CCTV has revolutionised how we protect our businesses from criminal activity and physical harm.
A shocking report from the Home Office indicates that wholesale and retail premises are most at risk. This statistic says it all; 13,426 crimes occurred per 1,000 premises. There’s no question that CCTV cameras are incredibly useful and worth investing time and money in for a commercial property.
However, there are legalities which must be adhered to through Data Protection laws with regard to recording, storing and distributing CCTV images. See more about the laws specific to CCTV hire and installation below.
Data protection laws, procedures and policies
The current Data Protection Act (DPA) came into force on March the 1st 2000, and the Information Commissioner issued a Code of Practice for CCTV systems, which has been updated throughout the years. The General Data Protection Regulation (GDPR) controls how organisations, businesses or the government uses personal information and came into force on May 25th 2018.
Under the GDPR, everyone responsible for processing personal data has to follow strict rules called ‘data protection principles’. They must make sure the information is:
- used fairly, lawfully and transparently
- used for specified, explicit purposes
- used in a way that is adequate, relevant and limited to only what is necessary
- accurate and, where necessary, kept up to date
- kept for no longer than is necessary
- handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage
The Data Protection Act also provides guidance and best practice rules for organisations and the government to follow on how to use personal data, including:
- Regulating the processing of personal data
- Protecting the rights of the data subject
- Enabling the Data Protection Authority (The ICO) to enforce rules
- Holding organisations liable to fines in the event of a breach of the rules
There are a further 30 points of good practice, which, together with the policies, are designed to build and maintain public confidence in CCTV systems and to ensure that they operate within the law. The introduction of the DPA had far-reaching consequences for those who own, manage or operate CCTV systems and don’t comply with the rules.
CCTV Filming rules
For the past 20 years it has been a criminal offence to use an unregistered CCTV system to record people in a public space. If your business uses CCTV, there are a set of specific rules that must be followed under the DPA:
- Put up a sign to let people know CCTV is being used and why
- In most circumstances, be able to provide images within one calendar month to anyone you’ve recorded
- Share images with the authorities, such as the police, if they ask for them
- Keep copies only as long as your business needs them
- Pay a data protection fee
In more detail; recordings should only be kept as long as your business needs them for a particular reason, and you are advised to delete them regularly, and when they are no longer needed. Ensure you don’t capture more footage than you need to achieve your purpose in using the system. The security of recordings should be controlled with who has access to them and ensuring the system is only used for the purpose it was intended. Every business that owns CCTV processes personal information that needs to pay a data protection fee to the ICO, unless they are exempt. The cost of the data protection fee depends on the size of property and turnover.
Sharing CCTV Footage
A trustworthy member of your team should be responsible for CCTV footage. This person should decide what needs to be recorded, how to use it and who they should present it to. The person in charge of the CCTV should also enrol with the Information Commissioner’s Office and ensure they understand how to operate the system and know when to provide appropriate information.
They should also be responsible for making sure all procedures are being followed precisely. Parliament have set up a “Subject Access Request” giving everyone the right to obtain CCTV footage of themselves. This should always be available on request within 40 days, a £10 fee may be charged.
It is also prohibited for CCTV operators to share footage of people identified with CCTV cameras. The only footage that is allowed to be released is if it’s to recognise someone for purposes requested by the police. Generally, CCTV footage should be retained for 31 days, but this can differ on occasion when it comes to severe incidents that require continual CCTV monitoring.
Capturing footage of other properties
It is easy to accidently capture other properties from your own CCTV cameras. Whether it’s a neighbour’s property, a public street or commercial property, it’s essential to take steps to ensure you comply with the data protection laws.
You are not breaking the law if you have footage of these properties.
However, as the CCTV user/owner, you are classified as the data controller. Which means you will need to comply with your legal obligations under the data protection laws and uphold the rights of the people whose images you are capturing.
Compliance is relatively simple
With regard to CCTV, a few steps can be taken to ensure you’re complying with the DPA such as informing those people that a CCTV camera may be pointing in the direction of their property. You should explain clearly that there isn’t any unlawful misuse of the footage and that they do have access to footage if needed.
Failing to comply with obligations under the data protection laws, may result in enforcement action by the ICO. This could include a fine.
They may also be subject to legal action by affected individuals who could pursue court claims for compensation or prosecution.
CCTV cameras have grown interest in commercial businesses as well as domestic buildings due to the development of technology.
If you want to install CCTV on your property it is important to keep in mind that steps have to be taken to comply with the GDPR and the DPA:
- First thing, make sure research is done into the general policies and laws of the DPA, followed by understanding specific CCTV rules that apply to you.
- Ensure a trustworthy member of your team is in control of any CCTV data and is fully informed of the policies and rules.
- Make sure owners of any properties captured by your CCTV system are aware of your system and don’t share ANY data of other people unless, for example: the police request the footage.
As long as there is full compliance with these rules, you are on track with the correct utilisation of CCTV cameras.