Closed Circuit Security Cameras (CCTV) are widely installed in both the public and private sector premises. Security cameras can be found in many places including but not limited to: business premises, educational establishments, hospitals and private properties. It has become essential equipment for the security and safety of personnel, properties and assets.
Organisations which use CCTV have a responsibility to ensure legal compliance, particularly to The General Data Protection Regulation (GDPR) and The Data Protection Act (DPA) 2018. The regulations apply to all organisations that process personal data throughout the UK and apply across all sectors. CCTV also requires implementation of appropriate technical and organisational measures.
The above regulations exist to protect the privacy rights of individuals. All organisations using CCTV or those that intend to install CCTV at their premises must comply with the regulations. Furthermore, the Human Rights Act 1998 protects individuals and their rights to be informed about being recorded in the workplace, making transparency an essential element of CCTV installation.
Considerations when using CCTV
Justifiable reasons must be provided by all organisations wishing to use CCTV on their premises. While security is the most obvious and commonly used reason, businesses should assess their security strategy to corroborate how the installation of CCTV aligns with the organisation’s principles and the principles set out in the DPA and GDPR.
Secret surveillance is not permitted under UK law. A clear sign to inform people and to deter potential criminal activity must be displayed in order to use CCTV at a premises.
Storage of the footage must be done appropriately. The organisation must limit access to the recordings to safeguard recorded individuals and ensure that recorded footage is not accessible to unauthorised third parties.
Retention of the footage is common practice and it is usually retained for about one month. Ideally it should be aligned with your organisation’s security strategy and the intended purpose of the surveillance. Typically, footage shouldn’t be held for more than six months unless it’s due to an exceptional circumstance such as prolonged investigation. Ensure your organisation has a data retention policy and if you holding data it is in line with ICO regulations in relation to business use guidelines.
The data controller of the organisation should be registered with the Information Commissioner Office (ICO) and pay a data protection fee, unless your company is exempt. Rights to access and the sharing of any footage should be designated to the data controller, ideally a senior member of the organisation. A robust and strict policy should be implemented for any footage that can identify an individual and this is usually required by law enforcement organisations.
Law enforcement agencies can legally request access to the footage. Organisations may have to share footage with the police even without an individual’s consent under certain circumstances. Co-operation with the law enforcement authorities is required in order to prevent/detect crime.
Legal representatives may also request footage from an organisation on behalf of their client to gather information on a claim or disputes such as: accidents at work and personal injury cases.
A subject access request (SAR) can be made by individuals who were recorded. Organisations must give someone a copy of the footage if it contains their data, unless an exemption applies. If the footage includes other people, then it can be redacted or blurred so others can’t be identified. The person submitting the request must specify when and where the individual was recorded and there is a duty to respond to the request within one month. The ICO has further guidance and resources related to the use of CCTV and surveillance.
CCTV offers a series of security benefits to an organisation but it must be used in compliance with the regulations. A security expert can assist organisations in the safe installation and management of CCTV and offer tailored advice to protect business security interests. Crescent Services Security Staffing and Associated Services framework offers access to fully-vetted security suppliers who are experts in the UK security sector.