Look up to the corner of any building in a public place and you are likely to see a closed circuit television (CCTV) surveillance camera. They're not just watching you out in the open air - "big brother" can be watching you as you check in at the airport or pop in to visit the bank manager. But the prevalence of CCTV cameras does not mean that their use is not legally controlled. The Data Protection Act 1998 (DPA) came into force in March 2000 and covers the processing of images of individuals caught by CCTV cameras. An important new feature of the Act is the ability of the Information Commissioner to issue Codes of Practice and the first code to be issued provided guidance on the operation of CCTV www.ico.gov.uk/documentUploads/cctvcop1.pdf
There are various issues to be considered if the owner or tenant of a building either wish to install their own CCTV system or receive a request for consent to the installation of a system by another organisation.
Is the CCTV system covered by the Data Protection Act?
If the proposed system is a basic one, its use may not be covered by the DPA. Much depends on what happens in practice and the purpose behind the system - even if your system is simple, if, for instance, you wish to use it to monitor a member of your staff who is causing you concern then you will be caught by the Act. The Information Commissioner www.informationcommissioner.gov.uk suggests that 3 questions should be asked:-
- can the cameras ever be operated remotely in order to focus in on what particular individuals are doing?
- are the images ever used to try and observe someone's behaviour for business purposes, such as monitoring members of staff?
- are the recorded images ever provided to anyone other than a law enforcement body such as the police?
If the answer is no to every question then the CCTV scheme will not be covered by the Act.
What about more sophisticated CCTV systems?
Many CCTV systems such as those found on the average high street are more sophisticated and can be used to focus in on the activities of particular people. This can be done either by zooming in, live, or by examining recorded CCTV images to monitor an employee's performance or identify a criminal, for instance. Activities such as this will be covered by the DPA but it will not cover some of the images such as a general scene which has been recorded without any incident happening.
Rule of Thumb
The simple rule of thumb which the Information Commissioner suggests we use is to decide whether the purpose behind the image taken on CCTV is to learn about a particular individual's activities. If it is, then the DPA applies.
The DPA applies - what happens next?
If some of your CCTV usage is covered by the Act, then you will have to ensure that you comply with the Act's requirements, such as:-
- making a formal notification to the Information Commissioner's Office of the fact that CCTV activities are being carried out. This should be done by the party responsible for the CCTV scheme. The notification helpline for the Information Commissioner is 01625 545 740.
- erecting suitable signs highlighting that a CCTV system covers the area.
- siting the cameras in such a way that they only monitor those spaces that are intended to be covered by the equipment (if operators can adjust the cameras, this should be restricted to ensure that the operators cannot manipulate the cameras to overlook areas not intended to be covered by the CCTV scheme).
- arranging secure storage of the recorded images, with only limited access by authorised personnel.
- ensuring that the images are only kept for long enough for any incident to come to light e.g. for a theft to be identified.
- only disclosing the images to law enforcement agencies.
- regularly maintaining the equipment, in particular the date/time stamping function.
The Information Commissioner's Office has produced a useful CCTV Small User checklist, covering these issues, designed to be used as part of a regular review process. It can be found at www.ico.gov.uk/documentUploads/CCTV%20Small%20User%20Checklist.pdf. If you are in any doubt as to how to respond to any request for access to your CCTV images, seek advice from you legal adviser as soon as possible. The Information Commissioner can also provide assistance and contact details can be found at www.dataprotection.gov.uk.
Signs must be placed in such a position that persons visiting the premises are aware that they are entering a zone which is covered by surveillance equipment. These signs must be clearly visible and legible. The size of the sign will vary depending upon the particular circumstances. A sign at an entrance door to the building may only need to be A4 due to the fact that it is at the eye level of those entering the building. But if the sign is at the entrance of a car park then the sign will usually have to be larger (e.g. A3) since it will be viewed from further away.
The sign must contain the following information:-
- the identity of the person or organisation responsible for the CCTV scheme;
- the purpose of the scheme;
- details of who to contact regarding the scheme.
The Information Commissioner has provided suggested wording as follows:-
Where an image of a camera is not used on the sign - "Images are being monitored for the purposes of crime prevention and public safety. The scheme is controlled by [Seymour Baddies]. For further information contact 01234 567 890".
Where an image of a camera does appear on the sign - "This scheme is controlled by [Ivor Picturovu]. For further information contact 01234 567 890".
Britain has the densest CCTV coverage of public spaces anywhere in the world, according to the Information Commissioner's research. An estimated 2.5 million cameras watch us, representing 10% of the world's total. So smile when you next visit the bank manager!