29 February 2016

If a business is using CCTV then it must comply with the Data Protection Act 1998 (DPA). It must ensure that it is using surveillance cameras for a legitimate reason, put up proper notices and provide members of the public with copies of the footage that they appear in on request. However, what if a private household has CCTV? Must they also comply and what does that mean?

Generally, there is an exemption under the DPA for processing of information in a domestic setting. However, following a decision from the Court of Human Rights in Europe in December 2014, householders who use CCTV which captures images in areas beyond the interior and exterior limits of their house, including public spaces and their neighbours’ gardens, must also comply with the terms of the DPA. In fact, the regulatory authority for the Data Protection Act, the Information Commissioner’s Office (ICO), advises that even if your cameras do not operate outwith your property, you should use the cameras in a responsible way and consider the following issues.

• Ensure that the use of CCTV is necessary under the Data Protection Act 1998 using one of the processing principles. If there is an alternative way to address this issue, then this must be considered. For example, if you want to use CCTV to deter criminal activity, would extra lighting do the same job?
   
• Put up signs indicating why you are using CCTV, advising who the operator is and providing contact details for that person;
   
  
• Ensure that the system is not misused, even by your own family. The images should not be used for any purpose other than the one stated;
  
  
• Have a system in place determining how long the images are stored for and you will have to store them securely; and
  
  
• You will be required to register with the ICO as a data controller.

The ICO has indicated that it will rarely be justified for CCTV which records sound to be used.

Finally, anyone whose personal data (their image and potentially any footage of their car) is being captured by your CCTV cameras has the right to make a subject access request under the Data Protection Act. This will oblige you to provide them with a copy of any images that you hold of them.