Home -> Law Blog Directory -> Intellectual Property Law Blogs -> IMPACT

Intellectual Property Law

: IMPACT

New CCTV Code of Practice launched

The Information Commissioner's Office (ICO) has issued a new Code of Practice for CCTV, setting out the best practice for organisations that use CCTV, to assist with compliance with the Data Protection Act 1998 (DPA).

The previous CCTV code was published in 2000. The new Code aims to be relevant to recent developments in CCTV technology, and to put in place safeguards over the use of CCTV. The new Code is very different to the old Code, and just because an organisation's policies complied with the old Code does not mean they will be right for the new Code.

Now is a great time for organisations to review their CCTV policies and practices. If you are considering a review within your organisation, we'd be happy to help.

We've produced a brief guide to the Code, which you can read by clicking the link below.

Application

The Code applies not just to what we think of as CCTV, but to any device that records images of people, and the information about people that is obtained from those image.

What type of CCTV usage is covered by the DPA?

The Code says that the DPA will apply to most usage of CCTV, because most usage is directed at viewing/recording the activities of people. This contrasts with the previous CCTV code, which stated that only usage of CCTV to monitor/record particular individuals would be subject to the DPA. Only very basic CCTV systems will not be subject to the DPA (see FAQs below).

Performing an impact assessment

Organisations should perform an 'impact assessment' on their usage / proposed usage of CCTV to help them assess whether to use CCTV. Section 4 sets out the questions that organisations should consider as part of the assessment. CCTV should only be used if, having performed the assessment, the use of CCTV can be justified.

The assessment, the conclusions drawn, and objective justifications for using CCTV, should be recorded by the organisation, possibly as part of the organisation's wider Data Protection Policy or Manual.

Policies on operating your CCTV Scheme

An organisation should put in place clear policies for issues such as responsibility for control of the images, what is to be recorded, and how images are used. They should also consider performing regular audits to check that these policies are being complied with.

Choosing, placing and using the cameras

The Code contains detailed guidance to ensure that suitable cameras are used and sited whilst keeping privacy instrusion to a minimum. Recording conversations between members of the public is prohibited, and recording can only be lawfully performed in a small number of situations, listed in section 7 of the Code (page 10).

Storing, viewing and disclosing CCTV images

Some organisations place televisions/monitors that display CCTV images being recorded around the building. The Code sets out rules for when and how this can be lawfully done; generally, such televisions/monitors should only be visible to the public if they are showing a publically viewable area close to the television/monitor.

In terms of disclosing CCTV images (e.g. sending a video or video file outside the organisation), the Code stipulates that this should be consistent with the purpose of the CCTV scheme. For example, if the CCTV is used for crime detection/prevention, images should only be disclosed to law enforceement agencies. The organisation should have clear policies on handling disclosure requests.

For storage, the Code states that CCTV images should only be stored for as long as necessary, bearing in mind the purpose for recording the image. For example, if an organisation has CCTV to record crimes taking place on its premises, it will only need the recording for a short period because an incident is likely to be discovered soon after it occurs.

Displaying CCTV notices

In areas being monitored/recorded, organisations should place notices saying that CCTV is being used, the purpose of the CCTV, and giving contact details for the organisation.

Getting your practices and policies into shape

The new CCTV Code of Practice is a radical departure from the version released in 2000. Whilst not complying with the Code doesn't automaticalyl mean you're in breach of the DPA, it is an important factor that the ICO would take into account if it assessed your organisation's DPA compliance.

Now is a great time for revisiting your CCTV practice and policies, and wider DPA compliance policies. If you would like assistance with your review, we'd be delighted to assist.

FAQs

"We only use our CCTV for crime detection. Do we have to comply?"

The Code sets out more restricted obligations for organisations using very basic CCTV systems, where the sole purpose of recording is to record criminal incidents on the organisations premises. If you fall into this category, you have to check the points covered in Appendix 2 (page 21).

If the CCTV system is also used for checking up on employees, the wider obligations of the Code and some special obligations (see below) will apply rather than just Appendix 2.

"I use CCTV to keep an eye on my employees. What do I have to do?"

To be compliant with the DPA, that usage must be justified. Appendix 3 (page 24) discusses this subject in detail and the type of issues you must consider. If you decide you do want to use CCTV for employee monitoring, you must first go through the impact assessment discussed above.

"We're a public sector organisation. Is there anything else we should consider?"

For public authorities, there are wider questions and issues to address about use of CCTV than there are for the private sector. Most directly, the Human Rights Act applies to public authorities. The right to respect for private and family life, one of the rights turned into a legal obligation by the Act, may be infringed by use of CCTV by a public body.

The CCTV policy (or lack of) of a public authority is also likely to be disclosable under the Freedom of Information Act, and therefore subject to scrutiny by the outside world. With data protection having become a very high-profile issue for the public and the media, being seen to have poor CCTV policies or practices could prove very damaging for a public sector body.

Of course, if you receive a subject access request for CCTV images, you should not disclose any images of individuals - this would almost certainly breach the Data Protection Act.

Full post as published by IMPACT on February 07, 2008 (boomark / email).