GDPR Data Protection Act May 2018 for CCTV

Why is there a need for additional guidance?

There has been a recent court case which affects whether particular CCTV activities are covered by the DPA (Data Protection Act). This Guidance Note makes clearer which CCTV activities are covered by the DPA. It is particularly aimed at helping users of basic CCTV systems such as small businesses.

Guidance Notes

• CCTV Small User Checklist
• Good Practice Note on when the Act applies
• CCTV Code of Practice

What CCTV activities are covered by the DPA?

The court case dealt with when information relates to an individual and is then covered by the DPA1. The court decided that for information to relate to an individual, it had to affect their privacy. To help judge this, the Court decided that two matters were important:

• that a person had to be the focus of the information
• the information tells you something significant about them. So, whether you are covered or not will depend on how you use your CCTV system.

I only use a very basic CCTV system, how am I affected?

If you have just a basic CCTV system, your use may no longer be covered by the DPA. This depends on what happens in practice. For example, small retailers would not be covered who:

• only have a couple cameras,
• can’t move them remotely,
• just record on video tape whatever the cameras pick up, and only give the recorded images to the police to investigate an incident in their shop.
The shopkeepers would need to make sure that they do not use the images for their own purposes such as checking whether a member of staff is doing their job properly, because if they did, then that person would be the focus of attention and they would be trying to learn things about them so the use would then be covered by the DPA2.

It sounds like many users of basic CCTV systems are not covered by the DPA, is there an easy way to tell?

Think about what you are trying to achieve by using CCTV. Is it there for you to learn about individuals’ activities for your own business purposes (such as monitoring a member of staff giving concern)? If so, then it will still be covered. However, if you can answer ‘no’ to all the following 3 questions you will not be covered:

• Do you ever operate the cameras remotely in order to zoom in/out or point in different directions to pick up what particular people are doing?
• Do you ever use the images to try to observe someone’s behaviour for your own business purposes such as monitoring staff members?
• Do you ever give the recorded images to anyone other than a law enforcement body such as the police?