CCTV and Data Protection

Law

Kate Grimley EvansSolicitor

Stone King LLP

Uses of CCTV

Camera uses

Crime Prevention

Student behaviour

Lesson/staff monitoring

Facial recognition

Which uses are OK?

Answer : It depends!

You must comply with the Data Protection

Act in deciding whether or not to start or

continue the use.

So how?

Privacy Impact

Assessment

Information Commissioner provides a Privacy Impact

Assessment Code of Practice with a precedent

PIA.

It helps you consider the Data Protection

Principles.

It isn’t compulsory but doing one is good practice and likely to improve your

legal position.

Data Protection

Principles

• fair (from Data Protection Principle 1)

• proportionate in relation to the purpose of the system (from Data Protection Principle 3)

What you do

should be:

Data Protection Principles

Principle 1

Personal Data shall be processed fairly and lawfully and , in particular, shall not be processed unless--

(a) at least one of the conditions in Schedule 2 is met and

(b) in the case of sensitive personal data, at least one of the conditions in schedule 3 is also met

Principle 3

Personal data shall be adequate, relevant and not excessive in relation to the purposes or purposes for which they are processed.

Being Fair

• What is the effect on

individuals’ privacy?

More likely to be unfair if there is

continuous filming or filming in

areas where people expect

privacy e.g. changing rooms,

private offices

Compliance with a schedule

2 Condition

Consent

Implied or express

Legitimate interests condition

The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Proportionality

Personal data shall be adequate, relevant and not excessive in

relation to the purpose or purposes

for which they are processed

Is using cameras the best way to achieve your objective? Have

you looked at alternatives?

How good are the images? If they are not good enough for the purpose then you

may not be able to justify the use

Deciding if your use is

compliant

• Do a privacy impact assessment

• Consult the ICO’s Employment Practices

Code

• Consult the ICO’s CCTV Code of Practice

What to think about

The ICO CCTV Code will help you comply but think about these things

• Why do you want to use CCTV. Is it the best way to achieve your objective

• Will people know what you are doing?

• Signs

• Privacy Notices (DfE precedents available)

• Do you have a CCTV policy or a Data Protection Policy covering the issue

• How long are you keeping the images?

• What are the data storage arrangements?

• Individual rights of subject access

• Staff training

• Does your registration with the ICO (officially called the ‘Notification’) show that you have CCTV? You are no longer required to list all the purposes for which you use CCTV but you do need to say that you have CCTV. There is currently no up to date guidance on the notification process and no indication of when new guidance will be issued but there is an ICO notification helpline which is 0303 123 1113.

Overlap with other issues

Facial recognition – biometric technology – follow DfEGuidance on Biometrics in schools

Staff Monitoring – refer to the ICO Employment Practices Code

Employment Practices

Code

Whenever you are filming staff to monitor performance or conduct consult this Code and also do a Privacy Impact Assessment. There is overlap between this Code and a PIA but the Code will help you make sure you have asked the right questions.

Whether you should be monitoring in a particular case

Privacy impact

Considering alternatives

Practical examples

• Monitoring staff all the time is very privacy intrusive.

• Can you really justify a camera being on in a classroom or workplace all the time?

• Is it necessary?

• Can you limit the area covered?

• Private areas are different from corridors.

• Be careful about relying on consent in the employment context

Requests for disclosure of

footage

FOI requests

DPA subject access requests

DPA disclosures not under

subject access

Subject access requests to

view footage

Balancing the data rights of different people

• Section 7(4) Where the data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless—

(a) the other individual has consented to the disclosure of the information to the person making the request, or

(b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual

Subject Access Requests

Subject Access Code of Practice

(chapter 7)

Some guidance

provided but legal advice

often necessary

Useful links

• CCTV Code of practice published by the Information Commissioners

Office. This is available here:

• ICO notification helpline which is 0303 123 1113.

• Formal privacy assessment. See here.

• If you are monitoring staff through a surveillance system then you

should make sure you have complied with the ICO’s Employment

Practices Code.

• Are you using the DfE standard form privacy notices for staff and

students and have you adapted them to cover any issues specific to

your school?

• Is the data secured securely? If you are using Cloud Storage, follow

the ICO’s guidance on Cloud Computing

• Are you using cameras to identify people ie. via facial recognition. If

so, you must follow the DfE guidance on biometric technologies

Questions

Questions and General discussion

Slide 1 Some rights reserved by charbel.akhras

Slide 2 Some rights reserved by Tulane Public Relations

Slide 3 Some rights reserved by seven_resist

Slide 4 Some rights reserved by vintagedept

Some rights reserved by rpongsaj

Slide 6 Some rights reserved by ssalonso

Slide 7 Some rights reserved by David Maddison

Slide 8 Some rights reserved by MyTudut

Slide 9 Some rights reserved by StockMonkeys.com

Some rights reserved by BlueAndWhiteArmy

Some rights reserved by Bernie Goldbach

Slide 10 Some rights reserved by mollybob

Slide 12 Some rights reserved by Editor B

Some rights reserved by Re-Entry One Stop

Slide 14 Some rights reserved by ChrisGoldNY

Slide 15 Some rights reserved by khairoun

Slide 16 Some rights reserved by winnifredxoxo

Slide 19 Some rights reserved by Raymond Bryson