The Information Commissioner's Office is consulting on a new draft Code of Practice for CCTV operators that will ensure compliance with the requirements of the Data Protection Act 1998. There is an existing Code of Practice and it is envisaged that the new Code of Practice will update and replace this.
CCTV images are Personal Data under the Data Protection Act and so operators should be mindful of their responsibilities in complying, in particular, with the eight data protection principles. The consultation is intended to incorporate lessons learnt from the existing Code, changes to CCTV technology, and the Human Rights Act and Freedom of Information Acts coming in to force. Another consideration in the changes to the Code is the increasing surveillance culture in the UK that is set to become more and more prevalent.
Some interesting points to note are:
- CCTV is Personal Data and so whoever is responsible must inform the Information Commissioner's Office that they are the data controller, the purposes for the CCTV and any disclosures that are made;
- The Code pushes firms to carry out an "impact assessment" to determine whether use of the CCTV is really necessary (i.e. are there less intrusive methods) and how the system will function;
- You can receive a subject access request in respect of CCTV images. This must be complied with within 40 days;
- The CCTV should not record conversations as this will almost certainly not be justified. Broadcasting audio messages to the subjects of CCTV surveillance should only be used when it is strictly necessary and the message should directly result from the purpose. "Help points" will be acceptable where the recording is two way and initiated by the person requiring the help; and
- If you are a public authority, Article 8 of the European Convention on Human Rights on the right to privacy, requires a system to be necessary for a specified purpose such as the prevention of crime or the health and safety of the public and it must be proportionate to the problem it aims to address.
The new Code is intended to be practical and user friendly and from the perspective of operators. Anyone can submit their views on the Information Commissioner's website before 31 October 2007.