It is well known that organisations have obligations under the Data Protection Act 1998 to keep personal data secure and not to make unwarranted disclosures to third parties. Section 29 of the Act however provides an exemption from the non-disclosure obligations where non-disclosure would be likely to prejudice the prevention or detection of crime or the apprehension or prosecution of offenders. Images caught on CCTV cameras will also constitute personal data. The Information Commissioner's guidance on the use of CCTV confirms that "if the system is established to help prevent and detect crime it will be appropriate to disclose images to law enforcement agencies where a crime needs to be investigated."