By Jonathan Bamford, Head of Strategic Liason.
It’s nearly five months since I last wrote about the importance of having a CCTV code fit for the demands of modern society. At that time the draft version of the code was out for consultation. Today all of your comments have been considered and our updated CCTV guidance is now available on our website.
Today’s updated CCTV code is one that is truly fit for the times that we live in. The days of CCTV being limited to a video camera on a pole are long gone. Our new code reflects the latest advances in surveillance technologies and their implementation, while explaining the key data protection issues that those operating the equipment need to understand.
So what’s changed?
Well in some respects, it’s a case of ‘keep calm and carry on’. The fundamental principles that need to be followed remain the same. People must be informed about the information being collected about them with relevant use of privacy notices and signage where required. The information also needs to be kept secure, so that the information doesn’t fall into the wrong hands, and effective retention and disposal schedules must be in place to make sure information is only kept for as long as necessary before it is securely destroyed.
However, the code must reflect the times we live in. The pace of technological change since our CCTV guidance was last updated in 2008, let alone when it was first published some 14 years ago, has been considerable. These advances bring with them new opportunities and new challenges for making sure the technology continues to be used in compliance with the Data Protection Act. One common theme from the enforcement action we have taken in relation to the use of surveillance cameras is that there needs to be a thorough privacy impact assessment. This needs to be done before deploying these increasingly powerful and potentially intrusive technologies. The code will help you stay on the right side of the law and save you the wasting money and resources on uncompliant systems.
The new and emerging technologies section of today’s code covers the key surveillance technologies that we believe will become increasingly popular in the years ahead.
A number of organisations are starting to use body worn video. These small inconspicuous devices can record both sound and images. This can mean that they are capable of being much more intrusive than traditional town centre CCTV so their use needs to be well justified with safeguards in place such as to ensure they are not used when they are not needed and strong security in case the devices fall into the wrong hands. The code has specific guidance to help deal with the challenges of using these new devices.
The guidance also considers technologies that are not currently common place, but which may prove increasingly popular in future. Just last month the Civil Aviation Authority released figures showing that over 300 companies have now been given permission to operate UAS (unmanned aerial vehicles) in the UK. This figure has risen by a third within the last twelve months alone. Many of these devices can now be bought for a few hundred pounds and can record imagery. There is important guidance on how they can be used by organisations to record personal information. Recreational users are also encouraged to operate UAS responsibly. For example, recording should be restricted and only carried out in controlled areas where people are informed that monitoring may be taking place. It is important that organisations understand these obligations at an early stage if they are to stay the right side of the law.
The code also addresses long standing issues where the consultation responses have shown that further clarification of the law is required. One such issue is the need for operators to comply with subject access requests. These requests are an important right enshrined in the Data Protection Act and allow individuals to request a record of any personal information that an organisation holds about them. This includes CCTV footage capturing their image. However, these requests have been causing a great deal of confusion, particularly for smaller operators, unaware of this area of the law. The new guide includes an expanded section explaining how these requests should be handled, when the information should be given out and the statutory deadline of 40 days that operators have to provide a full response.
We have designed our guidance to complement the Surveillance Camera Code published under the Protection of Freedoms Act. The Surveillance Camera Code’s ‘Guiding Principles’ apply to police forces, police and crime commissioners and local authorities in England and Wales as described in the Protection of Freedoms Act, and contain advice about recommended operational and technical standards that others may find useful. There is also a new Surveillance Camera Commissioner with duties to encourage compliance, provide advice and review the operation of the Code. We work closely with him and our code also refers to the further guidance he may provide.
The technology may change but the principles of the DPA remain the same. CCTV and other surveillance systems need to be proportionate, justifiable and secure to be compliant. Today’s code will help to make sure that this continues not just today, but for the years ahead.
Jonathan will be presenting the ICO’s first ever webinar at 2pm on Friday 17 October 2014. During the webinar Jonathan will discuss the key highlights from today’s guidance and will be answering your questions. You can register to attend on the webinars page of our website. If you are unable to attend but would still like to put your question to us, you can send the details to email@example.com. A recording of the webinar will also be published on the ICO website.
|Jonathan Bamford and the ICO’s Strategic Liason Department manage the ICO’s key relationships across the public, private and third sectors together with civil society and international contacts.|