Jonathan Bamford – head of strategic liaison at the Information Commissioner’s Office (ICO) – discusses the ICO’s updated CCTV Code of Practice and outlines why a revised Code is required to meet the demands of modern society.
It’s nearly five months since I last wrote about the importance of having a CCTV Code fit for the demands of modern society. At that time the draft version of the Code was out for consultation. Now, all of your comments have been considered and our updated CCTV guidance is available on the ICO’s website.
The updated CCTV Code is one that’s truly fit for the times in which we live. The days of CCTV being limited to a video camera on a pole are long gone. Our new Code reflects the latest advances in surveillance technologies and their implementation, while also explaining the key data protection issues that those operating the equipment need to understand.
So what’s changed? Well, in some respects it’s a case of ‘keep calm and carry on’. The fundamental principles that need to be followed remain the same. People must be informed about the information being collected about them with relevant use of privacy notices and signage where required. The information also needs to be kept secure so that it doesn’t fall into the wrong hands, and effective retention and disposal schedules must be in place to make sure information is only kept for as long as necessary before it’s securely destroyed.
However, the Code must reflect the times. The pace of technological change since our CCTV guidance was last updated in 2008 – let alone when it was first published some 14 years ago – has been considerable. These advances bring with them new opportunities and challenges for making sure the technology continues to be used in compliance with the Data Protection Act.
One common theme from the enforcement action we’ve taken in relation to the use of surveillance cameras is that there needs to be a thorough privacy impact assessment. This needs to be conducted before deploying these increasingly powerful and potentially intrusive technologies. The Code will help operators to stay on the right side of the law and save them from wasting money and resources on non-compliant systems.
New and emerging surveillance technologies
The new and emerging technologies section of the updated Code covers the key surveillance technologies that we believe will become increasingly popular in the years ahead.
A number of organisations are starting to use body-worn video. These small, inconspicuous devices can record both sound and images. This can mean that they are capable of being much more intrusive than traditional town centre CCTV. On that basis, their use needs to be well justified with safeguards put in place such as to ensure they are not used when they’re not needed. There must be strong security in case the devices fall into the wrong hands. The Code details specific guidance to help deal with the challenges of using these new devices.
The guidance also considers technologies that are not currently commonplace, but which may prove increasingly popular in future. Just last month, the Civil Aviation Authority released figures showing that over 300 companies have now been given permission to operate UAS (Unmanned Aerial Surveillance) in the UK. This figure has risen by a third within the last 12 months alone. Many of these devices can now be bought for a few hundred pounds and can record imagery. There’s important guidance on how they can be used by organisations to record personal information.
Recreational users are also encouraged to operate UAS responsibly. For example, recording should be restricted and only carried out in controlled areas where people are informed that monitoring may be taking place. It’s important that organisations understand these obligations at an early stage if they’re to remain on the right side of the law.
The updated CCTV Code also addresses long-standing issues where the consultation responses have shown that further clarification of the law is required. One such issue is the need for operators to comply with subject access requests. These requests are an important right enshrined in the Data Protection Act and allow individuals to request a record of any personal information that an organisation holds about them. This includes CCTV footage capturing their image.
However, these requests have been causing a great deal of confusion, particularly for smaller operators unaware of this area of the law. The new CCTV guide includes an expanded section explaining how these requests should be handled, when the information should be given out and details of the statutory deadline of 40 days by which time operators have to provide a full response.
Complementing the Surveillance Camera Code of Practice
We’ve designed our guidance to complement the Surveillance Camera Code of Practice published under the Protection of Freedoms Act 2012. The Surveillance Camera Code’s ‘Guiding Principles’ apply to police forces, Police and Crime Commissioners and local authorities in England and Wales as described in the Act, and contain advice about recommended operational and technical standards that others may find useful.
The technology may change but the principles of the Data Protection Act remain the same. CCTV and other surveillance systems need to be proportionate, justifiable and secure in order to be compliant.
The updated ICO Code will help to make sure that this situation continues for the years ahead.