Legal Considerations for CCTV Systems: DPIAs & Warning Signage

Implementing a CCTV system involves more than selecting and installing cameras. It also requires navigating legal obligations to comply with data protection laws and protect individual privacy.

Non-compliance can result in fines, enforcement actions, or damage to your reputation.

This guide explores the legal complexities of managing CCTV systems, helping businesses align with regulations and avoid penalties.

Contents

1. Your Legal Obligations
2. Governance of DPIAs
3. Assessing Risk
4. Warning Signage
5. Other Legal Considerations
6. Conclusion
7. Legal Considerations for CCTV – FAQs

Your Legal Obligations

Before we get into the technical aspects of CCTV installation, it is vital to address the legal obligations associated with surveillance systems.

Principle 2 of the Surveillance Camera Code of Practice states: “The user of a surveillance camera system must take into account its effect on individuals and their privacy, with regular reviews to ensure its use remains justified.”

Processing personal data through CCTV systems is considered likely to result in a high risk to individuals’ rights and freedoms under data protection law. For example, this applies when:

• Monitoring public spaces systematically and on a large scale.
• Using innovative technology, such as facial recognition or processing biometric data.

As such, businesses must conduct a Data Protection Impact Assessment (DPIA) before installing their CCTV system, and review it regularly.

Governance of DPIAs

A DPIA is a mandatory step before installing or modifying a CCTV system. It ensures risks to individuals’ rights and freedoms are identified and addressed.

Failure to complete a DPIA before deploying a surveillance camera system can lead to enforcement action by the ICO, including fines and other penalties.

What a DPIA Must Cover

• Article 35 of the GDPR (general processing) outlines when DPIAs are required.
• Section 64 of the DPA 2018 specifies requirements for law enforcement-related processing.

Additionally, the ICO has identified scenarios where a DPIA is mandatory due to high-risk processing, including:

• Introducing a new surveillance camera system.
• Processing special categories of personal data on a large scale.
• Implementing technologies such as facial recognition, ANPR, or body-worn cameras.
• Changing the location, field of view, or scope of the system.
• Altering the way images are recorded, handled, or shared.

Key Governance Practices

• As the operator of a surveillance camera system, you act as the data controller for the captured personal data and must designate a Data Protection Officer (DPO) under DPA 2018 (Sections 69-71). Seek the DPO’s advice during the DPIA process.
• Consult stakeholders, including employees, legal advisors, and individuals likely to be under surveillance, to gather feedback on privacy concerns. Use methods such as online surveys, local area committee discussions, and focus groups.
• Regularly review and update DPIAs to maintain their relevance, particularly after system changes or expansions. Factor DPIA reviews into your ongoing risk assessment procedures.
• Document decisions to ensure transparency and accountability.

The Surveillance Camera Commissioner’s Passport to Compliance provides further guidance on conducting consultations and maintaining compliance. Principle 2 of the Surveillance Camera Code of Practice also requires regular reviews to justify continued use of surveillance systems.

Assessing Risk

A thorough risk assessment ensures that CCTV systems are justified and proportionate. The process involves evaluating both the likelihood and severity of any impact on individuals’ rights, ensuring compliance with legal and ethical standards.

Steps for Risk Assessment

1. Identify Privacy Risks: Evaluate potential risks, such as decisions made using surveillance data or individuals’ lack of control over their data, and address them through system design.
2. Determine Likelihood and Severity: High risk could result from a high probability of minor harm or a low probability of significant harm. Assess both to gauge the overall risk.
3. Align with Business Needs: Ensure the surveillance system’s purpose aligns with legitimate needs, such as crime prevention or safety, without overstepping privacy boundaries.
4. Embed DPIAs: Incorporate Data Protection Impact Assessments (DPIAs) into project planning to identify and mitigate risks before deployment.

Carrying out a DPIA not only ensures compliance with the GDPR and DPA 2018, but also addresses statutory requirements under the Human Rights Act 1998 – it safeguards rights such as freedom of assembly, expression, and protection from discrimination. If residual high risks remain that cannot be mitigated, businesses must consult the ICO before proceeding.

Warning Signage

Clear and visible signage is a fundamental legal requirement for CCTV systems. Proper signage informs individuals of surveillance activities, ensuring transparency and compliance.

Signage Requirements

• Content: The signage should clearly state the purpose of the surveillance, the business name, and a contact number (preferably a switchboard number).
• Placement: Signs should be erected at all access and egress points to the surveillance area. For fenced sites, this includes all access gates. For internal cameras, signage should be visible at reception entrances and unfenced areas like driveways and paths. Additional signs may be needed if people can enter the surveillance area through non-standard routes.
• Design: Ensure signs are legible and visible, even in low-light conditions, to maximise accessibility and compliance.

Here’s an example of CCTV warning signage:

Failure to provide adequate signage can result in non-compliance with data protection regulations and potential enforcement actions by the ICO.

Other Legal Considerations

Ensuring compliance with CCTV-related laws goes beyond basic obligations like DPIAs and signage. Businesses must consider a range of additional factors to protect individual rights and maintain legal compliance.

• Facial Recognition Technology: Systems using facial recognition or biometric data require additional scrutiny and must comply with Article 9 of the GDPR. This includes ensuring explicit consent is obtained when necessary, implementing robust safeguards, and limiting the use of such technology to justified purposes.
• Data Access Requests: Individuals have the right to access footage that includes them under data protection laws. Businesses must establish clear, efficient procedures for handling these requests within the legal timeframe (typically one month) and ensure secure transmission of the data.
• Data Sharing: Access to recorded footage should be strictly limited to authorised personnel. Disclosure of footage must only occur for legitimate purposes, such as law enforcement requests, and must be logged to maintain accountability and compliance. Businesses should also implement policies to prevent unauthorised access or sharing of recorded data.
• Retention Policies: Ensure recorded footage is retained only for the period necessary to meet its purpose, as documented in your DPIA. Retention periods must comply with GDPR principles and should be reviewed periodically to avoid storing unnecessary data.
• Security Measures: Implement technical and organisational measures to safeguard recorded footage against unauthorised access, alteration, or destruction. This includes encryption, access controls, and regular audits of your security systems.

Conclusion – Legal Considerations for CCTV Systems

Compliance with legal obligations is critical when implementing CCTV systems.

From conducting DPIAs to displaying proper signage, businesses must prioritise privacy and data protection to build trust and avoid penalties.

Beyond avoiding fines, compliance fosters enhanced trust among employees and customers and improves operational efficiency by streamlining data management practices.

By aligning your CCTV strategy with legal requirements, you ensure your security measures are effective, ethical, and compliant.

Contact Kestrel Electronic Security for expert advice on legally compliant CCTV solutions.

CCTV Systems – Legal FAQs

What is a DPIA, and when is it required?

A DPIA is a Data Protection Impact Assessment that evaluates the risks of CCTV systems on individual rights. It is required for high-risk processing, such as monitoring public spaces or using advanced technologies like facial recognition.

How long can I retain CCTV footage?

The standard retention period is 31 days unless justified otherwise. Longer retention requires documentation in your DPIA.

What should CCTV signage include?

Signage must state the purpose of surveillance, the business name, and a contact number. It should be clearly visible to anyone entering the monitored area.

What happens if I don’t comply with GDPR for CCTV?

Non-compliance can result in enforcement action by the ICO, including fines and damage to your business’s reputation.

Can employees or customers request CCTV footage?

Yes, individuals can request footage that includes them under data protection laws. Ensure you have procedures in place to respond to these requests promptly.