When is CCTV covered by the Data Protection Act?

Most uses of CCTV will be covered by the Data Protection Act. This gives you the right to see information held about you, including CCTV images of you, or images which give away information about you (such as your car number plate).

The Data Protection Act sets rules which CCTV operators must follow when they gather, store and release CCTV images of individuals. The Information Commissioner can enforce these rules.

If you are concerned that CCTV is being used for harassment, anti social behaviour or other matters dealt with under the criminal law, then these are matters for the police.

Law enforcement covert surveillance activities are covered by a separate Act - the Regulation of Investigatory Powers Act (RIPA) 2000 and the Regulation of Investigatory Powers (Scotland) Act (RIPSA) 2000.

What can I expect?

The CCTV operator must let people know they are using CCTV. Signs are the most usual way of doing this. The signs must be clearly visible and readable, and should include the details of the organisation operating the system if not obvious.

CCTV should only be used in exceptional circumstances in areas where you normally expect privacy - such as in changing rooms or toilets, and should only be used to deal with very serious concerns. The operator should make extra effort to ensure that you are aware that cameras are in use.

Conversations between members of the public should not be recorded on CCTV. (There are some specific exceptions to this, such as a panic button in a taxi cab or the charging area of a police custody suite).

What must a CCTV operator do?

  • Make sure someone in the organisation has responsibility for the CCTV images, deciding what is recorded, how images should be used and who they should be disclosed to;
  • Register with the Information Commissioner’s Office (check our public register);
  • Have clear procedures on how to use the system and when to disclose information; and
  • Make regular checks to ensure the procedures are followed.

When can CCTV images be disclosed?

You have the right to see CCTV images of you and to ask for a copy of them. The organisation must provide them within 40 calendar days of your request, and you may be asked to pay a fee of up to £10 (this is the maximum charge, set by Parliament). This is called a Subject Access Request. You will need to provide details to help the operator to establish your identity as the person in the pictures, and to help them find the images on their system.

  • CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.
  • An organisation may need to disclose CCTV images for legal reasons - for example, crime detection. Once they have given the images to another organisation, then that organisation must adhere to the Data Protection Act in their handling of the images.
  • Public authorities are subject to the Freedom of Information Act 2000, or the Freedom of Information (Scotland) Act 2000. This Act allows members of the public to request official information by writing to the public authority, who must respond within 20 working days. If the images are those of the person making the request, then the request would be handled under the Data Protection Act as a Subject Access Request. If, however, other people are identifiable in the CCTV pictures, then the images would be considered personal information and it is likely they would be exempt from the Freedom of Information Act.

How long can an organisation retain CCTV images?

Organisations should have a retention policy. They should only keep the images for as long as necessary to meet the purpose of recording them.

Using CCTV on your property

CCTV used on your property will be exempt from the Data Protection Act unless you are capturing footage of individuals outside your property.

However, regardless of whether your CCTV system is exempt, the ICO recommends that you use CCTV in a responsible way to protect the privacy of others.

How can I use CCTV on my property responsibly?

The guiding principle throughout the deployment of your CCTV equipment should be checking at each stage that its use is necessary and not disproportionate. For example – ask yourself:

  • Do I really need a camera to address my security concerns?
  • Would extra lighting or sensor lighting be as effective?
  • Is there an alternative to a camera?
  • Is there anyone who could advise me about alternatives?
  • What is the most privacy friendly way to set it up?
  • Can I avoid intruding into my neighbours’ property?

What if my camera captures footage of individuals beyond the boundaries of my property?

You must consider whether it is necessary for your camera to operate beyond the boundary of your property.

If your camera covers, even partially, any areas beyond the boundaries of your property, such as neighbouring gardens or the street, then it will no longer be exempt from the Data Protection Act (DPA) under the domestic purposes exemption. This does not mean that you are breaching the DPA but it does mean that you are subject to it.

What can I do to make sure that what I’m doing complies with the DPA?

First, think about the problem you are trying to address and the best solution to it. This will usually be to safeguard you and your property against crime. Check your local police advice about crime prevention. Better locks or security lighting may be a more effective and less expensive way of securing your property.

If you decide to use CCTV cameras, you should:

  • consider what areas would need to be covered by it, will the camera capture images you actually need and how you will safeguard any recorded images so they can be used by the police to investigate crimes affecting you;
  • consider whether you can put up signs clearly explaining that recording is taking place and take steps to do so if it is practical;
  • have appropriate safeguards in place to ensure that the equipment is only operated in the ways you intend and can’t be misused. At its simplest, this means that anyone you share your property with, such as family members who could use the equipment, need to know how important it is not to misuse it;
  • ensure you have activated settings to enable the security of footage captured by the CCTV system and that any recordings of individuals are held securely. Make sure that you only allow access to people who need it;
  • consider speaking to your neighbours and explain what you are doing and any objections or suggestions they have. (It may be useful to invite your neighbours to view the footage that you capture, this may allay any concerns they may have about your use of a CCTV system.); and
  • consider purchasing equipment that enables you to control what you can record. This will enable you to keep privacy intrusion to a minimum.

You should remember that your use of a CCTV system may be appropriate but publicly uploading or streaming footage of individuals will require further justification and in most cases will not be justifiable.

As the data controller for this footage, individuals do have the right to request a copy of it from you under the DPA, if you collect their personal data.

What other considerations are there?

If you cannot rely on the domestic purposes exemption you are subject to a number of requirements in the Data Protection Act. This includes a requirement to notify the ICO that you are a data controller. However, we recognise that individuals need time to adjust to these developments in the law. We do not propose to take action during the coming year against an individual for failing to register their use of domestic CCTV cameras following this judgement, except in exceptional cases. If the position changes we will update this guidance.

Many CCTV systems now come with audio recording facilities. Audio recording is particularly privacy intrusive and in the vast majority of cases where CCTV is being used on domestic properties it should be disabled.