Please note: The following information has not been updated since the Data Protection Act 2018 became law. Although there may be some subtle differences between the guidance on this page and guidance reflecting the new law – we still consider the information useful to those in the media. This guidance will be updated soon to reflect the changes
When is CCTV covered by the Data Protection Act?
Most uses of CCTV will be covered by the Data Protection Act.
The Data Protection Act gives you the right to see information held about you, including CCTV images of you, or images which give away information about you (such as your car number plate).
It also sets rules which CCTV operators must follow when they gather, store and release CCTV images of individuals. The Information Commissioner can enforce these rules.
If you are concerned that CCTV is being used for harassment, anti social behaviour or other matters dealt with under the criminal law, then these are matters for the police.
Law enforcement covert surveillance activities are covered by a separate Act - the Regulation of Investigatory Powers Act (RIPA) 2000 and the Regulation of Investigatory Powers (Scotland) Act (RIPSA) 2000.
What can I expect?
The CCTV operator must let people know they are using CCTV. Signs are the most usual way of doing this. The signs must be clearly visible and readable, and should include the details of the organisation operating the system if not obvious.
CCTV should only be used in exceptional circumstances in areas where you normally expect privacy - such as in changing rooms or toilets, and should only be used to deal with very serious concerns. The operator should make extra effort to ensure that you are aware that cameras are in use.
Conversations between members of the public should not be recorded on CCTV. (There are some specific exceptions to this, such as a panic button in a taxi cab or the charging area of a police custody suite).
What must a CCTV operator do?
- Make sure someone in the organisation has responsibility for the CCTV images, deciding what is recorded, how images should be used and who they should be disclosed to.
- Have clear procedures on how to use the system and when to disclose information.
- Make regular checks to ensure the procedures are followed.
When can CCTV images be disclosed?
You have the right to see CCTV images of you and to ask for a copy of them. The organisation must provide them within 30 calendar days. This is called a Subject Access Request. You will need to provide details to help the operator to establish your identity as the person in the pictures, and to help them find the images on their system.
- CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.
- An organisation may need to disclose CCTV images for legal reasons - for example, crime detection. Once they have given the images to another organisation, then that organisation must adhere to the Data Protection Act in their handling of the images.
- Public authorities are subject to the Freedom of Information Act 2000, or the Freedom of Information (Scotland) Act 2000. This Act allows members of the public to request official information by writing to the public authority, who must respond within 20 working days. If the images are those of the person making the request, then the request would be handled under the Data Protection Act as a Subject Access Request. If, however, other people are identifiable in the CCTV pictures, then the images would be considered personal information and it is likely they would be exempt from the Freedom of Information Act.
How long can an organisation retain CCTV images?
Organisations should have a retention policy. They should only keep the images for as long as necessary to meet the purpose of recording them.