But actually, it includes any data that can be used to identify a living person, and that includes still or video images. So video captured by CCTV systems may be covered by the DPA and therefore those responsible for collecting and processing it should operate within the eight principles of data protection.
The eight DPA principles (abridged) are that personal data shall:
- be processed fairly and lawfully
- be obtained only for specified and lawful purposes
- be adequate, relevant and not excessive
- be accurate and kept up to date
- not be kept for longer than is necessary
- be processed in accordance with the rights of data subjects
- be protected against unauthorised or unlawful processing and against accidental loss
- not be transferred outside the EEA without protection for the rights and freedoms of data subjects
The Information Commissioner’s Office (ICO) is responsible for promoting and policing the DPA.
They recently revised the CCTV code of practice to take account of updated technology including automatic number plate recognition (ANPR), body-worn video and drones.
The new code has the not-so-snappy title ‘In the picture: A data protection code of practice for surveillance cameras and personal information’ (wow, that's a mouthful isn't it?) and provides advice on good practice for those who operate CCTV systems.
As well as complying with the ICO’s standard code of practice, operators should ensure that they incorporate the updated 'in the picture' revisions into their own policies, codes of practice, staff training and systems.
If you don’t have a separate CCTV policy or code of practice, video images should at least be referenced in your Data Protection policy. A CCTV code of practice should set out clearly the purposes for which CCTV is used, how the data is processed, stored and deleted and under what circumstances it can be passed on to data subjects or third parties.
Operators of CCTV systems have to keep careful records of what they do with video data, including when and why they pass copies on to third parties such as the police or others, so a comprehensive code of practice should include the forms or logs to be used.
Staff, customers or visitors should know that video recording is in use and why. They should also know who to contact if they want to request a copy of video images by making a data subject request, although they may not be entitled to see it if other people can be identified on the video too.
Picaw’s proprietary Oggle remote video system is compliant with the DPA and the ICO code of practice, so long as users and operators have a robust policy which is carefully followed.
If you'd like to talk about data protection and your CCTV system then give us a call on 0845 287 3622 or send us an email and let's see how we can help you.