Does Your Data Protection Policy Cover CCTV?
Picaw can help you with that ...
The Data Protection Act (DPA) ensures that our personal information is not misused by those who collect and process it. Usually, we think of this data as names, addresses, phone numbers, bank or credit card account details and so on ...
If your data protection policy doesn't cover CCTV then call Picaw for help!
copyright: andreypopov / 123rf stock photo (licensee)
But actually, it includes any data that can be used to identify a living person, and that includes still or video images. So video captured by CCTV systems may be covered by the DPA and therefore those responsible for collecting and processing it should operate within the eight principles of data protection.
The eight DPA principles (abridged) are that personal data shall:
be processed fairly and lawfully
be obtained only for specified and lawful purposes
be adequate, relevant and not excessive
be accurate and kept up to date
not be kept for longer than is necessary
be processed in accordance with the rights of data subjects
be protected against unauthorised or unlawful processing and against accidental loss
not be transferred outside the EEA without protection for the rights and freedoms of data subjects
The Information Commissioner’s Office (ICO) is responsible for promoting and policing the DPA.
They recently revised the CCTV code of practice to take account of updated technology including automatic number plate recognition (ANPR), body-worn video and drones.
The new code has the not-so-snappy title ‘In the picture: A data protection code of practice for surveillance cameras and personal information’ (wow, that's a mouthful isn't it?) and provides advice on good practice for those who operate CCTV systems.
As well as complying with the ICO’s standard code of practice, operators should ensure that they incorporate the updated 'in the picture' revisions into their own policies, codes of practice, staff training and systems.
If you don’t have a separate CCTV policy or code of practice, video images should at least be referenced in your Data Protection policy. A CCTV code of practice should set out clearly the purposes for which CCTV is used, how the data is processed, stored and deleted and under what circumstances it can be passed on to data subjects or third parties.
Operators of CCTV systems have to keep careful records of what they do with video data, including when and why they pass copies on to third parties such as the police or others, so a comprehensive code of practice should include the forms or logs to be used.
Staff, customers or visitors should know that video recording is in use and why. They should also know who to contact if they want to request a copy of video images by making a data subject request, although they may not be entitled to see it if other people can be identified on the video too.
Picaw’s proprietary Oggle remote video system is compliant with the DPA and the ICO code of practice, so long as users and operators have a robust policy which is carefully followed.
If you'd like to talk about data protection and your CCTV system then do give me a call on 0845 287 3622 or click here to send over an email enquiry and let's see how we can help you.
Until next time ...
While working with Volvo in the late 70’s I realised the way forward in international component distribution was computing. I created a company distributing components for several international manufacturers using the 'new' computers of the day. I quickly realised we needed our own programs so started writing distribution software. I grew the company by developing the software until I eventually sold my shares 20 years later, but retaining the rights to the software. I continued developing the software and supplied it to several similar companies where the software is still used today.
During 1999, I was asked by a friend to develop a facility to video the live sea conditions on the south coast accessible on the internet. Working with a Linux software developer I created our first remote video application. The internet boom of 2000 allowed me to develop a commercial application forming the basis of our systems today.