A CCTV code fit for 2014 and beyond

The Information Commissioner’s Office (ICO) believes its updated CCTV code of practice, issued just over a month ago, is now “truly fit for the times we live in”.

“The days of CCTV being limited to a video camera on a pole are long gone,” said Jonathan Bamford, head of strategic liaison at the ICO. “Our new code reflects the latest advances in surveillance technologies and their implementation, while explaining the key data protection issues that those operating the equipment need to understand.”

He said the pace of technological change since the CCTV guidance was last updated in 2008, let alone when it was first published some 14 years ago, has been considerable.

“These advances bring with them new opportunities and new challenges for making sure the technology continues to be used in compliance with the Data Protection Act,” said Mr Bamford on his ICO blog.

“One common theme from the enforcement action we have taken in relation to the use of surveillance cameras is that there needs to be a thorough privacy impact assessment. This needs to be done before deploying these increasingly powerful and potentially intrusive technologies. The code will help you stay on the right side of the law and save you wasting money and resources on incompliant systems.

“The new and emerging technologies section of the code covers the key surveillance technologies that we believe will become increasingly popular in the years ahead.”

And it is not just the widespread use of body-worn video (BWV) cameras that has been addressed. The guidance has also considered technologies that are not currently commonplace, but which may prove increasingly popular in future.

“The Civil Aviation Authority has released figures showing that more than 300 companies have now been given permission to operate UAS (unmanned aerial vehicles) in the UK,” explained Mr Bamford. “This figure has risen by a third within the past 12 months alone.

“Many of these devices can now be bought for a few hundred pounds and can record imagery. There is important guidance on how they can be used by organisations to record personal information. Recreational users are also encouraged to operate UAS responsibly.

For example, recording should be restricted and only carried out in controlled areas where people are informed that monitoring may be taking place. It is important that organisations understand these obligations at an early stage if they are to stay on the right side of the law.”

Equally with BWV, which can record both sound and images meaning they are capable of being much more intrusive than traditional town centre CCTV, their use needs to be well justified with safeguards in place such as to ensure they are not used when they are not needed and strong security in case the devices fall into the wrong hands, said Mr Bamford.

The code also addresses longstanding issues where the pre-release consultation responses showed that further clarification of the law was required. One such issue is the need for operators to comply with subject access requests.

“These requests are an important right enshrined in the Data Protection Act and allow individuals to request a record of any personal information that an organisation holds about them,” said Mr Bamford. “This includes CCTV footage capturing their image.

However, these requests have been causing a great deal of confusion, particularly for smaller operators, unaware of this area of the law. The new guide includes an expanded section explaining how these requests should be handled, when the information should be given out and the statutory deadline of 40 days that operators have to provide a full response.

“We have designed our guidance to complement the Surveillance Camera Code published under the Protection of Freedoms Act. The Surveillance Camera Code’s ‘guiding principles’ apply to police forces, police and crime commissioners and local authorities in England and Wales as described in the Protection of Freedoms Act, and contain advice about recommended operational and technica