New obligations on all businesses involved in 'data processing' and the record holding of information on individuals are imposed in the Data Protection Act 1998 which came into force in March of this year. But what are the implications for CCTV surveillance?
This question and answer session sums up the main points of the Act, of which all CCTV installers, specifiers and owner/operators should be aware.
Q: What exactly is meant by 'data processing'?
A: Under the act 'data' is defined is "information which is being processed by equipment operating automatically in response to instructions or is recorded with the intention it should be processed". The word 'processing' is defined as "obtaining, recording or holding data, carrying out any operation or set of operations on the data, organisation, adaption or alterations, retrieval consultation or use of the data, disclosure of the data by transmission, dissemination, or otherwise making available, alignment, combination, blocking, erasure or destruction".
Q: What should I do?
A: If you are operating a system that was installed after October 24 '98, you should have already notified the Data Protection Registrar. If the system was installed before that date you must notify the Data Protection Register by October 24 2001, but it would be good practice to adopt compliant procedures sooner rather than later. The registrar's number is 01625 545700.
Q: Do I have to let people know they're on CCTV?
A: Yes. Clearly visible signs should be placed where the video recording is active so that individuals are aware they are being monitored. These signs are normally at the entrances of buildings or the perimeter and approaches of an open or less well defined site. The system owner's name and contact details must also be displayed.
Q: Is the system's security affected?
A: Yes, in as much as operators must be aware of the need for confidentiality and that recorded information must be kept secure and available only to those directly connected with achieving the 'objectives' of the system.
CCTV operators must have access to a clear statement of these 'objectives' and be clear about the responsibilities of those involved in its operation and management.
Recordings must be logged and traceable throughout their life within the system
The recording and the equipment must only be accessible to those directly concerned with achieving the 'objectives' of the system.
Q: Who else can share the information?
A: Under the Crime and Disorder Act, the system owner/operator can share the information with the police and information can be shared between the police forces, police authorities, probation committees, local authorities and health authorities.
Original recording from which copies are made must be segregated from operational recordings and held in a secure manner only accessible to those involved with the 'objectives' of the system. These recordings must be magnetically erased and/or physically destroyed at the closure of any investigation with which they are related.
Q: Is 'archiving' affected?
A: The archive period should not be longer than is necessary to achieve the system 'objectives'. The generally accepted period is 31 days although this may be extended if there is 'reasonable cause'.
At the end of a recording's life in the system, the system manager must magnetically erase the information before disposal or destruction of the recording.
Q: Can individuals recorded on CCTV have access to recordings?
A: Yes, although this is very much down to the owner/manager. Individuals who are the subject of stored data images may request a copy of any recording, normally in the form of a VHS cassette. The individual may also request a description of the purposes of the recording and details of all recipients. But the request must be made in writing, the individual must provide satisfactory ID and must provide enough information to locate the recording (specific date and reasonable time window).
The owner/manager has up to 40 days to respond and may continue to operate the established management routine. By combining these two points it can be seen that if the normal routine is to magnetically erase recordings after the recommended 31 days archive period, the owner manager is under no compulsion to comply with a request for a recording. They might, therefore, respond to requests by saying that during the normal routine management of the system the only copy of the requested recording has been erased. The exception to this is when the recording has been retained for evidence in which case the owner/manager should consider complying with the request.
Q: Does it affect covert recording?
A: the use of covert cameras is only lawful if the criminal activity under surveillance can be specifically identified.
Because you must install signs to let individuals know they are entering an area where their image may be recorded, it follows that failure to provide signs is a breach of the act. However, an exemption in Section 29 (1) states that 'personal data' processed for reasons of prevention and detection of crime and apprehension and prosecution of offenders are exempt, provided that the following criteria are met:
a) you have assessed that if you had to inform individuals that recording was taking place it would prejudice your objective;
b) you have reasonable cause to suspect that specific criminal activity is taking place;
c) covert recording is only carried out for a limited and reasonable period of time and relates to the specific suspected criminal activity.
Operators are advised to have a clear, documented procedure which sets out how the use of covert cameras is determined in an individual case. When covert recording is deemed appropriate, operators should document their decision and reasons for reaching it.
Our thanks to Video Management Services , Unit 6 Hughes Business Centre, Wilverley Road, Christchurch, Dorset BH23 3RU (tel 01202 480048, fax 01202 480066) for providing information. The company has produced a 15 page document 'CCTV Recording Standard Code of Practice' which incorporates principles of the Data Protection Act and Elements and Good Practice when operating a CCTV system. This forms a section of the Video Management Services Logbook.
Focusing on wider issues
The wider implications of the Data Protection Act and how it affects every business are summed up in a helpful booklet from Experian Customer Services, the information solutions provider. Research carried out by Experian showed that almost 90 per cent of businesses did not know how the act affected them and 97 per cent felt they needed to know more. The guide can be obtained by calling Experian customer services on 0115 992 2555 or e-mail business.information@experian.com (a charge may be made for multiple copies).
Said Peter Brooker of Experian: "It is vital that anyone in business who keeps personal records relating to individuals, including their customers, shareholders, directors and staff knows exactly what their new responsibilities are."
"The central principle is that every bit of information a business holds is the property of the individual. They have full rights over that data and can demand to see it any time. They can also demand compensation if the records are incorrect or damaging, even if they haven't been passed to anyone else ... it now encompasses any information on sole traders, partnerships and small limited companies if that information allows anyone to identify an individual."
Source
Security Installer
