Not complying with the Data Protection Act could leave firms facing huge fines
Many firms with CCTV cameras are contravening the Data Protection Act — despite thinking they comply — a security expert has warned.

Companies breaking the complex law, which came into force on 23 October, can be fined thousands of pounds and evidence gathered from cameras not complying with the law may be inadmissible in court.

There is also the potential threat of people suing camera operators for any distress illegal filming may cause.

Bernie Brooks from Datpro, a company that provides CCTV audits, products, fitting and training, said very few companies he visits are properly prepared. 'People think they have to just lock the tapes away,' he added. But there are 70 points of law to be considered,' he said.

Brooks said the onus for compliance with the Act is on the end user and urged companies to have an audit of their procedures and to take the issue seriously. 'The data controller has their head on the block. '

Many people believe putting a sign under a camera is enough, but the sign should be visible before people enter the camera area — allowing them to decide whether or not they are filmed. When companies supply camera footage to an individual, people in the background need to be pixelated so as to not infringe their rights, Brooks said.

The British Security Industry Association has also listed what companies using CCTV need to do in order to comply with the Data Protection Act. In brief it says:

  • there must be a legitimate basis for installing CCTV
  • cameras must be sited so only public spaces are filmed
  • clearly visible signs should be placed near cameras so that people are aware they are being monitored, and informed who is responsible for the scheme
  • the use of covert cameras is only lawful if the criminal activity under surveillance can be specifically identified
  • information must be processed fairly and lawfully, documented, and retained no longer than necessary
  • images may only be disclosed if compatible with the purpose of installing cameras e.g. to the police for crime detection/prevention
  • individuals who are the subject of stored data images must be allowed access to them, given satisfactory reasons for doing so and suitable identification.