In the UK, the law surrounding CCTV (which includes the use of IP / Internet Cameras) is largely covered by the Data Protection Act, and the information supplied here should only be used as a guide.
Please consult http://www.ico.gov.uk/ for current rules and regulations regarding CCTV and camera systems.
Household Use
The use of CCTV cameras on residential properties is becoming increasingly common, which can be worrying if you feel that your privacy is being threatened.
There is an exemption for domestic or household processing of personal information, as long as this does not involve putting personal information on a website or making it available to the world at large in another way without good reason.
This means that if a CCTV camera mounted in your neighbour's property is overlooking your land, it is unlikely that they will be breaching the Data Protection Act. However, they may be breaching other legislation such as the law about harassment or voyeurism, and so may be subject to investigation by another body, such as the police.
The use of cameras for limited household purposes is exempt from the DPA. This applies where an individual uses CCTV to protect their home from burglary, even if the camera overlooks the street or other areas near their home. Images captured for recreational purposes, such as with a mobile phone, digital camera or camcorder, are also exempt.
The Data Protection Act does not apply to individuals’ private or household purposes. So if you install a camera on your own home to protect it from burglary, the Act will not apply.
Business Use
Most CCTV is directed at viewing and/or recording the activities of individuals. This means that most uses of CCTV by organisations or businesses will be covered by the Data Protection Act (DPA) and the provisions of this code, regardless of the size of the system.
Establishing a clear basis for the handling of any personal information is essential and the handling of images relating to individuals is no different. It is important to establish who has responsibility for the control of the images, for example, deciding what is to be recorded, how the images should be used and to whom they may be disclosed. The body which makes these decisions is called the data controller and is legally responsible for compliance with the Data Protection Act (DPA).
CCTV must not be used to record conversations between members of the public as this is highly intrusive and unlikely to be justified. You should choose a system without this facility if possible. If your system comes equipped with a sound recording facility then you should turn this off or disable it in some other way.
Storing and viewing the images
Recorded material should be stored in a way that maintains the integrity of the image. This is to ensure that the rights of individuals recorded by the CCTV system are protected and that the material can be used as evidence in court. To do this you need to carefully choose the medium on which the images are stored, and then ensure that access is restricted. You may wish to keep a record of how the images are handled if they are likely to be used as evidence in court. Finally, once there is no reason to retain the recorded images, they should be deleted. Exactly when you decide to do this will depend on the purpose for using CCTV.
Disclosure
Disclosure of images from the CCTV system must also be controlled and consistent with the purpose for which the system was established. For example, if the system is established to help prevent and detect crime it will be appropriate to disclose images to law enforcement agencies where a crime needs to be investigated, but it would not be appropriate to disclose images of identifiable individuals to the media for entertainment purposes or place them on the internet. Images can be released to the media for identification purposes; this should not generally be done by anyone other than a law enforcement agency.
Retention
The DPA does not prescribe any specific minimum or maximum retention periods which apply to all systems or footage. Rather, retention should reflect the organisation’s own purposes for recording images.
You should not keep images for longer than strictly necessary to meet your own purposes for recording them. On occasion, you may need to retain images for a longer period, where a law enforcement body is investigating a crime, to give them opportunity to view the images as part of an active investigation.
Letting people know
You must let people know that they are in an area where CCTV surveillance is being carried out.
The most effective way of doing this is by using prominently placed signs at the entrance to the CCTV zone and reinforcing this with further signs inside the area. This message can also be backed up with an audio announcement, where public announcements are already used, such as in a station.
Clear and prominent signs are particularly important where the cameras themselves are very discreet, or in locations where people might not expect to be under surveillance. As a general rule, signs should be more prominent and frequent where it would otherwise be less obvious to people that they are on CCTV.
Subject access requests
Individuals whose images are recorded have a right to view the images of themselves and, unless they agree otherwise, to be provided with a copy of the images. This must be provided within 40 calendar days of receiving a request. You may charge a fee of up to £10 (this is the current statutory maximum set by Parliament). Those who request access must provide you with details which allow you to identify them as the subject of the images and also to locate the images on your system.
Monitoring your workforce
When you install CCTV in a workplace, such as a shop, it is likely to capture pictures of workers, even if they are not the main subject of surveillance. If the purpose of the CCTV is solely to prevent and detect crime, then you should not use it for monitoring the amount of work done or compliance with company procedures. You should first of all consider whether better training or greater supervision would be a more appropriate solution.
Example: You suspect that your workers are stealing goods from the store room. It would be appropriate to install CCTV in this room, as it will not involve continuous or intrusive monitoring and is proportionate to the problem.
Example: You suspect that your workers are making mobile phone calls during working hours, against company policy, and you consider installing CCTV cameras on their desks to monitor them throughout the day. This would be intrusive and disproportionate. Continuous monitoring should only be used in very exceptional circumstances, for example where hazardous substances are used and failure to follow procedures would pose a serious risk to life.
