The data protection watchdog the ICO has brought out its updated guide for CCTV.
Long-time ICO man Jonathan Bamford, Head of Strategic Liason, said in part it was a case of ‘keep calm and carry on’: “The fundamental principles that need to be followed remain the same. People must be informed about the information being collected about them with relevant use of privacy notices and signage where required. The information also needs to be kept secure, so that the information doesn’t fall into the wrong hands, and effective retention and disposal schedules must be in place to make sure information is only kept for as long as necessary before it is securely destroyed. However, the code must reflect the times we live in. The pace of technological change since our CCTV guidance was last updated in 2008, let alone when it was first published some 14 years ago, has been considerable. These advances bring with them new opportunities and new challenges for making sure the technology continues to be used in compliance with the Data Protection Act. One common theme from the enforcement action we have taken in relation to the use of surveillance cameras is that there needs to be a thorough privacy impact assessment. This needs to be done before deploying these increasingly powerful and potentially intrusive technologies. The code will help you stay on the right side of the law and save you the wasting money and resources on uncompliant systems.
A new and emerging technologies section of the code covers the key surveillance technologies that the ICO believes will become increasingly popular; such as body-worn video, and UAS (unmanned aerial vehicles), drones for short. As Bamford put it, the days of CCTV being limited to a video camera on a pole are long gone.
Bamford said that the guidance complements the Surveillance Camera Code published under the Protection of Freedoms Act. That Surveillance Camera Code’s ‘Guiding Principles’ applies to police forces, police and crime commissioners and local authorities in England and Wales as described in the Protection of Freedoms Act, and contain advice about recommended operational and technical standards.
He summed up: “The technology may change but the principles of the DPA remain the same. CCTV and other surveillance systems need to be proportionate, justifiable and secure to be compliant.”
