If you’re in the market for a CCTV installation at your home, or even if you are looking to install yourself. There are a few rules and regulations that you as the homeowner should know about before those cameras go up on your walls!
As the owner of your CCTV system, if you record any footage outside of your property boundary you become a data controller. Meaning you need to comply with your legal obligations under data protection laws to protect the privacy of people you record.
How can I comply with Data Protection Laws?
When capturing images beyond your property boundary, you should have a clear and justifiable reason for doing so. In particular, you will need to think why you need these images. If asked by an individual or the Information Commissioners Office (ICO), you will need to be able to explain your reasons.
You will also need to:
Let people know you are using CCTV.
Ensure you don’t capture more footage than you need to achieve your purpose in using the system.
Ensure the security of the footage you capture – in other words, holding it securely and making sure nobody can watch it without good reason.
Only keep the footage for as long as you need it – delete it regularly, and when it is no longer needed.
Ensure the CCTV system is only operated in ways you intend and can’t be misused for other reasons.
You must also allow anyone that you have recorded access to the data that you have stored of them, if they request it.
What Rights do the public have?
You also need to make sure you respect the data protection rights of the people whose images you capture. This includes the following things:
Responding to subject access requests (SARs). Individuals have a right to access the personal data you hold about them, including identifiable images. They can ask you verbally or in writing. You must respond within one month and give them a copy of the data.
Deleting footage of people if they ask you to do so. You should do this within one month. You can refuse to delete it if you specifically need to keep it for a genuine legal dispute – in which case you need to tell them this, and also tell them they can challenge this in court or complain to the ICO.
Consider any objection you get now from particular people about capturing their image in the future. Given the nature of CCTV systems, this may be very difficult to do. However, you should again think whether you need to record images beyond your property boundary – particularly if your system is capturing images from a neighbour’s home or garden.
What happens if I break the law?
If you fail to comply with your obligations under the data protection laws, you may be subject to enforcement action by the ICO. This could include a fine. You may also be subject to legal action by affected individuals, who could pursue court claims for compensation.
If you follow our guidance and take all reasonable steps to comply with your data protection obligations, the ICO is unlikely to regard you as a regulatory risk. So the ICO would be unlikely to think that taking enforcement action against you was a proportionate use of its resources.
It is your responsibility as a homeowner to ensure that your system complies with General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA18).
