The Data Protection Act of 1998 covers the processing by "data
controllers" of "personal data" and includes a right for
individuals, subject to conditions, to receive a copy of "the
information constituting the personal data of which that individual
is the data subject".
"Personal data" includes data which relate to a living
individual who can be identified from or using that data. For the
purposes of CCTV, an image of an individual caught on camera has in
the past always been regarded as "personal data". However, a recent
Court of Appeal decision in a case relating to a Mr Michael Durant
ruled that the naming of a living person in a document does not
necessarily amount to "personal data" under the Data Protection
Act.
The reasoning behind the ruling has been applied to CCTV with
the effect that incidental images of individuals, which are not
biographical in nature, do not focus on the individual and do not
affect that person's privacy, may in limited circumstances fall
outside the scope of the Act. As a result, some businesses may no
longer have to comply with the Act in relation to their CCTV
activities.
According to the guidance issued by the Information Commissioner
last week, organisations that use a very basic CCTV system, of the
type that cannot be moved remotely and that record only a general
image, may not be covered by the Act.
However, it is the images, and not the system itself, which may
be outside the Act. If a system is used to focus on particular
individuals, such as employees, then the Act will still apply.
Says the Information Commissioner:
"If you can answer 'no' to all the following 3 questions you
will not be covered:
Do you ever operate the cameras remotely in order to zoom in/out
or point in different directions to pick up what particular people
are doing?
Do you ever use the images to try to observe someone's behaviour
for your own business purposes such as monitoring staff
members?
Do you ever give the recorded images to anyone other than a law
enforcement body such as the police?"
More sophisticated systems are likely to fall under the Act,
although not all of the images recorded by the system will be
subject to it - for example, images of a general scene where
the camera does not focus in on an individual or record an incident
occurring, will not be covered by the Act.
Says the guidance:
"The simple rule of thumb is that you need to decide whether the
image you have taken is aimed at learning about a particular
person's activities. The only difference is that you will no longer
have to give individuals access to those images that are just
general scenes neither focusing on a particular individual nor
being used to learn information about individuals."
The Commissioner has also issued general guidance on the effect
of the ruling on Data Protection rules.
Disclaimer: We hope you find OUT-LAW’s content useful. It’s prepared by the lawyers at Pinsent Masons. Please remember, though, that it’s intended as general information only. It’s not legal advice. If that’s what you’re seeking, please
contact us. See also: our
full disclaimer
