With the arrival of new General Data Protection Regulation (GDPR) being launched in the UK on 25th May 2018, business owners should be aware of the legislation surrounding the use of CCTV cameras on their premises and how GDPR will affect the usage of such equipment.
The GDPR focuses on the authority/control an individual has over their own personal data. Anything that can identify a person is classed as personal data, therefore that person has the right to be/have:
informed of the data capture and its usage
provided access to any data stored on them
the opportunity to rectify any incorrect data stored on them
the opportunity to have any data stored on them erased
able to move the data stored on them
the opportunity to object to having any data stored on them
In terms of CCTV, the recording of a data subject is classed as their personal data, as many businesses employ this technology as protective mechanism against would be criminals, they must ensure that they inform all members of the public, staff or stakeholders that are on a businesses premises that CCTV cameras are in use
In order to remain compliant, businesses should use signage to highlight the location of all CCTV cameras, this signage should be visibly positioned near to all cameras, clearly legible in context, state why the CCTV is in employed and labeled with the operating companies contact details.
As an example, if CCTV is used in the workplace to record any accidents that may take place, the signage must make staff aware of its purpose. The footage can then not be used for any other purpose, however it should be noted that if CCTV footage is requested as part of a criminal investigation by the police, the recorded footage must be made available.
Businesses must also be able to to justify their need for recording and submit this to the Information Commissioner's Office (ICO). CCTV cannot be used in anyway as a detriment to an individual’s privacy.
A data subject has the right to request any footage of themselves and this must be made available to them within 40 days of their request being made. If a subject requests their data to be erased, if the footage no longer serves the purpose for which it was originally created, the business should comply with their request and do so within a 30 day period.