CCTV Legislation - The Data Protection Act 1998 / 2003
Further legislation that applies to the operation of CCTV systems:
The Criminal Justice and Public Order Act (1994)
The Police and Criminal Evidence Act (1984)
The Protection from Harassment Act (1997)
The Criminal Procedure and Investigations Act (1996)
The Magistrates Court Rules (1981)
The Magistrates Court Act (1980)
Legal Issues Surrounding CCTV - What laws apply to the storage of and access to information?
Data Protection Act 1998/ Freedom of Information Act 2000
Since 24/10/01 all commercial CCTV which records data in areas to which the public have mostly unrestricted access must register their system(s) with the Information Commissioner.
Under the terms of Data Protection legislation, individuals have access to personal data about themselves, for which an administrative fee (currently £10) is charged for processing the request. The person making the request is only shown information relevant to that particular search and which contains personal data of her or him self only, unless all other individuals who may be identified from the same information have consented to the disclosure.
In the event of the data controller complying with a request to supply a copy of the data to the subject, only data pertaining to the individual should be copied, (all other personal data which may facilitate the identification of any other person should be concealed or erased). Under these circumstances an additional fee shall be payable.
The data controller is entitled to refuse an individual request to view data under these provisions if insufficient or inaccurate information is provided. In addition, the data controller is entitled to refuse a request if the CCTV footage is likely to become, part of a 'live' criminal investigation.
The Data Protection Act (1998) is designed to prevent the misuse of personal information. Legal obligations are placed on anybody who handles this type of information.
The need to recognise a request from an individual to prevent processing likely to cause substantial and unwarranted damage or distress (s10 DPA) and one to prevent automated decision-taking in relation to the individual (s12 DPA)
Data Protection Implications
The majority of the public at large have become accustomed to camera surveillance. Concerns expressed arise mainly over matters appertaining to the storage of information, i.e. what happens to the material that is obtained.
In processing personal information there must be total respect for the privacy of the individual. That right to respect can be forfeited, but if CCTV schemes are to command public confidence, then privacy concerns of the law-abiding citizen must be paramount.
To take into account future legislative change, the eight principles of the Data Protection Act, 1984, are to be adhered to; namely to:
Obtain and process personal data fairly and lawfully.
Hold the data only for the purposes specified.
Use the data only for the purposes, and disclose only to the people, shown within these policies and procedures.
Only hold data that is adequate, relevant and not excessive in relation to the purpose for which the data is held. Ensure personal data is accurate and, where necessary, kept up to date.
Hold data for no longer than is necessary.
Allow individuals access to information held about them and, where appropriate, correct it or erase it.
Take security measures to prevent unauthorised or accidental access to, alteration, disclosure, or loss and destruction or information.
In order to support the requirements of these policies and procedures, in particular, legislation surrounding the recording and storage of sound and image data, the Council has registered its use of CCTV with the Data Protection Registrar for the purpose of “crime prevention, crime detection and public safety and for the prosecution of offenders”.
Fixed signs informing the public of the existence of the CCTV cameras are displayed at the approaches to each monitored camera zone. The signs inform the public that cameras are in operation and give contact details for enquiries.
The Freedom of Information Act (2000) provides a right of access to any recorded information held by public authorities. Legal obligations are placed on public authorities to follow certain procedures when responding to requests for information.
(if other individuals are capable of being identified then it is personal information about those individuals and unlikely this info can be disclosed, must apply data protection act principles also)
Other legislation of which to be aware:
Crime and Disorder Act 1998
Section 17 of the Crime and Disorder Act 1998, which requires local authorities including the council and the Police to mainstream community safety throughout the way they plan and deliver services, applies to Council and Police use of CCTV.
Criminal Justice and Public Order Act 1994
Section 163 permits the use of CCTV in a local authority area.
Criminal Law Act 1967
Section 3 allows for small retailers to use CCTV as a reasonable means to prevent crime.
Human Rights Act 1998
Technology such as CCTV has the potential to interfere with privacy rights, Article 8 (as a qualified right) requires that three tests have to be applied if the interference is to be lawful. It seems clear the Human Rights Act, by incorporating a right to privacy into UK domestic law, does have potential implications for CCTV systems especially those run by public authorities. And, second, that in the longer term incorporation of Article 8 will mean that the government is obliged to introduce specific statutory regulations and controls over CCTV.
First, the interference must be undertaken ‘in accordance with the law’.
Second, the aim of the interference must fall within one of the exceptions to Article 8 f it is to be lawful. These are the exceptions that allow the right of privacy to be restricted. Essentially, these aims are either to protect national security, public safety, public health and morals, the rights of others or prevent public disorder or crime.
Third, that the restriction fulfils a pressing social need and is proportionate in how it responds to that need.
Legal Basis for CCTV
The Human Rights Act 1998 requires that there is a legal basis for any act that the 'State' might carry out. In particular where any Act or Omission might affect the rights as laid down by the Act. The use of CCTV in space to which the public may have access has the potential for engaging Human Rights. The introduction of Codes of Practice by the Data Protection Office clearly has its basis in Human Rights and whilst this legislation controls the use of CCTV it was not the primary legislation that allowed the original legislation. That lies in Section 163 of the Criminal Justice and Public Order Act 1994.
Civil Liberties
The principles of civil liberties must not be breached by the operation of a CCTV scheme. Fundamentally, it must be shown that:
Individual members of the public are not being harassed
No other agency (e.g. the Police) is in ‘regular’ control of the Local Authority CCTV coverage.
The operators of the cameras will operate with the utmost probity at all times.
Every use of the camera will accord with the purposes and key objectives of the scheme and in compliance with the main Policies, Procedures and Strategy.
Cameras will not be used to look into private property. Where considered appropriate, ‘privacy zones’ have been programmed into the system in order to ensure that cameras do not survey the interior of any private property within their range. This is further supported and encompassed in UK law, by both the Data Protection Act 1998 - CCTV Codes of Practice (July 2000) and the Human Rights Act 1998.
The Regulation of Investigatory Powers Act 2000 (RIPA)
Came into force in October 2001. The Act relates to surveillance by the Police and other agencies, and refers to the use of directed covert surveillance, which would cover direct covert surveillance using CCTV. Written authorisation is required for the Police in advance at Superintendent level for planned direct covert CCTV operations. The application must indicate the reason for the request and should fall within one or more of the following categories:
In the interests of national security.
For the purpose of preventing or detecting crime or of preventing disorder.
In the interests of the economic well-being of the United Kingdom.
In the interests of public safety.
For the purpose of protecting public health.
For the purpose of assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department.
For any purpose (not falling within paragraphs a) to f)) which is specified for the purposes of this subsection by an order made by the Secretary of State.
It relates to surveillance by the Police and other agencies and deals in part with the use of directed covert surveillance – which could be by the way of the CCTV system.
CCTV operators and system managers should be aware of the requirements placed on them by these laws and should have procedures in place to enable them to comply. Note that laws can be amended, new ones introduced and old ones superseded so it is recommended to seek up-to-date advice.
Under the provisions of the Private Security Industry Act 2001, it is a criminal offence for staff to be contracted as public space surveillance CCTV operators in England, Wales and Scotland without an SIA licence10.
RIPA also forms part of a trio of documents produced as a result of the Human Rights Act, the others being the Data Protection Act CCTV Codes of Practice and the Code of Practice for the use of personal data in employer / employee relationships.
All three documents have implications for the way CCTV in the UK is operated and in particular those systems that are operated by or on behalf of an Authority or Public Body, and in the way that evidence of criminal acts are gathered.
The following extract from the Home Office website in relation to the Regulation of Investigatory Powers Act 2000 explains at what level of surveillance the Act might come into being or not as the case may be:
"General observation forms part of the duties of many law enforcement officers and other public bodies. Police officers will be on patrol at football grounds and other venues monitoring the crowd to maintain public safety and prevent disorder. Officers may also target a crime "hot spot" in order to identify and arrest offenders committing crime at that location. Trading standards or HM Customs & Excise officers might covertly observe and then visit a shop as part of their enforcement function to verify the supply or level of supply of goods or services that may be liable to a restriction or tax. Such observation may involve the use of equipment to merely reinforce normal sensory perception, such as binoculars, or the use of cameras, where this does not involve systematic surveillance of an individual. It forms a part of the everyday functions of law enforcement or other public bodies. This low-level activity will not usually be regulated under the provisions of the 2000 Act.
Neither do the provisions of the 2000 Act or of this code of practice cover the use of overt CCTV surveillance systems. Members of the public are aware that such systems are in use, for their own protection, and to prevent crime.”
Police Act 1967 (Section 6)
For the use of CCTV for the Police to maintain an efficient and effective Police area.
The Private Security Industry Act 2001
Outlines a system for the statutory regulation of the private security industry, including CCTV operators.
For further information on these see The Information Commissioner’s Office (www.ico.gov.uk). The ICO also publish a CCTV Code of Practice.
CCTV Legislation / Guidance Links Information Commisioners Office Home Office CCTV Information HOSDB CCTV Guidance