The benefits of CCTV systems need no explanation. What perhaps does need explanation though, is the often-overlooked rights of those who film, and those who are filmed. These rights are contained in the Data Protection Act 2018 (DPA 2018) and the General Data Protection Regulation ((EU) 2016/679) (GDPR).

Advice to owners of CCTV systems

Those systems set up so that only areas within the owner’s property come under surveillance are exempt from the data protection laws. This represents an ideal situation for a CCTV user. In practice though, this may be difficult, if not impossible, to achieve. Users of CCTV systems which capture footage beyond the boundaries of their property are treated in law as data controllers. Data controllers are legally responsible for complying with the data protection laws.

As a data controller, your use of CCTV must be capable of objective justification. You must be able to explain why your CCTV system captures footage outside the boundaries of your property, and why doing so is more important than a neighbour’s or passer-by’s right to privacy. Tied to this, where a user’s CCTV captures such areas, they must give people in those areas notice that they are being filmed. The user should erect signs stating the fact that CCTV is being used, and the reasons for such use.

Failure to comply with the data protection laws as a data controller may lead to enforcement action by the data regulator, the Information Commissioner’s Office. This usually results in a fine but note also that persons whose privacy has been interfered with may bring court actions for compensation.

Practical takeaways for owners of CCTV systems are to:

  • ensure that the area of surveillance falling outside your property is kept to a minimum, and that capturing these areas is necessary;

  • store footage for only as long as is reasonably necessary to achieve your aim of home security. It is advisable to delete footage at regular intervals;

  • restrict access to the footage to persons such as yourself and another family member, and make sure that any footage captured is not shared or misused in some other way.

Advice to those who are filmed

A data subject is any identifiable person caught on camera. Data subjects have several rights which can be enforced against data controllers. Notably, data subjects can submit what are known as subject access requests. Subject access requests are requests, either in writing or verbally, from a data subject to have access to any personal data held by a data controller. This means that you can request a copy of any footage in which you may be identified. The data controller has one month to respond to your request, after which you may be able to bring a claim against them. Other notable rights of data subjects include an entitlement to ask a data controller to delete any footage in which you feature and a right to request that the data controller avoids filming you in the future.

The European Convention on Human Rights may also be relevant in some instances. It is possible that the right to privacy contained in Article 8 of the Convention could be breached where photographs or videos of a person’s home are taken or published without their consent.

If you would like specialist advice on these matters, please contact our experts at Farleys on 0845 287 0939 or send your enquiry through our online form.