Most uses of CCTV will be covered by the Data Protection Act

The Data Protection Act gives you the right to see information held about you, including CCTV images of you, or images which give away information about you (such as your car number plate).

It also sets rules which CCTV operators must follow when they gather, store and release CCTV images of individuals. The Information Commissioner can enforce these rules.

If you are concerned that CCTV is being used for harassment, anti social behaviour or other matters dealt with under the criminal law, then these are matters for the police.

Law enforcement covert surveillance activities are covered by a separate Act – the Regulation of Investigatory Powers Act (RIPA) 2000 and the Regulation of Investigatory Powers (Scotland) Act (RIPSA) 2000.

CCTV filming carried out by others

What can I expect?

The CCTV operator must let people know they are using CCTV. Signs are the most usual way of doing this. The signs must be clearly visible and readable, and should include the details of the organisation operating the system if not obvious.

CCTV should only be used in exceptional circumstances in areas where you normally expect privacy – such as in changing rooms or toilets, and should only be used to deal with very serious concerns. The operator should make extra effort to ensure that you are aware that cameras are in use.

Conversations between members of the public should not be recorded on CCTV. (There are some specific exceptions to this, such as a panic button in a taxi cab or the charging area of a police custody suite).

What must a CCTV operator do?

Make sure someone in the organisation has responsibility for the CCTV images, deciding what is recorded, how images should be used and who they should be disclosed to.
Register with the Information Commissioner’s Office (check our public register).
Have clear procedures on how to use the system and when to disclose information.
Make regular checks to ensure the procedures are followed.

When can CCTV images be disclosed?

You have the right to see CCTV images of you and to ask for a copy of them. The organisation must provide them within 40 calendar days of your request, and you may be asked to pay a fee of up to £10 (this is the maximum charge, set by Parliament). This is called a Subject Access Request. You will need to provide details to help the operator to establish your identity as the person in the pictures, and to help them find the images on their system.

CCTV operators are not allowed to disclose images of identifiable people to the media – or to put them on the internet – for entertainment. Images released to the media to help identify a person are usually disclosed by the police.
An organisation may need to disclose CCTV images for legal reasons – for example, crime detection. Once they have given the images to another organisation, then that organisation must adhere to the Data Protection Act in their handling of the images.
Public authorities are subject to the Freedom of Information Act 2000, or the Freedom of Information (Scotland) Act 2000. This Act allows members of the public to request official information by writing to the public authority, who must respond within 20 working days. If the images are those of the person making the request, then the request would be handled under the Data Protection Act as a Subject Access Request. If, however, other people are identifiable in the CCTV pictures, then the images would be considered personal information and it is likely they would be exempt from the Freedom of Information Act.

How long can an organisation retain CCTV images?

Organisations should have a retention policy. They should only keep the images for as long as necessary to meet the purpose of recording them.

Domestic CCTV systems – guidance for people using CCTV

Using CCTV at your home

There are many domestic CCTV systems on the market to help you protect your home. If you’re thinking of using one, you need to make sure you do so in a way that respects other people’s privacy.

If you set up your system so it captures only images within the boundary of your private domestic property (including your garden), then the data protection laws will not apply to you.

But what if your system captures images of people outside the boundary of your private domestic property – for example, in neighbours’ homes or gardens, shared spaces, or on a public footpath or a street?

Then the Data Protection Act 2018 (DPA18) will apply to you, and you will need to ensure your use of CCTV complies with these laws. This guidance refers to them as the ‘data protection laws’.

Regardless of whether or not your use of CCTV falls within the data protection laws, the ICO recommends you use it responsibly to protect the privacy of others.

What does ‘private domestic property’ mean?

It means the boundary of the property (including the garden) where you live.

How can I use CCTV responsibly at my property?

You should ask yourself whether CCTV is actually the best way to improve your home security.

Think about the following questions:

Do I really need CCTV?
Are there other things I could use to protect my home, such as better lighting?
What is the most privacy-friendly way to set up the system?
What areas do I want the cameras to capture?
Can I position the cameras to avoid intruding on my neighbours’ property or any shared or public spaces?
Do I need to record the images, or is a live feed enough?
Has my CCTV system got an audio-recording facility? Audio recording is very privacy-intrusive. So in most cases where householders use CCTV, they should disable audio recording.

Think about the problem you are trying to tackle. It will usually be to safeguard you and your property against crime. Check your local police advice about crime prevention. Better locks, security lighting or an alarm system may be more effective and less expensive ways of securing your property.

If you decide to use CCTV, think about what areas need to be covered, and whether your cameras need to capture images beyond the boundary of your property. Remember, if your cameras don’t capture images beyond your boundary, the data protection laws won’t apply to you.

What is the law if my CCTV captures images of people outside my own home and garden?

If your CCTV captures images beyond your property boundary, such as your neighbours’ property or public streets and footpaths, then your use of the system is subject to the data protection laws.

This does not mean you are breaking the law. But it does mean that, as the CCTV user, you are a data controller. So you will need to comply with your legal obligations under the data protection laws.

You can still capture images, but you need to show you are doing it in ways that comply with the data protection laws and uphold the rights of the people whose images you are capturing.

What must I do if I capture images of people outside my own home and garden?

If you are capturing images beyond your property boundary, you should have a clear and justifiable reason for doing so. In particular, you will need to think why you need these images. If asked by an individual or the ICO, you will need to be able to explain your reasons, so you should write them down now. You should also write down why you think capturing the images is more important than invading the privacy of your neighbours and passers-by.

You will also need to:

Let people know you are using CCTV by putting up signs saying that recording is taking place, and why.
Ensure you don’t capture more footage than you need to achieve your purpose in using the system.
Ensure the security of the footage you capture – in other words, holding it securely and making sure nobody can watch it without good reason.
Only keep the footage for as long as you need it – delete it regularly, and when it is no longer needed.
Ensure the CCTV system is only operated in ways you intend and can’t be misused for other reasons. Anyone you share your property with, such as family members who could use the equipment, needs to know the importance of not misusing it.

You also need to make sure you respect the data protection rights of the people whose images you capture. This includes the following things:

Responding to subject access requests (SARs), if you receive any. Individuals have a right to access the personal data you hold about them, including identifiable images. They can ask you verbally or in writing. You must respond within one month and give them a copy of the data.
Deleting footage of people if they ask you to do so. You should do this within one month. You can refuse to delete it if you specifically need to keep it for a genuine legal dispute – in which case you need to tell them this, and also tell them they can challenge this in court or complain to the ICO.
Consider any objection you get now from particular people about capturing their image in the future. Given the nature of CCTV systems, this may be very difficult to do. However, you should again think whether you need to record images beyond your property boundary – particularly if your system is capturing images from a neighbour’s home or garden.

What happens if I break the law?

If you fail to comply with your obligations under the data protection laws, you may be subject to enforcement action by the ICO. This could include a fine. You may also be subject to legal action by affected individuals, who could pursue court claims for compensation.

If you follow our guidance and take all reasonable steps to comply with your data protection obligations, the ICO is unlikely to regard you as a regulatory risk. So the ICO would be unlikely to think that taking enforcement action against you was a proportionate use of its resources.

What else should I think about?

Before you install the system, consider speaking to your neighbours and explaining what you are doing. Listen to any objections or concerns they may have. It may also be useful to invite your neighbours to view the footage you capture. This may relieve any concerns they have about your use of CCTV. It may also avoid disputes escalating or complaints being made about your recording.
The phrase ‘domestic CCTV system’ refers to the use of any video surveillance equipment mounted or fixed on your home. It can include cameras fitted to doorbells.
You should remember that your use of a domestic CCTV system may be appropriate, but publicly uploading or streaming footage of identifiable people would need more justification. In most cases it would not be justifiable.
You don’t need to register with the ICO or pay a fee (this is a change from the previous law). However, you must maintain records of how and why you are capturing these images, and for how long you are keeping them. You may need to make these records available to the ICO on request.