CCTV DPA Subject Access Requests from 9 Elbourn Way CCTV System

Notes

Regulation in CCTV, and domestic CCTV in particular has been sketchy to say the least over the years.

Following the debacle after the government's investment in town centre CCTV in the early '90s where users rushed to have a slice of the budget without any thought to what they wanted to achieve, it is not surprising the results were poor, to say the least. As a response, the Police Scientific Development Branch in the mid-'90s developed the concept of the Operational Requirements but also established the Rotakin as the test tool to establish quality, which quickly became the standard tool throughout the world for testing CCTV systems. (Home Office CAST's updated test system c. 2009 for digital recording systems was less successful).

Once the quality of the systems began to improve the ICO became worried about the abuse of systems and how they impacted on individuals personal data and developed their own advice along the basic principals of data protection. Initially this didn't include domestic CCTV, but by 2010 onwards they did expect systems that overlooked public space (as opposed to private gardens etc) had to have CCTV signage and to have disclosure capabilities. Today they have reversed their earlier decision, realising they don't have the authority to sanction individuals or the resources to engage in domestic squabbles - see https://ico.org.uk/for-the-public/domestic-cctv-systems/#rules.

In 1998, when I first employed CCTV I canvased my neighbours who quite clearly indicated they didn't want me monitoring public areas and so I have been careful to ensure cameras are positioned to reduce coverage of neighbouring properties and public areas ever since. Having invested in CCTV signage, after reviewing the advice in 2020 I have decided to retain it, which is still advisable if not mandated, as a way of informing neighbours (who change over time) that I have CCTV. Similarly, having developed a number of systems to conform to the data protection act (in 2020, 2023 & 2024) I see no reason to withdraw it. Going forward, and seeing as I provided more than required, I do not intend to follow the vagaries of the ICO and do not intend to change these procedures.

It is unlikely any recordings have been retained, because:
  1. The system is designed and managed to strictly conform to the general data protection regulations (and DPA): Lawfulness, fairness and transparency; Purpose limitation; Data minimisation; Accuracy; Storage limitation; Integrity and confidentiality (security); Accountability.
  2. The system intends to only record short clips of people who come on to the property. Inevitably there will be co-incidents capturing people in adjacent areas.
  3. The data controller reviews recordings regularly to ensure the system remains operational and obviously when/if there are any data requests. All records are subsequently deleted unless there are specific security concerns, such as:
    1. Damage or theft from the property
    2. Trespass
    3. Taking undue interest in the property (possible planning future theft etc), such as taking pictures
Under DPA individuals are entitled to see any recorded data of themselves, unless this is likely to compromise any future legal proceedings. They are NOT entitled to see anyone else who maybe in the image (without the data controller receiving their specific consent). To this end the data controller must be confident any images disclosed are of the correct person. To achieve this the images must be clear enough to recognise them and they would need to look directly into the camera with nothing obscuring their face.

After receiving the initial request, providing: the time and date of the interested period; supporting information (such as clothing & route taken - see regions on site plan); and a reason for the request, a review will be made of the recordings. If there are any that maybe relevant the requestor will be asked to advise their height and provide a passport quality photo - see https://www.gov.uk/photos-for-passports, to help verify their identity. If confirmed, their images will be extracted from the clip and a video will be forwarded by email. Even following these procedures there is no guarantee there will be any images that can be disclosed if their identity cannot be confirmed.

ICO considers 30 days to be a reasonable time to respond to requests and 40 days to be the maximum (not allowing for long periods of absence, such as 120 world cruise). 		Site Plan 9EW
Please refer to ICO’s web-site for clarification: https://ico.org.uk/your-data-matters/domestic-cctv-systems-guidance-for-people-using-cctv/.

These procedures score GREEN on ICO’s CCTV checklist – see https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/
Download the request form
Please complete the fields: name; email; number of people/pets accompanying; clothing worn; route taken; purpose; Date/time from; Date/time to. Forward the completed form and photo to: