Stupid GDPR question - CCTV

[Meldrew]

Hi,

 

Stupid question, being devil's advocate, really. CCTV is personally identifiable data. Explicit consent must be given under GDPR to collect such data, so 'CCTV in operation' style notices don't count. For schools this might be a little easier as consent could be included in an admission form for students and some agreement for staff (but visitors would be a problem), but most businesses with the general public walking in off the street would this technically be a GDPR problem?

 

Meldrew

[synaesthesia]

I can't see it being an issue as long as you already comply. There's only so much you can do. You can't have everyone that ever wanders past your property to sign something, neither is there a system that only records when a crime or incident is happening. Maybe a slight change in signage such as "Proceeding past this sign acts as your agreement with being recorded on CCTV. A copy of our CCTV policy is available at reception".

[GrumbleDook]

This has been an interesting discussion in some circles ... a few folk even raised queries about where dash cams could have problems.

 

The last thing I saw was folk were going to ask the ICO if the CCTV Code of Conduct was going to get an update. Will go and see if there was a response.

[enjay]

I think (but am going on other people's advice not my own research) it is sufficient to put clearly visible signs at all points of entry to your premises (the site, not each individual door!) saying CCTV is in operation and how to get more information. You also need to register its use with the ICO.

[enjay]

a few folk even raised queries about where dash cams could have problems.

I suspect this is where the "expectation of privacy" laws kick in, which permit me to film you without your consent in the street but not in your back garden. The difference presumably being the street is public land, the school grounds are not (despite those people who feel they pay their taxes so have the right to use our cricket nets or walk their dogs on our fields!)

[Hedgehog13]

You have to ensure that anyone entering the area covered by the cameras is aware of this by putting up clearly visible and readable signs at any points of access to the area covered (entry gates/doors etc). The signs have to state that the area is covered by CCTV, why it is used (to protect from theft/harm etc.), the details of the organisation operating the CCTV system along with basic contact details such as website, email address or phone number for queries relating to the use of the CCTV system.

 

Also, you need to ensure that the range of the cameras is only sufficient to cover the area of your/the school's boundaries. If you end up recording beyond that you could fall foul of breaking data protection and privacy rules as people passing by would not expect that they are going to be recorded etc. especially if that includes car registration numbers etc. that identify people easily.

[enjay]

Also, you need to ensure that the range of the cameras is only sufficient to cover the area of your/the school's boundaries. If you end up recording beyond that you could fall foul of breaking data protection and privacy rules as people passing by would not expect that they are going to be recorded etc. especially if that includes car registration numbers etc. that identify people easily.

 

Not sure that bit is true. Anyone passing the school is doing so on public roads, where they don't have an expectation of privacy. I can stand on the road in front of school and take pictures or video on my phone, perfectly legally, so I would have thought the CCTV could cover the same bit of pavement (IANAL though)

[Hedgehog13]

ICO guidance states 'Both permanent and movable cameras should be sited and image capture restricted to ensure that they do not view areas that are not of interest and are not intended to be the subject of surveillance'

 

If the camera happens to capture an area just outside the school premises, that may well be acceptable, but if the camera captures an area further afield (say the opposite side of the road outside the school gates, or extends into the gardens/grounds of the properties opposite) then that would not be within the guidelines...

 

One of those 'greyish' areas where the actual siting is going to be down to you, but the later interpretation of the siting will be judged by someone else entirely if a complaint is made...

[enjay]

ICO guidance states 'Both permanent and movable cameras should be sited and image capture restricted to ensure that they do not view areas that are not of interest and are not intended to be the subject of surveillance'

 

Which also (sort of) covers the dash cam question, which @GrumbleDook raised earlier. Home security systems that also show the road in front of the house, however....

[Hedgehog13]

Home security systems don't fall under DPA unless they extend beyond the boundary, in which case any images captured beyond the boundary DO fall under DPA etc...

 

I wonder how many home owners know this/care about this etc.? And the likelihood of ever having a complaint made against you for your home security system is pretty small too :-)

[mavhc]

It's as if these rules were created without thinking of the consequences, weird.

 

Of course if you're on cctv you can request footage, so it's in the school's own interest to limit their recording area

[enjay]

Of course if you're on cctv you can request footage, so it's in the school's own interest to limit their recording area

 

True, but it is probably also in the school's interest to put CCTV over the main entrance too...

[jthompson]

ICO guidance states 'Both permanent and movable cameras should be sited and image capture restricted to ensure that they do not view areas that are not of interest and are not intended to be the subject of surveillance'

 

If the camera happens to capture an area just outside the school premises, that may well be acceptable, but if the camera captures an area further afield (say the opposite side of the road outside the school gates, or extends into the gardens/grounds of the properties opposite) then that would not be within the guidelines...

 

One of those 'greyish' areas where the actual siting is going to be down to you, but the later interpretation of the siting will be judged by someone else entirely if a complaint is made...

 

For a few of our cameras, I've configured them with privacy regions (essentially blackout boxes over portions of the image) where something is in shot that we don't want to be recording. This includes (admittedly small) bits of neighbouring property, views into classrooms or a view of a staff workstation. These are configured on the cameras themselves, so the blackout regions get baked into the cameras' feeds prior to recording. Nobody has ever asked these sorts of questions here, though.

[enjay]

For a few of our cameras, I've configured them with privacy regions (essentially blackout boxes over portions of the image) where something is in shot that we don't want to be recording. This includes (admittedly small) bits of neighbouring property, views into classrooms or a view of a staff workstation. These are configured on the cameras themselves, so the blackout regions get baked into the cameras' feeds prior to recording. Nobody has ever asked these sorts of questions here, though.

 

Some of ours have that too, excluding areas of trees - otherwise the motion sensors would mean we were constantly recording the feed from that camera!

[jthompson]

Some of ours have that too, excluding areas of trees - otherwise the motion sensors would mean we were constantly recording the feed from that camera!

 

Yes, we also exclude areas from motion detection, without necessarily blacking them out. It's annoying when there are cobwebs on the camera, for this reason.

[enjay]

It's annoying when there are cobwebs on the camera, for this reason.

And terrifying if you see the actual spider, too. 22" in full HD, yikes!

 

We had a feather caught in a cobweb on one camera recently. In the night vision mode, it looked like a ghost.