On 24th February, the UK’s Information Commissioners Office (ICO) updated their guidance on video surveillance technologies. It covers how data protection laws apply to CCTV, as well as facial recognition and other commercially available technologies, including dash cams, Automatic Number Plate Recognition (ANPR), and smart doorbells when they are used in the charity and not-for profit sector.
This updated guidance arrives at a time when increasingly there is a public debate about intrusive surveillance technology. Only last week, the TUC warned that workplace surveillance is "spiralling out of control", having taken off during the Covid-19 pandemic as workers transitioned to more remote work arrangements. Among the types of surveillance of concern to the union were webcams on work computers and CCTV. This issue also featured in the ICO’s Covid-19 guidance last year, which looked at whether CCTV and other forms of surveillance could be used to monitor whether staff adhered to health and safety measures introduced in response to the pandemic.
Technological advances have made it easier than ever to increase the level of surveillance, and the latest technology presents a wide range of inexpensive options to businesses. A particular concern addressed in the updated guidance relates to audio recording. The ICO’s position is that businesses should not normally use surveillance systems that record conversations between members of the public, which is unlikely to be justifiable in most circumstances, and more privacy intrusive than visual-only recording.
More generally, the ICO’s position is that any surveillance needs to be necessary, justified and proportionate, depending on the specific context. A business needs to consider how surveillance helps achieve specific objectives, make an assessment of necessity and proportionality in the circumstances, and look at what changes are needed to existing policies and procedures, which would include – in the context of workplace surveillance - privacy notices given to staff, who may not expect to be monitored when carrying out their day-to-day roles.
What is very clear from the updated guidance is that the ICO expects businesses to always look into whether, as an alternative to video surveillance, there are less privacy-intrusive ways to achieve the same objectives, and the consideration given to this should be incorporated into any data protection impact assessment (DPIA). In keeping with the principle of fairness and transparency, they expect individuals to be informed when their personal data is processed, for example with appropriate signage notifying about the use of video surveillance. Any sharing of information taken from a surveillance system with third parties needs to be consistent with the purposes for which the system was set up. And, as with all personal data processing activities, businesses are required to have a lawful basis for the processing and have appropriate safeguards in place, covering security arrangements and retention of footage.
Navigator deliver a free webinar at 10am on Tuesday 22nd March to summarise the updated guidance on video surveillance and what it means for businesses.
