3. What this code covers

This code covers the use of CCTV and other systems which capture images of identifiable individuals or information relating to individuals for any of the following purposes:

• Seeing what an individual is doing, for example monitoring them in a shop or walking down the street.
• Potentially taking some action in relation to an individual, for example handing the images over to the police to investigate a crime.
• Using the images of an individual in some way that will affect their privacy, for example passing images on to a TV company.

Most CCTV is directed at viewing and/or recording the activities of individuals. This means that most uses of CCTV by organisations or businesses will be covered by the Data Protection Act (DPA) and the provisions of this code, regardless of the size of the system. This replaces our previous guidance on when a CCTV system has to comply with the DPA.

The use of cameras for limited household purposes is exempt from the DPA. This applies where an individual uses CCTV to protect their home from burglary, even if the camera overlooks the street or other areas near their home. Images captured for recreational purposes, such as with a mobile phone, digital camera or camcorder, are also exempt.

This code is primarily aimed at businesses and organisations who routinely capture images of individuals on their CCTV equipment. Some specific uses of image recording equipment are not intended to be covered in this code, although they may still be covered by the requirements of the DPA.

• The covert surveillance activities of the law enforcement community are not covered here because they are governed by the Regulation of Investigatory Powers Act (RIPA) 2000 and Regulation of Investigatory Powers (Scotland) Act (RIPSA) 2000.
• The use of conventional cameras (not CCTV) by the news media or for artistic purposes such as for film making are not covered by this code as they are subject to special treatment in the DPA. This code does apply to the passing on of CCTV images to the media.

Not all sections of the code will be fully relevant to all CCTV systems; this will depend upon the extent and use of the images. Although small-scale users (such as small retailers) are covered by the DPA, they are unlikely to have sophisticated systems, so many of this code’s provisions are inappropriate. Appendix 2 provides special guidance, as an alternative to the full code, for very limited use of CCTV where privacy risks are small and resources are limited. If you are a small user, but you wish to use your CCTV system for any purpose which is not covered in the checklist, you should read the full code. Appendix 3 is for employers who may use CCTV to monitor their workers.

Note: The DPA applies to images captured by CCTV. This code does not cover the use of dummy or non-operational cameras.