4. Deciding whether to use CCTV or continue using CCTV

Using CCTV can be privacy intrusive, as it is capable of putting a lot of law-abiding people under surveillance and recording their movements as they go about their day to day activities. You should carefully consider whether to use it; the fact that it is possible, affordable or has public support should not be the primary motivating factor. You should take into account what benefits can be gained, whether better solutions exist, and what effect it may have on individuals.

You should consider these matters objectively as part of an assessment of the scheme’s impact on people’s privacy. This does not have to be an extensive or time-consuming process in all cases. The extent of assessment necessary will depend on the size of the proposed scheme and the level of impact it is likely to have on people’s privacy¹.

You should use the results of the impact assessment to determine whether CCTV is justified in all the circumstances and if so how it should be operated in practice.

The things to cover in any impact assessment include:

• What organisation will be using the CCTV images? Who will take legal responsibility under the Data Protection Act (DPA)?²
• What is the organisation’s purpose for using CCTV? What are the problems it is meant to address?
• What are the benefits to be gained from its use?
• Can CCTV technology realistically deliver these benefits? Can less privacy-intrusive solutions, such as improved lighting, achieve the same objectives?
• Do you need images of identifiable individuals, or could the scheme use other images not capable of identifying the individual?
• Will the particular equipment/system of work being considered deliver the desired benefits now and remain suitable in the future?
• What future demands may arise for wider use of images and how will you address these?
• What are the views of those who will be under surveillance?
• What could you do to minimise intrusion for those that may be monitored, particularly if specific concerns have been expressed?

Where the system will be operated by or on behalf of a public authority, the authority will also need to consider wider human rights issues and in particular the implications of the European Convention on Human Rights, Article 8 (the right to respect for private and family life). This will include:

• Is the proposed system established on a proper legal basis and operated in accordance with the law?
• Is it necessary to address a pressing need, such as public safety, crime prevention or national security?
• Is it justified in the circumstances?
• Is it proportionate to the problem that it is designed to deal with?

If this is not the case then it would not be appropriate to use CCTV.

---

1 If you are establishing a large system, or considering a use of CCTV which could give rise to significant privacy concerns, you may wish to consider using the ICO’s Privacy impact assessment handbook.

2 If CCTV is used by a business or organisation, then it is the body that is legally responsible under the DPA (the “data controller”), not an individual member of staff.