contents
- Foreword
- About this code
- What this code covers
- Deciding whether to use CCTV or continue using CCTV
- Ensuring effective administration
- Selecting and siting the cameras
- Using the equipment
- Looking after the recorded material and using the images
- Responsibilities
- Staying in control
- Appendix 1
- Appendix 2
- Appendix 3
CCTV code of practice
8. Looking after the recorded material and using the images
8.1 Storing and viewing the images
Recorded material should be stored in a way that maintains the integrity of the image. This is to ensure that the rights of individuals recorded by the CCTV system are protected and that the material can be used as evidence in court. To do this you need to carefully choose the medium on which the images are stored, and then ensure that access is restricted. You may wish to keep a record of how the images are handled if they are likely to be used as evidence in court. Finally, once there is no reason to retain the recorded images, they should be deleted. Exactly when you decide to do this will depend on the purpose for using CCTV.
Many modern CCTV systems rely on digital recording technology and these new methods present their own problems. With video tapes it was very easy to remove a tape and give it to the law enforcement agencies such as the police for use as part of an investigation. It is important that your images can be used by appropriate law enforcement agencies if this is envisaged. If they cannot, this may undermine the purpose for undertaking CCTV surveillance.
- How easy is it to take copies of a recording off your system when asked for by a law enforcement agency? Can this be done without interrupting the operation of the system?
- Will they find your recorded images straightforward to use?
- What will you do when recorded material needs to be taken away for further examination?
Viewing of live images on monitors should usually be restricted to the operator unless the monitor displays a scene which is also in plain sight from the monitor location.
Example: Customers in a bank can see themselves on a monitor screen. This is acceptable as they cannot see anything on the screen which they could not see by looking around them. The only customers who can see the monitor are those who are also shown on it.
Example: Monitors in a hotel reception area show guests in the corridors and lifts, i.e. out of sight of the reception area. They should be turned so that they are only visible to staff, and members of the public should not be allowed access to the area where staff can view them.
Recorded images should also be viewed in a restricted area, such as a designated secure office. The monitoring or viewing of images from areas where an individual would have an expectation of privacy should be restricted to authorised persons.
- Are your monitors correctly sited taking into account the images that are displayed?
- Is your monitor viewing area appropriate and secure?
- Where necessary is access limited to authorised people?
8.2 Disclosure
Disclosure of images from the CCTV system must also be controlled and consistent with the purpose for which the system was established. For example, if the system is established to help prevent and detect crime it will be appropriate to disclose images to law enforcement agencies where a crime needs to be investigated, but it would not be appropriate to disclose images of identifiable individuals to the media for entertainment purposes or place them on the internet. Images can be released to the media for identification purposes; this should not generally be done by anyone other than a law enforcement agency.
NOTE: Even if a system was not established to prevent and detect crime, it would still be acceptable to disclose images to law enforcement agencies if failure to do so would be likely to prejudice the prevention and detection of crime.
Any other requests for images should be approached with care, as a wide disclosure of these may be unfair to the individuals concerned. In some limited circumstances it may be appropriate to release images to a third party, where their needs outweigh those of the individuals whose images are recorded.
Example: A member of the public requests CCTV footage of a car park, which shows their car being damaged. They say they need it so that they or their insurance company can take legal action. You should consider whether their request is genuine and whether there is any risk to the safety of other people involved.
- Are arrangements in place to restrict disclosure of images in a way consistent with the purpose for establishing the system?
- Do those that may handle requests for disclosure have clear guidance on the circumstances in which it is appropriate to make a disclosure and when it is not?
- Do you record the date of the disclosure along with details of who the images have been provided to (the name of the person and the organisation they represent) and why they are required?
Judgements about disclosure should be made by the organisation operating the CCTV system. They have discretion to refuse any request for information unless there is an overriding legal obligation such as a court order or information access rights7. Once you have disclosed an image to another body, such as the police, then they become the data controller for their copy of that image. It is their responsibility to comply with the Data Protection Act (DPA) in relation to any further disclosures.
The method of disclosing images should be secure to ensure they are only seen by the intended recipient.
8.3 Retention
The DPA does not prescribe any specific minimum or maximum retention periods which apply to all systems or footage. Rather, retention should reflect the organisation’s own purposes for recording images.
You should not keep images for longer than strictly necessary to meet your own purposes for recording them. On occasion, you may need to retain images for a longer period, where a law enforcement body is investigating a crime, to give them opportunity to view the images as part of an active investigation.
Example: A system installed to prevent fraud being carried out at an ATM may need to retain images for several weeks, since a suspicious transaction may not come to light until the victim gets a bank statement.
Example: Images from a town centre system may need to be retained for enough time to allow crimes to come to light, for example, a month. The exact period should be the shortest possible, based on your own experience.
Example: A small system in a pub may only need to retain images for a shorter period of time because incidents will come to light very quickly. However, if a crime has been reported to the police, you should retain the images until the police have time to collect them.
- Have you decided on the shortest period that you need to retain the images, based upon your own purpose for recording the images?
- Is your image retention policy documented and understood by those who operate the system?
- Are measures in place to ensure the permanent deletion of images through secure methods at the end of this period?
- Do you undertake systematic checks to ensure that the retention period is being complied with in practice?
7 More information on subject access and freedom of information requests can be found in section 9.