Balancing Security and Privacy: Tips for Using Domestic and Commercial CCTV in the UK

CCTV has become widespread across the UK in recent years. The cost of installation is minimal, and it enables people to monitor their homes and businesses, and to enjoy an increased feeling of security.

The rise in use has not, of course, been without problems. Some may find the use of cameras intrusive, particularly if it allows people to track each others’ movements.

One such case was the subject of headlines in 2021. Jon Woodard was ordered to pay damages after he installed CCTV on his property. In this case, Jon had seemingly deliberately set up several cameras with the sole purpose of monitoring his neighbour’s comings and goings.

In most cases, where CCTV is installed purely for one’s own peace of mind, there is usually nothing to worry about in relation to data protection.

The ICO (Information Commissioner’s Office), which upholds information rights, advises that while there are ways to mitigate the effect your CCTV use has on neighbours, it is “high unlikely” the ICO would take enforcement action on a domestic CCTV user should a neighbour take issue.

What to consider when setting up domestic CCTV

There are a few things you can do to be on the safe side when installing a CCTV system around your home, to ensure you’re within the law and reassure neighbours of your intentions.

1. Set up the cameras in such a way that limits what is captured outside of your property. You may be able to restrict what the camera can see using the software it comes with, or block part of the camera’s view using tape.
2. Change the default password on the system as soon as it’s set up.
3. Speak to neighbours about your new CCTV system, explaining why you are getting it and what you may be able to see of their property. Offer them a chance to look at the footage to reassure them.
4. Put up signs in clear view to tell passers-by that CCTV is in use.
5. Set up the system to regularly delete footage, e.g. after 30 days.
6. Give people copies of footage they are in, if they ask.
7. Delete footage of someone, if they ask you to.

In summary, using CCTV around your house is an easy way to increase security and peace of mind. As long as you’re sensible and follow a few basic steps, it shouldn’t cause a problem in terms of data protection.

Domestic vs commercial CCTV use

While an at-home CCTV system that happens to cover public property is not subject to data protection law, any commercial use of CCTV would be subject to the UK GDPR, DPA 2018 and, for public authorities, the Surveillance Camera Code of Practice.

Scottish organisations should follow the CCTV Strategy for Scotland. 

Organisations in the UK should therefore ensure that they have the appropriate documentation in place and that the privacy of data subjects has been given proper consideration.

For example, CCTV use (including dashcams, camera doorbells and body cams) should be assessed using a DPIA (data protection impact assessment) for any processing likely to result in high risk to individuals. This would include processing special category data, monitoring publicly accessible places on a large scale, or monitoring individuals at their place of work.

The organisation must also register with the ICO, consider how it would comply with data subject rights and have policies and procedures in place to ensure the personal information it captures will be well protected.

The process of setting all this up and maintaining it is complex, but must be done properly. Organisations that fail to comply with the relevant regulations can face criminal charges and face fines up to £500,000.

If you’re an organisation considering implementing CCTV, the ICO has some helpful information on the topic, and DQM GRC offers a CCTV Audit service to help ensure your CCTV use complies with data protection regulations.

Key takeaways:

• Domestic CCTV users should be considerate but don’t have too much to worry about in terms of data protection law.
• Organisations using CCTV are subject to multiple regulations and codes of practice, and should ensure they have all the appropriate documentation in place, as well as processes for fulfilling data subject rights.
• Depending on their size and maturity level, some organisations may find the administration burdensome and may prefer to engage external consultants to ensure the personal information captured by CCTV is adequately protected.