Data Protection Act 1998
Your guide to compliance
The Data Protection Act 1998 was introduced to promote high standards in the handling of personal information, and so to protect the individual’s right to privacy.
The Act applies to commercial and public CCTV systems only, and is enforceable where a CCTV system obtains, records, or stores personal data in the form of video images.
Most businesses with CCTV installations designed to provide either crime prevention, crime detection or to enhance the safety of the public, will now have to comply with the requirements of the Act by complying with the 8 data protection principles of good information handling. This particularly applies when the purpose of the system is to learn about an individual’s activities.
Personal information must be:
- Fairly and lawfully processed
- Processed for specified purposes
- Adequate, relevant and not excessive
- Accurate, and where necessary, kept up to date
- Not kept for longer than is necessary
- Processed in line with the rights of the individual
- Kept secure
- Not transferred to countries outside the European Economic Area unless there is adequate protection of the information
What happens if I do not comply?
- Your business’s reputation and finances could be affected.
- The Information Commissioner could also take enforceable action against you to bring your processing into compliance with the 8 principles.
- A failure to notify or renew a notification that your business has a CCTV system in operation is a criminal offence punishable by a fine, unless you are exempt from notifying.
- An individual may seek compensation through the courts for any damage suffered.
Requirements of the Act
- Your CCTV system must be registered by notifying the Information Commissioner at www.informationcommissioner.gov.uk or telephone 01625 545740. The notification period is one year and the fee is £35. If you have already registered your CCTV system the Information Commissioner will write to you before the expiry date of your register entry, and the renewal cost is £35.
- Warning signs must be displayed to show that CCTV cameras are recording, stating the purpose of the system and including details of who manages the system and how to contact them.
CCTV Systems incorporating an analogue Video Cassette Recorder (VCR)
- All your recordings must be logged and tracked to show who changes tapes and when, and when a tape has been released to a third party or removed from use
- All your recorded tapes and video cassette recorders must be kept secure.
CCTV Systems incorporating a Digital Video Recorder (DVR)
- All your recordings must be logged and tracked to show how long images are stored and when images have been released to a third party
- All your recorded images and digital recording devices must be kept secure
Subject Access Request
Individuals have limited rights under the Act to request a copy of the information held about them. This is known as the right of subject access. Such requests must be documented and reasonable, and you can charge an administration fee of up to £10 to produce the information. You must deal with such requests promptly and in any case within 40 days.