printer friendly version

Practical surveillance guidelines

The Information Commissioner’s Office (ICO) in the UK recently brought out a new code of practice regarding data protection with a particular focus on surveillance cameras and personal information. This supplements regulatory measures already being established by the Surveillance Camera Commissioner for the UK.

The document can be obtained from its website at http://ico.org.uk. UK and South African crime, civic and surveillance environments are very different and the UK is driven primarily by a public CCTV surveillance philosophy. Recent developments in the UK also come after a few years of little movement due to political changes there. There are also a range of other laws that impact on what can or cannot be done in the UK regarding privacy, human rights, and access to information.

However, because many of our laws and best practice that influence CCTV are derived from the UK, it is important to consider what areas and issues are emerging in the UK. This is particularly the case as our Protection of Personal Information Act gets established and we can expect some provisions from this code of practice to filter through to our own regulatory environment and decision making. It therefore makes constructive reading for our own circumstances.

The ICO’s code has been based on extensive consultation but its recent publication shows some contemporary issues. Besides CCTV which is seen to process individuals’ personal information through the collection of video information, the code now extends to automatic number plate recognition, body worn cameras as discussed at the iLegal conference recently, drones or unmanned aerial systems as the document refers to them, and other systems capturing information of identifiable individuals or relating to individuals.

The use of mobile systems is seen in a similar way to fixed technology, so a mobile ANPR vehicle would need to adhere to the code in a similar way to fixed cameras performing the same function.

More than security

Video analytics are also part of what is covered in this emerging technology area, and is not just restricted to crime. The use of technology for marketing, advertising, or operational efficiency are all effectively subject to the same restrictions and may impact on people using CCTV well removed from the traditional crime focus.

The code states, for example, that “the use of technologies to identify individuals’ faces, the way that they walk or their eye movements, for example when they are looking at advertising, are being increasingly used by organisations. These types of technologies attract the same data protection concerns as those discussed already in this code. If you are thinking of using these systems you must provide fair processing information to data subjects. If you are storing this information you will also need to have an appropriate retention and disposal schedule and have suitable technological and physical security measures in place” (pg 31). The code also states that any use of automated technology such as video analytics should involve some level of human interaction and should not be done on a purely automated basis.

What is not covered is also interesting. The use of surveillance for limited household purposes is exempt from the Data Protection Act (DPA) and is therefore not seen as influenced immediately by the code. However, given legal developments in the Court of Justice of the European Union, the ICO may review its position on the use of CCTV for domestic crime prevention purposes. Because the DPA exempts activities relating to journalistic, artistic and literary purposes, the code does not cover use of conventional cameras by the news media or for artistic purposes. However, the code does apply to information collected by surveillance or CCTV systems that is provided to the media.

Given the extent to which CCTV cameras can contribute to news stories, this could have interesting implications and public interest conflicts. Also, the capacity of conventional cameras, whether standalone or built into a phone or tablet, is increasingly becoming popular in various countries. In Australia, for example, news stations will often request people with such footage to send it through at the end of the news broadcast, and we have similar trends in South Africa with at least one of our radio stations. Ironically, a system featuring dummy cameras or one that is not operational is not covered by the code, because it is not actively gathering information on individuals.

Motivation and justification

The code stresses the importance of motivating the use of CCTV and in this sense, provides some realistic questions that even those not concerned about privacy would benefit from considering. It notes that “before you decide to procure and deploy such a system, it is important that you justify its use and consider whether or not it is proportionate, necessary and addresses a pressing social need” (pg 27). It also proposes the use of privacy impact assessments. In true British nature, there is also reference to a specific code of practice on conducting privacy impact assessments.

Recording, disclosure, and awareness of being monitored are major areas covered by the ICO code. Signage is seen as important and the code states that “clear and prominent signs are particularly important where the surveillance systems are very discreet, or in locations where people might not expect to be under surveillance”. Interestingly enough, the duty for privacy is also a relative thing. For example, information collected by cameras at a drug rehabilitation centre may be far more sensitive to those outside a hardware store. In this sense, if you are dealing with sensitive issues, you need to be prepared to pay far more attention to your data protection and who may get to view live or recorded camera footage. The code also has a focus on audio recording in conjunction with video feeds.

Motivation of the need for surveillance and the threats being protected against do have a substantial impact on how the code is applied. For example, the time recorded footage which is retained is seen as a sensitive issue that should be defined not by the capacity of the system to record for a longer period, but by the privacy concerns. This is likely to result in some interesting conflicts of views between different parties who may need to use the same camera data. Surprisingly, the code mentions the example of heightened expectations of privacy in somewhere like a change room, and makes the point that cameras should only be used here under exceptional conditions to “deal with very serious concerns”. I would certainly be interested in what constitutes such “very” serious concerns, but in South Africa we would probably need court approval for such a step anyway.

Practical and useful

The ICO data protection code of practice for surveillance cameras and personal information provides some good common sense guidelines, a perspective on legal issues within the UK environment and potentially elsewhere, and some recommendations that are, frankly, going to be very difficult to manage easily – for example switching on video and sound separately for body worn cameras depending on conditions – you can imagine the thoughts of someone in a crises and having to consider these steps. There is a great deal of comment on how things need to be related to the sensitivities of your particular environment, and this is both a curse and a good thing about the code.

It acknowledges that there is no one solution and people need to cater for the specific circumstances under which they are operating. At the same time, the use of discretionary decision making may well become a primary issue in courts of law when examining cases, and if you are in the UK, your system information gathering may be challenged at the most basic level of procedural correctness to get people off severe offences. For South Africa, the code provides good insights into some of the privacy issues as well as some considerations for effective and relevant system design, and best practice.

Dr Craig Donald is a human factors specialist in security and CCTV. He is a director of Leaderware which provides instruments for the selection of CCTV operators, X-ray screeners and other security personnel in major operations around the world. He also runs CCTV Surveillance Skills and Body Language, and Advanced Surveillance Body Language courses for CCTV operators, supervisors and managers internationally, and consults on CCTV management. He can be contacted on +27 (0)11 787 7811 or craig.donald@leaderware.com

Share this article:

Further reading: