CCTV and GDPR considerations

 It’s important for people to know their data protection rights, and CCTV and GDPR considerations is a new thing for people and organisations to consider.

It has been suggested that many do not know that GDPR has an impact on CCTV since the new changes in power came in to affect in May 2018. CCTV is, after all, widespread – really widespread – throughout the UK. It’s now also commonly used by organisations in the office as well as outside an office for security, and is typically used on-board commercial vehicles, largely for security, legal and health and safety reasons.

But, what about the relationship between CCTV and GDPR?

Images captured by CCTV is normally classed as personally-identifiable information within meaning of the GDPR. The fact that images are being collected and stored must usually be done for a strong and valid reason in order to justify the recording of personally-identifiable information within meaning of the GDPR.

As your personal data is being collected, you should have provided informed consent. Many places will have signage to confirm CCTV is in operation, but in workplaces or commercial vehicles, potentially more images – and therefore more data – is being collected.

This is key for new links between CCTV and GDPR.

The retention of images recorded is also a key thing for people to consider. Most organisations, we find, don’t retain CCTV images for a long period of time unless it’s being used for a legal action. It’s normally recorded-over fairly quickly. But, if an organisation intends to keep hold of footage for longer, how aware are you as to how long the images – i.e. your personally-identifiable information – will be kept for, or in what format it will be kept, and where, or with whom?

GDPR should heavily influence the way in which both organisations and people being recorded see the use of CCTV footage. CCTV and GDPR now go hand-in-hand now. Whilst there’s little doubt that the use of CCTV is often vital for legal and safety reasons, new obligations the GDPR has brought in cannot be ignored.

Few can risk or afford the new powers the ICO has to fine data breach offenders £17m or 4% of their global annual turnover.