Did you know that in the same way that your personal data is protected under the GDPR any CCTV footage that you collect is also protected in the same way?
Making sure that you comply with data protection regulations takes a lot more than a sign that says “warning CCTV in operation”. Any recordings where an individual can be recognised have to be treated as ‘personal data’ and protected accordingly. Failing to do this could leave you on the wrong side of the ICO with a large fine.
How do you ensure that your recordings stay within the law?
Where are your CCTV recordings stored?
You must consider where your CCTV recordings are stored and who has access to them. If someone else has access to the recordings you must ensure that they are credible and capable data handlers. Essentially, you must display the same levels of security over your CCTV footage that you would over the email addresses and phone numbers of your customers and staff.
The security of your network and storage also has to be considered. Do you have adequate cybersecurity and internal security measures in place? For example, can ex-members of staff still access your systems?
Can you switch your CCTV system off?
GDPR and the ICO have stated that you must have legitimate grounds for making CCTV recordings on your premises. Within this, you must be able to show that you can you’re your CCTV system off when needed. You may argue that it’s vital to have 24/7 CCTV protection on your premises, but you must be able to clearly demonstrate that you have legitimate grounds for this.
If your CCTV system has a sound recording option you also need to be able to show that this function is fundamental to the security of your business. Remember, CCTV recordings shouldn’t record conversations between members of the public or between staff. If this happens it could be considered highly intrusive.
Would your recordings stand up in court?
Having CCTV on your premises is an excellent security measure and deterrent, but you also need to make sure that any recordings you make are fit for purpose. Could your recordings be used to support a criminal investigation?
Any recordings you make must be clear and you must also regularly check that the date and time stamps are accurate. Essentially, any recordings must be usable and easily accessible should the police require them for their investigations.
Do you have a CCTV policy?
Any organisation that has CCTV cameras should also have a CCTV policy in place. Your policy should pinpoint how you protect rights to access images, and include fair usage policies and a deletion timeline. You also need to check that your employees are aware that CCTV is in operation, where the cameras are and what to do if someone requests access to footage of them.