Are you concerned about whether your use of CCTV, whether in the classroom or workplace, is legal? Do you know what information people are legally entitled to request, if you use it? Kate Grimley Evans, solicitor at Stone King LLP, takes you through the basics of how to use CCTV legally and where to look for further advice.

1. CCTV and Data Protection
Law
Kate Grimley Evans
Solicitor
Stone King LLP

2. Uses of CCTV
Camera
uses
Crime
Prevention
Student
behaviour
Lesson/staff
monitoring
Facial
recognition

3. Which uses are OK?
Answer : It depends!
You must comply with the Data Protection
Act in deciding whether or not to start or
continue the use.
So how?

4. Privacy Impact
Assessment
Information Commissioner
provides a Privacy Impact
Assessment Code of
Practice with a precedent
PIA.
It helps you consider the
Data Protection
Principles.
It isn’t compulsory but
doing one is good practice
and likely to improve your
legal position.

5. Data Protection
Principles
• fair (from Data
Protection Principle 1)
• proportionate in
relation to the purpose
of the system (from Data
Protection Principle 3)
What
you
do
should
be:

6. Data Protection Principles
Principle 1
Personal Data shall be processed fairly and lawfully
and , in particular, shall not be processed unless--
(a) at least one of the conditions in Schedule 2 is
met and
(b) in the case of sensitive personal data, at least
one of the conditions in schedule 3 is also met
Principle 3
Personal data shall be adequate, relevant and not
excessive in relation to the purposes or purposes for
which they are processed.

7. Being Fair
• What is the effect on
individuals’ privacy?
More likely to be unfair if there is
continuous filming or filming in
areas where people expect
privacy e.g. changing rooms,
private offices

8. Compliance with a schedule
2 Condition
Consent
Implied or express
Legitimate interests condition
The processing is necessary for the purposes
of legitimate interests pursued by the data
controller or by the third party or parties to
whom the data are disclosed, except where the
processing is unwarranted in any particular
case by reason of prejudice to the rights and
freedoms or legitimate interests of the data
subject.

9. Proportionality
Personal data shall
be adequate, relevant
and not excessive in
relation to the
purpose or purposes
for which they are
processed
Is using cameras the
best way to achieve
your objective? Have
you looked at
alternatives?
How good are the
images? If they are
not good enough for
the purpose then you
may not be able to
justify the use

10. Deciding if your use is
compliant
• Do a privacy impact assessment
• Consult the ICO’s Employment Practices
Code
• Consult the ICO’s CCTV Code of Practice

11. What to think about
The ICO CCTV Code will help you comply but think about these things
• Why do you want to use CCTV. Is it the best way to achieve your objective
• Will people know what you are doing?
• Signs
• Privacy Notices (DfE precedents available)
• Do you have a CCTV policy or a Data Protection Policy covering the issue
• How long are you keeping the images?
• What are the data storage arrangements?
• Individual rights of subject access
• Staff training
• Does your registration with the ICO (officially called the ‘Notification’) show that you
have CCTV? You are no longer required to list all the purposes for which you use
CCTV but you do need to say that you have CCTV. There is currently no up to date
guidance on the notification process and no indication of when new guidance will be
issued but there is an ICO notification helpline which is 0303 123 1113.

12. Overlap with other issues
Facial recognition – biometric
technology – follow DfE
Guidance on Biometrics in
schools
Staff Monitoring – refer to the
ICO Employment Practices
Code

13. Employment Practices
Code
Whenever you are filming staff to monitor performance or conduct consult this Code
and also do a Privacy Impact Assessment. There is overlap between this Code and
a PIA but the Code will help you make sure you have asked the right questions.
Whether you should be monitoring in a particular case
Privacy impact
Considering alternatives

14. Practical examples
• Monitoring staff all the time is very privacy
intrusive.
• Can you really justify a camera being on in a
classroom or workplace all the time?
• Is it necessary?
• Can you limit the area covered?
• Private areas are different from corridors.
• Be careful about relying on consent in the
employment context

15. Requests for disclosure of
footage
FOI requests
DPA subject
access requests
DPA disclosures
not under
subject access

16. Subject access requests to
view footage
Balancing the data rights of different people
• Section 7(4) Where the data controller cannot
comply with the request without disclosing
information relating to another individual who can
be identified from that information, he is not
obliged to comply with the request unless—
(a) the other individual has consented to the
disclosure of the information to the person
making the request, or
(b) it is reasonable in all the circumstances to comply
with the request without the consent of the other
individual

17. Subject Access Requests
Subject
Access
Code of
Practice
(chapter 7)
Some
guidance
provided but
legal advice
often
necessary

18. Useful links
• CCTV Code of practice published by the Information Commissioners
Office. This is available here:
• ICO notification helpline which is 0303 123 1113.
• Formal privacy assessment. See here.
• If you are monitoring staff through a surveillance system then you
should make sure you have complied with the ICO’s Employment
Practices Code.
• Are you using the DfE standard form privacy notices for staff and
students and have you adapted them to cover any issues specific to
your school?
• Is the data secured securely? If you are using Cloud Storage, follow
the ICO’s guidance on Cloud Computing
• Are you using cameras to identify people ie. via facial recognition. If
so, you must follow the DfE guidance on biometric technologies

19. Questions
Questions and
General discussion

20. Slide 1 Some rights reserved by charbel.akhras
Slide 2 Some rights reserved by Tulane Public Relations
Slide 3 Some rights reserved by seven_resist
Slide 4 Some rights reserved by vintagedept
Some rights reserved by rpongsaj
Slide 6 Some rights reserved by ssalonso
Slide 7 Some rights reserved by David Maddison
Slide 8 Some rights reserved by MyTudut
Slide 9 Some rights reserved by StockMonkeys.com
Some rights reserved by BlueAndWhiteArmy
Some rights reserved by Bernie Goldbach
Slide 10 Some rights reserved by mollybob
Slide 12 Some rights reserved by Editor B
Some rights reserved by Re-Entry One Stop
Slide 14 Some rights reserved by ChrisGoldNY
Slide 15 Some rights reserved by khairoun
Slide 16 Some rights reserved by winnifredxoxo
Slide 19 Some rights reserved by Raymond Bryson