What is the law on CCTV cameras in the workplace?

CCTV is a useful – and powerful – business tool, enabling business operators to mitigate risk, increase security and protect their stock. Of the estimated 1.85 million CCTV cameras in the UK, only around 52,000 are operated by public bodies, so the vast majority are commercial CCTV systems operated by private businesses.

Commercial CCTV systems are naturally subject to rules and regulations that impose some responsibilities on those businesses and limit the opportunities for surveillance.

The law

Two principal pieces of legislation apply:

• The Protection of Freedoms Act 2012
• The Data Protection Act 1998

The first of these led to the creation of the Surveillance Camera Code of Practice 2013, more commonly known as SCCOP, which is intended to protect a broad public right to privacy while acknowledging the benefits of CCTV technology.

The Data Protection Act, meanwhile, includes the storage of CCTV recordings within its broad remit over the protection of personal data. It gives individuals the right to view footage of themselves or their vehicles.

The Information Commissioner’s Office is responsible for the enforcement of these rules.

Let’s take a look at the how the regulations apply to the use of CCTV cameras in the workplace. Familiarity with the law is vital for business operators: breaches of the Data Protection Act can result in huge fines running into the hundreds of thousands of pounds. Compliance with the law will also protect you from legal action if anyone objects to you recording them.

CCTV law in action

The following are the key guidelines for ensuring that your use of commercial CCTV technology complies with the law:

• Inform the Information Commissioner’s Office that you are the operator of a CCTV system. State a clear purpose for the system and review this on a regular basis to ensure you remain able to justify your business CCTV equipment if required to do so.
• Only install cameras where there is a genuine need – to control access to your building, for example, or to protect sensitive areas such as locations in which stock is stored. Only install cameras in public spaces within your premises. You should not record sound in most circumstances as this would be an intrusion on the privacy of your employees.
• Assess the impact on privacy of your CCTV and your compliance with regulations. Review these whenever you make significant changes to your CCTV installation – for example adding new cameras, changing the position of existing cameras or upgrading your overall setup. Publish the results of these audits.
• Draw up a list of CCTV rules for your staff and ensure your staff are fully aware of these, including of course, any individual responsibilities they may hold. These should include secure storage of footage and defined time limits for that storage: 31 days is usual, but the timeframe can be extended in some circumstances. Ensure you have clear procedures for the deletion of footage older than the limit and strictly limit staff access. All recordings are subject to strict privacy requirements and cannot be published in any way.
• Install signs on your premises indicating the presence of a CCTV system. This is to alert both employees and visitors to your premises, as well as any passers-by who may be recorded by outward-facing cameras.
• Give someone within your organisation overall responsibility for your office CCTV and publish their name and contact information on your website for anyone, including members of staff, who wish to raise concerns, request access or ask questions. Alternatively take on this role yourself.
• Apply caution to outward-facing CCTV cameras, capturing footage of people passing your premises or of private properties in the vicinity. Both of these are subject to the Data Protection Act. The footage should be of sufficient quality to allow its use in court in the event that you capture evidence of a crime: this means decent picture quality and correctly set dates and times. But avoid unnecessary intrusion into people’s privacy: do not direct your cameras at nearby homes and, once again, do not record audio.
• If you connect your CCTV system to external databases in order to access additional information – for example, car number plates – ensure this data is reliable and current.

You can read the Surveillance Camera Code of Practice in full here.

This post does not constitute legal advice or gives rise to a solicitor/client relationship. Specialist legal advice should be taken in relation to specific circumstances.

The contents of this site are for general information purposes only.