The Information Commissioner’s Office (ICO) regulates and enforces the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).
If you have any questions about the use of domestic CCTV or concerns about your privacy, visit the website:
or call them on: 0303 123 1113
If your CCTV system captures images of people outside the boundary of your private domestic property – for example, from neighbours’ homes, gardens, shared spaces or public areas – then the GDPR and the DPA will apply to you. You have to ensure that its use fully complies with these Data Protection Laws. If you do not, you may be subject to regulatory action by the ICO, as well as possible legal action by affected individuals.
The term ‘domestic CCTV system’ refers to any video surveillance equipment mounted or fixed on your home and can include cameras fitted into doorbells.
You must remember that while recording CCTV may be appropriate, publicly uploading or streaming footage of identifiable people needs much stronger justification. In most cases it will not be justifiable.
If your system only captures images within the boundary of your private domestic property (including your garden), then the Data Protection Laws will not apply to you. Nevertheless, the ICO recommends that you use it responsibly to protect the privacy of others. Audio recording is very intrusive and should be disabled in most cases.
If your CCTV captures images beyond your property boundary, you are not breaking the law, but It makes you a data controller with legal obligations under the Data Protection Laws.
You have to show that you are capturing images in a manner that complies with the Data Protection Laws and protects the rights of the people whose images are being recorded. You must provide clear and justifiable reasons for doing it, if asked to do so by an individual or the ICO. You should write them down carefully with your reasons for believing that capturing the images justifies invading the privacy of other people.
You do not have to register with the ICO or pay a fee but you must maintain records of how and why you are capturing images and for how long you are keeping them. You may be required to make these records available to the ICO on request.
You also have to:
- Let people know that you are using CCTV by putting up signs saying that recording is taking place and why.
- Ensure you do not capture more footage than you need to achieve your purpose in using the system.
- Ensure the security of recordings and make sure nobody can watch them without good reason.
- Only keep recordings for as long as you need them.
- Ensure the CCTV system is only used for the purpose you intend and that anyone sharing your property, such as family members, understands the importance of not misusing it.
You must respect the data protection rights of the people whose images you capture by:
- Responding to Subject Access Requests (SARs). Individuals have a right to access the personal data you hold about them, including identifiable images. They can ask you verbally or in writing. You must respond within one month and give them a copy of the data.
- Deleting recordings of people if they ask you to do so. You should do this within one month. You can refuse to delete it if you specifically need to keep it for a genuine legal dispute but you must tell them and that they can challenge this in court or complain to the ICO.
- Considering any objections from specific individuals about capturing their image in the future. While avoiding this may not be easy, you should consider whether you need to record images from beyond your property boundary.
- Remembering that publicly uploading or streaming footage of identifiable people needs very strong justification. In most cases it will not be justifiable.
If you fail to comply with your obligations under the Data Protection Laws, you may be subject to enforcement action by the ICO. This could include a fine. You may also be subject to legal action by affected individuals, who could pursue claims for compensation.
If you follow the guidance and take all reasonable steps to comply with your data protection obligations, the ICO is unlikely to regard you as a regulatory risk and decide that taking enforcement action against you is a proportionate use of its resources.
Before you install a system is a good dea to:
- Speak to your neighbours and explain what you are doing.
- Listen to any objections or concerns they may have.
- Invite your neighbours to see what footage you will capture in order to allay any concerns they may have. This can avoid disputes and complaints at a later stage.