The Data Protection Act of 1998 covers the processing by "data controllers" of "personal data" and includes a right for individuals, subject to conditions, to receive a copy of "the information constituting the personal data of which that individual is the data subject".
"Personal data" includes data which relate to a living individual who can be identified from or using that data. For the purposes of CCTV, an image of an individual caught on camera has in the past always been regarded as "personal data". However, a recent Court of Appeal decision in a case relating to a Mr Michael Durant ruled that the naming of a living person in a document does not necessarily amount to "personal data" under the Data Protection Act.
The reasoning behind the ruling has been applied to CCTV with the effect that incidental images of individuals, which are not biographical in nature, do not focus on the individual and do not affect that person's privacy, may in limited circumstances fall outside the scope of the Act. As a result, some businesses may no longer have to comply with the Act in relation to their CCTV activities.
According to the guidance issued by the Information Commissioner last week, organisations that use a very basic CCTV system, of the type that cannot be moved remotely and that record only a general image, may not be covered by the Act.
However, it is the images, and not the system itself, which may be outside the Act. If a system is used to focus on particular individuals, such as employees, then the Act will still apply.
Says the Information Commissioner:
"If you can answer 'no' to all the following 3 questions you will not be covered:
Do you ever operate the cameras remotely in order to zoom in/out or point in different directions to pick up what particular people are doing?
Do you ever use the images to try to observe someone's behaviour for your own business purposes such as monitoring staff members?
Do you ever give the recorded images to anyone other than a law enforcement body such as the police?"
More sophisticated systems are likely to fall under the Act, although not all of the images recorded by the system will be subject to it - for example, images of a general scene where the camera does not focus in on an individual or record an incident occurring, will not be covered by the Act.
Says the guidance:
"The simple rule of thumb is that you need to decide whether the image you have taken is aimed at learning about a particular person's activities. The only difference is that you will no longer have to give individuals access to those images that are just general scenes neither focusing on a particular individual nor being used to learn information about individuals."
The Commissioner has also issued general guidance on the effect of the ruling on Data Protection rules.