Advanced surveillance systems using new technologies have spread beyond simply cameras. This has implications for the data protection obligations of security system and CCTV operators.
ICO identifies increased risk from the latest surveillance technologies
The Information Commissioner’s Office (ICO), which works to secure compliance with data protection law in the UK, states that: “Advances in technology and software mean that surveillance systems can pose an increased risk to people’s privacy in both the public and private sectors.”
The regulator has created guidance for new technologies that expand the capability of traditional surveillance systems which highlights additional considerations to consider when processing personal data’ This guidance also includes good practice recommendations organisations should follow in order to comply with the UK GDPR and Data Protection Act (DPA) 2018.
A new law, the Data Protection and Digital Information Bill, is currently going through parliament and is being debated within the House of Lords. The government said it remains committed to the main elements of the UK GDPR, although some peers are concerned about the Bill which gives the Secretary of State for Science, Innovation and Technology, the power to amend the regulation via statutory instrument.
A range of surveillance technologies are covered by data protection law
This means, however, if you comply with the current guidance you will continue to meet the data protection standards of the UK GDPR. The technologies covered by the ICO’s guidance are:
- Automatic Number Plate Recognition (ANPR)
- Body Worn Video (BWV)
- Unmanned Aerial Systems / Drones
- Facial Recognition technologies and surveillance
- Smart doorbells (commercial use)
- Surveillance in vehicles
- Action cameras and other portable surveillance
Before deployment of these technologies organisations should carry out a Data Protection Impact Assessment (DPIA) that explores any impact on the rights and freedoms of individuals whose personal data are processed.
The importance of processing personal data correctly
All processing of data must be done in a fair, lawful and transparent way as explained in an earlier post This means putting up signage to inform people that a particular technology is being used in an area, which would be in addition to any signage with information that you have CCTV. All signage needs to have sufficient detail about who to contact if they have a query. Additionally, the surveillance cameras that are using the technology must be kept to the minimum required for the purpose identified.
Organisations also need to have appropriate retention periods for the personal data collected and stored through your surveillance system as well as governance procedures in place to be able to retrieve stored data and process it for subject access requests or onward disclosures.
The ICO adds, “If you are intending to match data together from different systems, you need to be careful that the information you are collecting is:
- accurate;
- not excessive;
- used only for defined purposes; and
- the use is still necessary and proportionate throughout the lifecycle of the processing.”
Avigilon and Motorola Solutions take data protection seriously
At Ecl-ips we offer surveillance camera technology from Avigilon and its parent company, Motorola Solutions encompassing ANPR, BVW and facial recognition technology. Avigilon says that, “security and data protection are at the heart of the hardware, software solutions and services we provide”. The company’s approach is based on three principles:
- Availability: Ensuring the systems are available when needed and that data is protected from deletion, whether intentional or accidental.
- Confidentiality: Ensuring the right people have access to the right parts of the system and that access is protected by password and encryption.
- Integrity: Ensuring the system is functioning as intended and is protected from backdoor access and malware.
Staying compliant while benefiting from new technology
To aid data protection compliance, the latest Avigilon Unity Video software, which is embedded in H6A and H6X cameras, features dynamic privacy masking which blurs people and vehicles in video but provides the flexibility to remove it for investigations. Separately, to help you easily meet more stringent privacy requirements, the H6X cameras have been designed without a built-in mic.
Customers can therefore be confident that data protection compliance is integral to any advanced Avigilon surveillance system we install. Additionally, our expertise means we will only locate surveillance cameras using ANPR and facial recognition in the areas they are required. We can also advise on the signage needed. If you want extra support to manage your CCTV assets and ensure data protection compliance you may be interested in trying out CCTV Logbook.
Giving you confidence by achieving high cyber security standards
To show our commitment to high levels of cyber security within our own systems we have achieved the IASME Governance Standard, which also means we became Cyber Essentials Certified. We are also an NSI Gold accredited installer providing customers added peace of minds that all installations are carried out to a high standard.
We have produced a series of blogs and videos looking in detail at data protection law and how it relates to CCTV. For information on retaining compliance sign up to our newsletter on our blog page so you can read articles once they are published.
If you want to know more about the advanced surveillance technologies we offer from Avigilon and Motorola Solutions, please get in touch.