A particularly extreme example of improper and misleading use of domestic CCTV provides a reminder that video and audio recordings of individuals qualify as personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) and attract the appropriate safeguards whether for domestic or commercial use.
HHJ Melissa Clarke found in Fairhurst v Woodard that four cameras placed around the defendant’s home location, covering (amongst other areas) a shared drive and shared car park, went beyond the scope of the specified purpose of providing security for his car. She also found that the defendant had not been transparent about the status of two of the cameras, claiming they were dummy cameras when they were actually live. Contrary to the way the case has been presented in some of the inflammatory reports of the popular press, the judgment did confirm that the usual and intended use of a video doorbell on a main access door of a domestic property met the balance of legitimate interests of security and privacy between homeowner and passer-by or caller.
It is not new that video and audio recordings of individuals qualify as “personal data”. Their collection, transmission and retention is not subject to the UK GDPR and the DPA 2018, if the system is set up to capture only data within the boundaries of a private domestic property, including the yard or garden. However, if the CCTV records personal data outside the private domestic property, e.g. neighbours’ properties, shared spaces, or public footpaths or a street, then the use of CCTV is covered by the data protection laws. In this case, the use of CCTV by the defendant constitutes processing within the meaning of the UK GDPR and is subject to the Regulation’s guidelines for the processing of such data, as it covered an area broader than the confines of his own property. Those who wish to use video or audio for a legitimate purpose such as security have to be conscious of the balance between that purpose and the rights of others. Recital 4 of the UK GDPR states that the “processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.” One of these fundamental rights is security of person and property.
In this case, the defendant failed to restrict the use of video and audio to that of his stated purpose of providing security for his car following an attempted theft. The video the cameras picked up included comings and goings on a shared driveway that was not part of the defendant’s property and included most of a shared car park as well as parts of neighbours’ gardens, together with any incidental audio from the areas when the relevant audio capable camera was activated. The defendant did not consult with his neighbours before setting up the cameras. In response to queries about several of the cameras, the defendant misled his neighbours by claiming they were not live when they were.
The court found that, when balancing the defendant’s legitimate interest of crime prevention against the claimant’s right to privacy in her home, the defendant’s actions went too far and breached the DPA 2018 and the UK GDPR. More specifically, the court found that the defendant breached both the first and second principles of the UK GDPR, as he did not process data fairly and transparently and did not collect data for a specified or explicit purpose, but misled the claimant about the intended use and scope of the camera. In other words, while the defendant may have had a legitimate interest in installing cameras for crime prevention, the collection of personal data outside his property boundaries went beyond that legitimate interest and was therefore disproportionate. Damages are yet to be assessed.
Sensible alternatives were proposed in the decision, including appropriately restricted fields of coverage for the cameras and, if audio was necessary at all, using a short-range microphone. Most commercially available CCTV products now feature customisable exclusion zones for camera coverage and motion sensitive activation, and those with audio capability can provide for audio streaming and recording to be disabled. If the defendant had consulted with his neighbours before acting, he could have accommodated any concerns and avoided the situation he now finds himself in, but he could also have obtained the blessing of other consenting neighbours.
When proposing to use CCTV outside the boundaries of a domestic property, the ICO recommends carrying out a Data Protection Impact Assessment (DPIA) to record its purpose and scope. Coverage of cameras should be restricted to that required to fulfil the legitimate purpose of the CCTV. Any use of wifi or remote access to transmit video, images or audio must be suitably encrypted to avoid unauthorised access. To comply with the requirement for transparency, prominent signage should be displayed explaining the purpose of any CCTV and providing contact details. And, of course, it is then important to ensure that you comply with the restrictions set out in that DPIA.
Further guidance from the ICO can be found here for domestic CCTV systems, and here for commercial use or use of CCTV outside the boundaries of domestic properties, including a Code of Practice.
Comment
This decision deals with two important and related issues in our modern world, security and privacy. As anticipated in the UK GDPR, there will be tensions between such key issues. It is not unreasonable for surveillance systems to be used to enhance security, and whilst one might expect neighbours to be grateful for incidental security, it has to be accepted that they are equally entitled to protection of their personal data. As video and audio surveillance systems become more sophisticated and widespread, it will be important for those installing and operating them to be aware of the balance required between legitimate interests such as security and the reasonable expectations of privacy of those potentially affected by the surveillance system.
