What is the law for business security cameras?

Security cameras are a powerful tool to keep you safe – especially in the workplace. They are able to mitigate risk, increase your security and protect your premises and staff; there are currently 5.2 million CCTV cameras in use in the UK. The use of a CCTV system for a business is highly beneficial as it acts as a deterrent for any criminal activity; however there are rules and regulations that must be followed. The UK has different legislations regarding the way CCTV footage can be gathered and used, the aim of this is to ensure a business can protect itself whilst still ensuring all employees human rights are followed. So, what is the law for business security cameras?

How is CCTV governed? 

For a business to use CCTV cameras they must be compliant to the General Data Protection Regulation (GDPR) laws. This method of security has grown in popularity meaning public authorities and the government have had to take an active role in the regulation of video surveillance to ensure everyone’s privacy stays protected. There are a number of acts and regulations that must be adhered to when setting up CCTV cameras in the workplace.

The Data Protection Act (DPA) – outlines the requirements when collecting, processing and disclosing CCTV footage; it controls how personal information is used by organisations. 

The Protection of Freedom Act (POFA) – discusses how data can be used and how it must be protected. This act is primarily concerned with CCTV usage in public spaces however is relevant when referring to the workplace. 

The Freedom of Information Act (FOI) – regulates access to any information that is being held by public authorities and gives you the right to see any information that you require. 

The Human Rights Act (HRA) – is one of the most fundamental pieces of legislation that conducts the use of CCTV cameras. This act highlights the importance of privacy and the need to treat everyone equally with respect and equity.

General Data Protection Regulations (GDPR) – clarifies that CCTV footage is personal and that there are specific requirements on how this personal information is stored and processed. This act requires those who hold data to disclose it, based on subject requests from employees. 

When deciding to and installing security cameras in your business there are things that you must consider and follow before this can take place. You must first establish whether or not they are a necessary method of security. If the answer is yes then you must determine what exactly you want recorded and why – ensure areas of privacy are not included in this. You must then register with the Information Commissioner’s Office (ICO) and appoint a data controller to be responsible for the storage, processing and review of all data. 

What rights and obligations do employers have with regard to CCTV?

Security cameras can only be deployed when there is a legitimate business or security concern; the equipment must then only be brought in if it is proportionate, essential and addresses a pressing need that can’t be resolved in any other way. There are numerous obligations regarding CCTV in the workplace to ensure that the privacy of employees and visitors is protected.  

Throughout the premises there must be clear signage wherever a camera is present; this is to make people aware that they are being monitored and are under surveillance. There must also be a policy explaining the purpose and extent of the monitoring and you must ensure that all footage is kept secure and only accessible to a designated person. If anyone requests to see footage they appear in then this must be supplied to them straight away and the footage must be deleted once it is no longer needed. All workers have a right to their privacy so it is vital that – as a business – you are ensuring they feel well respected and comfortable at work. 

Who has access to the footage?

Once security cameras have been fitted you must appoint a data controller who is legally responsible for checking and monitoring the footage. It’s important to keep the list of people with access as short as possible – this is both a legal requirement and helps implement good operational practice. By having fewer people with access it helps to decrease the chance of any footage being leaked. This data must then be stored in a  safe and secure place that is only accessible to the appointed authorised personnel. However, in some circumstances the data can be made accessible to others; by law, anyone can be offered access to footage they appear in but this only includes themselves not anyone else. Police can also be given access as long as their request meets all legal requirements. The Data Protection Act (DPA) requires you to record all access to CCTV footage and keep a thorough document containing all requests for access and any reasoning for denial. 

There is no set amount of time for how long data must be stored for however it should only be kept for as long as it is legitimately needed – this will vary depending on the circumstances. Although data protection laws do not mandate a specific retention period the DPA does state that images should not be retained for longer than necessary to achieve the purposes of the CCTV system. 

When installing security cameras in your business it is important that you understand and follow all rules and regulations that are required to maintain the privacy of your employees and any visitors. When used correctly, they are an excellent and secure way to keep your business safe and deter any criminal activity from your premises. Here at SecurePro we are proud to offer a range of comprehensive, high-quality CCTV packages as well as a host of security services. Our expert team is on hand to answer any queries regarding how we can help to keep you and your property safe; ring us today on 01384 378300 for more information!