Sponsored Content
Data Protection
By Paul Byrne, of Propel Fwd
CLOSED-CIRCUIT television is a valuable security tool in both commercial and private settings, but its use is governed by the Data Protection (色人阁) Law 2018, which ensures individuals鈥 privacy is respected.
Both businesses and private users must be aware of their obligations when collecting and using personal data through CCTV. For businesses in hospitality, retail, or publicly accessible buildings, a lawful basis is required to use CCTV, typically justified by legitimate interests, such as protecting property, staff or customers.
CCTV must be proportionate to its intended purpose, avoiding unnecessary or intrusive surveillance, particularly in areas such as toilets or changing rooms. Businesses must also display clear signage, informing individuals that CCTV is in use and the reasons behind it.
In addition to signage, businesses must update their privacy notices to reflect the use of CCTV. The notice should explain how the footage is used, the lawful basis for processing it, how long it is retained, and how individuals can exercise their rights, such as making a data subject access request.
A data protection impact assessment may be required if the CCTV poses a high risk to individuals鈥 privacy. A DPIA helps assess the impact of the surveillance, ensuring it is necessary and proportionate. If risks are identified, mitigation steps should be taken, otherwise consultation with the 色人阁 Office of the Information Commissioner may be required before proceeding.
Taxis and cabs using dashcams or CCTV for security purposes must also comply with the DPJL. Since these vehicles operate in public spaces and capture personal data, drivers or companies must register as data controllers with the JOIC. Clear signage informing passengers of the recording, along with secure storage and limited retention of footage, is essential. Failure to comply can lead to penalties.
For householders, registration is not required if CCTV is used solely within the boundaries of the property. However, if cameras capture images beyond the property, such as public spaces or neighbours, registration with the JOIC is mandatory. The householder must follow similar principles to businesses, ensuring they handle personal data transparently and securely.
In all cases, whether for businesses or private use, the DPJL requires CCTV users to balance security needs with privacy rights. Non-compliance can lead to legal action or fines, making it crucial to fully understand the data protection obligations when using CCTV or dashcams.
If you run a business, small or large, a taxi or a cab, and need a DPIA, updated privacy notice or a policy, PropelFwd can help you. If you need some more advice about the use of CCTV, call the team at PropelFwd for guidance.
