CCTV Consultant: Data Protection Complacency Risks YouTube Lawsuit

Too often CCTV operators are ignorant of, or complacent about, their obligations under the Data Protection Act, a leading security consultant says in IFSEC Global.com’s latest Q&A.

Simon Lambert, whose degree in physics and electronics gives him a different kind of expertise to that of ex-police or ex-military consultants, also discusses the code of practice issued last year by the surveillance camera commissioner. Omitting millions of private cameras and lacking “legislative teeth” the code is “a missed opportunity”, laments Lambert.

IFSEC Global: How much of a headache is the Data Protection Act to end users?

Simon Lambert: That was probably one of the first pieces of legislation with real teeth that you could get a nasty letter in the post if you didn’t comply.

If you ignored it they might actually take you to court and throw the book at you – unlikely but possible.

The Information Commissioner’s Office told me you can get up to a £500,000 fine. That’s been the case since 1998 [when the act came into force] and people in the CCTV world are aware of it, but it never ceases to amaze me – and most of the people I know in our industry – how many organisations still don’t understand it or comply.

Do they not have company lawyers?  Do they not have properly trained managers? Or owners who understand their legal responsibilities?

The many CCTV operators who fail to comply with the Data Protection Act either don’t understand it or they’re getting bad advice. Now we’re obviously happy to correct them as consultants; we’re not lawyers, but we can clearly provide the appropriate code of practice and say guys, do you realise point one, point two and point three, actually you are breaking the law – let’s correct this.

IG: In what ways do facilities managers and others responsible for CCTV typically contravene the legislation?

SL: The most obvious thing is not putting up appropriate signage to warn the public that they’re being watched by CCTV cameras and who owns them. That is a very simply thing to rectify, but very often it isn’t done properly.

They may have some signage from the local printers that isn’t actually truly compliant with the code of practice. It may be a picky point, but the law is the law.

Sometimes people are fairly lax with the security of the video footage, having it on display to people it shouldn’t be on display to, not securing it against access from unauthorised people.

The information you’re recording on your video is actually construed as personal data. It must be securely kept, which some people are quite lax about.

Heaven help you if it ends up on YouTube. It’s a pretty serious security breach if people’s personal data in the form of video footage ends up on YouTube without their permission.

Now let’s not fool ourselves into thinking it happens all the time, but it could.

IG: Should CCTV operators pay heed to any other legislation?

SL: The Protection of Freedoms Act 2012 was obviously something the Coalition Government really wanted to push. The surveillance camera commissioner – which is a fairly new role from the Home Office – released a new code of practice for CCTV last August.

Now, while that code of practice is entirely consistent with the data protection law, Freedom of Information Act and Regulation of Investigatory Powers Act 2000 and so on, it isn’t actually mandatory. If you fail to comply with it, nobody can cart you off to prison and it only applies to public authorities – for instance local government with CCTV systems and the police with automatic number plate recognition and their own surveillance systems.

Most people who have looked at it would say it has no bearing on the millions of private CCTV cameras all over the country that do need regulation.

That area goes completely unregulated and I think a lot of people see this new code of practice as a missed opportunity. It would have been an absolute minefield to regulate, but the opportunity was staring us in the face and they chose not to take it.

They say that future revisions may bring those [private cameras] on board, but let’s just say most of us aren’t holding our breath. It’s going to be a long wait.

IG: Why did the code not encompass private cameras do you think?

SL: It’s a government thing driven by the Home Office. You would have thought that things like hospitals, the border control agencies – they’re quasi government organisations aren’t they – would have been included, but even they’ve been left out.

But anyway, the code doesn’t even have legislative teeth. If you don’t comply then all they can really do is wag their finger at you.

IG: So is it a waste of time then?

SL: Well, there are some people who would say “yes”.

IG: Would you be one of them?

SL: Being diplomatic, I do genuinely think it’s a missed opportunity to be wider ranging.  I can understand that that would have been a difficult and onerous task, but it’s a shame that the opportunity wasn’t taken.

Free Download: The Video Surveillance Report 2023

Discover the latest developments in the rapidly-evolving video surveillance sector by downloading the 2023 Video Surveillance Report. Over 500 responses to our survey, which come from integrators to consultants and heads of security, inform our analysis of the latest trends including AI, the state of the video surveillance market, uptake of the cloud, and the wider economic and geopolitical events impacting the sector!

Download for FREE to discover top industry insight around the latest innovations in video surveillance systems.

Download The Video Surveillance Report