The use of CCTV has become so commonplace that most people have become oblivious to the risks that it poses. It is clear that, in the right circumstances, CCTV can be effective in protecting property and personal safety. Jersey’s Data Protection Law permits the use of CCTV for the right purpose, with appropriate controls.
Nevertheless, businesses and individuals often use CCTV for purposes where it is excessive to their needs and not effective in that it does not help solve the problem they have. Service providers often promote their products aggressively. Some property developers automatically install it in new buildings, whether or not prospective tenants even want it. This results in the unnecessary overcollection of personal data that can compromise the rights and freedoms of individuals whose images the CCTV captures. It is important for everyone to understand the risks of CCTV and for data controllers to determine its use to be appropriate before implementing it.
Most people are rightly concerned about their personal security and that of the homes, businesses and assets, and they want to take appropriate and effective measures to protect themselves. CCTV is an attractive option because it is inexpensive and widely available. We assume that it will provide a deterrent to crime because it increases the risk to a perpetrator that law enforcement will apprehend them. However, CCTV often also captures the data of many innocent, law-abiding individuals. This raises the risk of someone abusing that data to compromise the rights and freedoms of those innocent people. In that way, if CCTV recordings fall into the wrong hands, they can facilitate crime, as well as detect it. Moreover, being under video surveillance affects how individuals behave and can become emotionally stressful.
Years ago, when I was investigating complaints about the overuse of CCTV in a block of flats, one of the complainants spoke eloquently about the impact of video surveillance:
Surveillance by video cameras has a different effect than other forms of collection of information. Being under a state of constant observation has real psychological effects. … People react differently to being under surveillance. ... They feel self-conscious and nervous. They may feel humiliated, and certainly many are intimidated. There can be a sense of personal violation. The psychological impact of feeling under constant observation can be enormous, incalculable. It causes people to alter their social behaviour. Casual behaviour can no longer be casual. [1]
When we take into account how frequently CCTV captures our images during the course of a day in St Helier, we see that this effect can multiply.
The question then becomes how to obtain the benefits of CCTV technology, while avoiding the risks. This involves a two-step process. The first step is to determine whether CCTV is appropriate for a particular purpose. Conducting a data protection impact assessment (DPIA) will help to answer this question. CCTV is highly invasive and is appropriate only when all of the following circumstances apply:
It is important to note that the function of CCTV is forensic: that is to say, that it assists in the investigation of crimes. There is nothing in the technology that explicitly prevents crime. It is only the deterrent effect of the expectation that police are more likely to be able to identify the perpetrator of a crime. CCTV does not prevent drunken brawls. Nor does it prevent accidents. Therefore, it is not effective, for example, in ensuring safety around a swimming pool. It has proven effective, however, in deterring shoplifting, which is endemic in the retail sector. It is important to note that CCTV will only deter crime where people are aware of its existence. This requires adequate signage to notify the public of the deployment of CCTV. The Data Protection Law also requires this notification on signs to include the purpose for the collection of personal data and the contact information of the person responsible.
If a DPIA determines that the four conditions above apply, it is necessary to complete the other elements of the assessment with respect to the deployment of the equipment. This includes such factors as the placement of the cameras, security measures to protect the images in the system, controls on who has access and the retention period for the recordings. The Data Protection Law requires that data controllers limit the collection of data to the minimum required to achieve the objective and limit the use of the data to only the stated purpose. The Law prohibits using CCTV recordings, collected for the purpose of personal security or the protection property, for other purposes, except in limited circumstances.
These rules also apply to home surveillance systems and dash cams. Users must take care in positioning cameras to ensure that they do not capture the data of innocent, law-abiding individuals in public places. Dash cams should not be able to record the number plates of passing cars or the faces of passing cyclists. The Data Protection Law includes an exemption for the collection of personal data for domestic or family purposes, but this does not apply to the collection of personal data of members of the public acting lawfully in a public place.
Our Data Protection Law supports getting the right information to the right person at the right time for the right purpose. If used properly, CCTV can achieve these goals. However, when used improperly, it can be illegal and do more harm than good. The key message is to resist the allure of technology for its own sake. Conduct a thorough analysis of the existing problem and identify the most effective means to address it. If CCTV is the answer, make sure to implement it with the safeguards that the Law requires.
[1] British Columbia Order P07-02, [2009] B.C.I.P.C.D. No. 34, p. 5, https://www.oipc.bc.ca/orders/1417.
