GDPR compliance in CCTV is the process of ensuring that your CCTV system complies with the UK GDPR. According to the UK GDPR, organisations need to be upfront about handling personal data and get permission from users before gathering their personal info. To comply with UK GDPR, you must also make sure your CCTV system meets these basic requirements:
Your CCTV system must have a clear purpose statement describing why it’s being used by the organisation (i.e., safety and security purposes).
The footage from cameras should be retrieved only if there’s suspicion that an individual may have committed an offence (i.e. if it matches existing video footage from other sources).
Any footage collected must be stored securely so unauthorised individuals or third parties cannot access it without consent from the individuals featured (i.e., via a password or biometric identifier).
The need for CCTV monitoring depends on each organisation. If you have storage units containing valuable items and sensitive information, CCTV may be useful in monitoring access and maintaining a log of activities around these areas. Other organisations may choose to only install CCTV following previous security incidents.
The monitoring of employees through video surveillance isn't required by the GDPR. It is left to the discretion of the data controller (your organisation) to identify a need for CCTV and decide.
When we think about personal information, our first thought is written documentation, such as banking details and forms of identification. But it's important to remember that images and videos may also include personal information, a key consideration for CCTV systems under the GDPR. To stay compliant, remember these key points when using and sharing CCTV footage:
The GDPR is rooted in transparency, and you must inform people that they are under surveillance using visible signs. Signs should also include the following details:
Article 5(1)(c) of the GDPR stipulates that data collection should be “adequate, relevant and limited to what is necessary” in line with its stated purpose. Be sure to review your CCTV practices and delete unnecessary footage regularly.
Only those who need access to surveillance footage should be allowed access, i.e. those in management roles and others who require this data to perform their duties. To facilitate this, cloud-based systems can store CCTV footage securely in an encrypted format that those with permission can access.
Before you set up your CCTV cameras and begin surveillance, you should identify and minimise any potential data processing risks. Gather this information through a DPIA - learn more about carrying out a DPIA and download a DPIA template. A DPIA should be conducted whenever CCTV equipment is newly installed or moved.
Individuals should be allowed access to CCTV footage that concerns them. These requests can be formal or informal, and you are expected to respond to requests within one month. The requested footage should be provided in a secure and easily accessible way, with the identities of other subjects blurred to ensure their privacy.
When done effectively, CCTV can be a valuable tool in maintaining workplace security and protecting the confidentiality, availability, and integrity of sensitive information. However, there are a few risks you should consider before choosing to install CCTV.
Watch our on-demand webinar: Master the GDPR compliance audit: A comprehensive guide
Though not inherently risky, there are a few things you should aim to avoid before choosing to install CCTV at your workplace:
Monitoring workplace activities may damage your relationship with your employees, so they must be informed of any CCTV devices. Uninformed/non-consensual surveillance may result in complaints and staffing issues.
Your organisation might violate the GDPR and incur heavy fines if the collected data isn't adequately protected. This could damage your organisation’s reputation and put it at significant financial risk.
Ensure that the means of surveillance are not overly intrusive so as not to violate your employees' privacy. Such violations can result in legal action.
The ICO takes data privacy violations seriously, which extends to poor CCTV practices. GDPR violations can result in fines amounting to €20 million or 4% of an organisation’s annual global turnover – whichever is greater.
When reviewing how your organisation handles personal information, don't overlook that video surveillance might capture personally identifiable images. Following GDPR guidelines safeguards your organisation against unauthorised sharing of sensitive data, breaches, and hefty fines.
Find out how to keep your organisation GDPR compliant and how our experts and platform can help you along the way. And if you’re ready, don’t hesitate to reach out: