Following is additional information supplied by the Data Protection Commissionaires Office (Sept. 2004) following the case in the Court of Appeal - Durant v Financial Services Authority.

This information will help you decide whether your system is subject to the Data Protection Act.


1. Why is this additional guidance necessary?

There has been a recent court case that affects whether particular CCTV activities are covered by the DPA. The following notes make clearer which CCTV activities are covered by the DPA. It is particularly aimed at helping users of basic CCTV systems such as small businesses.


2. What CCTV activities are covered by the DPA?

The court case dealt with when information relates to an individual and is then covered by the DPA. The court decided that for information to relate to an individual, it had to affect their privacy. To help judge this, the Court decided that two matters were important:

•	that a person had to be the focus of the information
•	the information tells you something significant about them

This means that whether you are covered or not will depend on how you use your CCTV system.


3. If I only use a very basic CCTV system, how am I affected?

If you have just a basic CCTV system, your use may no longer be covered by the DPA. This depends on what happens in practice. For example, a small shopkeeper would not be covered who:

•	only have a couple cameras,
•	can't move them remotely,
•	just record on video tape whatever the cameras pick up, and
•	only give the recorded images to the police to investigate an incident in their shop

The retailers would need to make sure that they do not use the images for their own purposes such as checking whether a member of staff is doing their job properly, because if they did, then that person would be the focus of attention and they would be trying to learn things about them so the use of the system would then be covered by the DPA.


4. It sounds like many users of basic CCTV systems are no longer covered by the DPA, is there an easy way to tell?

Think about what you are trying to achieve by using CCTV. Is it there for you to learn about individuals' activities for your own business purposes (such as monitoring a staff member who is giving concern)? If so, then it will still be covered. However if you can answer 'no' to all the following 3 questions you will not be covered:

•	Do you ever operate the cameras remotely in order to zoom in/out or point in different directions to pick up what particular people are doing?
•	Do you ever use the images to try to observe someone's behaviour for your own business purposes such as monitoring staff members?
•	Do you ever give the recorded images to anyone other than a law enforcement body such as the police?

5. How does this affect more sophisticated CCTV systems?

Many CCTV schemes, such as those that are used in town centres or by large retailers, are more sophisticated. They are used to focus on the activities of particular people either by directing cameras at an individual's activities, looking out for particular individuals or examining recorded CCTV images to find things out about the people, such as identifying a criminal or a witness or assessing how an employee is performing. These activities are covered by the DPA but some of the images they record will no longer be covered. So if only a general scene is recorded without any incident occurring and with no focus on any particular individual's activities, these images are not covered by the DPA.

In short, organisations using CCTV for anything other than the most basic of surveillance will have to comply with the DPA although not all their images will be covered in all circumstances. What you need to decide is whether the image you have taken is aimed at learning about a particular person's activities.


6. What should I do next?

If some of your CCTV activities are still covered you still need to comply with the DPA by making sure you have notified the Commissioner, having signs, deciding how long you retain images and making sure your equipment works properly. The only difference is that you will no longer have to give individuals access to those images that are just general scenes neither focusing on a particular individual nor being used to learn information about individuals.

If you are a user of a basic system and are not covered, you do not have to comply with the DPA though you may find the guidance on compliance in the CCTV Code of Practice helpful as this gives good practice advice to help make sure the images are up to the job of preventing and detecting crime.