BLOG: Ensuring your CCTV and Doorbells meet data protection laws

By Jo Lui, Data Protection Manager (Statutory Data Protection Officer)

Do you currently have a CCTV camera or video doorbell installed at your home? Did you know that if your CCTV camera or video doorbell overlooks shared areas, public pathways, neighbours’ homes and/or gardens or a street, you could be subject to data protection laws?

We understand that keeping our homes safe and secure is important. Installing CCTV may be one way of helping us achieve this. CCTV is any device that captures images with or without sound, including your new ring doorbell or a similar device. With more and more request coming through to install CCTV doorbells, and as the Data Protection Manager at Network Homes, I can share with you some advice on what the law expects from you and what you can consider when keeping your home safe.

If you wish to install a CCTV device, please ensure it meets the following criteria:

• It is only used for domestic purposes.
• It only overlooks your home or garden and not surrounding areas like communal areas, neighbours’ homes/garden or public pathways.
• Sound recording is turned off.

If you don’t meet the above criterion but still feel you need a CCTV device, including a doorbell with image capturing functions, then you will need to comply with the obligations placed under ‘Controllers’ in the Data Protection Act 2018. Alternatively, there are other options for you to consider, such as installing security lighting, a burglar alarm or setting up a Neighbourhood Watch Scheme which you can arrange through your safer neighbourhood team.

What does it mean to be a Controller?

As a Controller you are responsible for the personal data you capture and use. You need to ensure:

1. You have appropriate, clearly displayed signage to identify why you’re using the CCTV, including your name and contact details for individuals to get more information.
2. You only use the footage captured for the purposes expressed on your signage and nothing more.
3. You have considered what you need to fulfil this purpose including thinking about:
   
   
   • does it need to record all the time or can motion sensor device do the same job?
   • does it need to record footage or will a live stream work just as well?
   • does it need to record sound, or can you switch that off?

4. It is fit for purpose - There is no point installing a camera which produces bad quality images that are not able to identify anyone. You might remember Crimewatch used to show those blurred man hunt images- how many actual criminals do you think were apprehended from those images alone?

5. You only keep the footage for as long as needed, most devices have a deletion schedule.

6. Your device has appropriate security controls. Everyone in the household is aware of the security controls and understand where this footage is stored. For example, if it is in the Cloud, they know what that means and where the cloud is hosted.

As well as the above principles, you will need to accommodate data protection rights of individuals. This means that anyone you record can request:

• Details about your CCTV processing, including whom you share the information with and how long you keep it for.
• A copy of the footage unless exemptions apply (which you should learn about too).
• For you to delete the footage of them.
• For you to restrict what you are capturing, i.e., you can capture their front lawn but not their garden, or not capture sound.
• For you to stop filming them.

You must comply with all these rights within one calendar month from the date of the request. You must also verify the requestor’s identity. If you are not able to comply with the request, you need to respond within the same calendar month to confirm why not, and the action they can take (I.e., reporting to regulator or raising court proceedings).

Cyber-attacks have become a huge issue in the modern world. To protect you and your family it’s important we work together to understand how this works. My personal advice is to:

• consider purchasing a reliable brand (seek the shop’s tech staff for their support)
• change any default settings on you Wi-Fi network
• enable two factor authentications on the devices account. This means getting a code sent to your mobile or tablet to access your account.

Let’s work together to keep your home safe

We want to work together to make your homes safe and secure. To do this, we ask that all residents who wish to install any device to their property, to make a request to us by phone or email. 

It is important we work together to ensure our homes and local communities are safe. In line with our Anti-social behaviour policy, we may need to ask you to take down the device if it compromises the safety of others.

I hope this advice has been helpful and remember, this not only applies to CCTV and video doorbells, but it also applies to devices that you may have not considered, such as drones and dashcams. For more information about your obligations please see the ICO guidelines for Domestic CCTV systems - guidance for people using CCTV | ICO and the Surveillance Commissioner guide for Surveillance Camera Code of Practice (publishing.service.gov.uk).