CCTV surveillance of people outside your home and garden
When using CCTV at home consider whether your 'surveillance systems' (such as cameras and doorbells) capture images beyond your property boundary.
If you set up your system to capture images only within the boundary of your home and garden, CCTV data protection laws will not apply to you.
CCTV beyond your property boundary
If your CCTV captures images beyond your property boundary (neighbours’ homes or gardens, shared spaces, or public footpaths and streets) you're a CCTV 'data controller', therefore you must:
- comply with CCTV data protection laws and your legal obligations to avoid breaking the law
- have a clear and justifiable reason for capturing images beyond your own home and garden
- be able to deonstrate you're complying with data protection laws
- uphold the rights of the people whose images you capture
CCTV data controller
If your use of CCTV at home means you're a 'data controller', you need to maintain records. You must be able to explain your reasons for capturing images beyond your boundary, if asked by an individual or the Information Commissioner’s Office (ICO), and may need to make you records available to the ICO, upon request.
Be prepared. When you first install your CCTV write down:
- how you're capturing images
- your reasons for capturing images beyond your boundary
- why you think capturing images is more important than invading the privacy of your neighbours and by-passers
- what you do with the images (monitoring, storage, deletion)
- how long you'll keep the images
You must also:
- let people know you're using CCTV by putting up signs saying that recording is taking place, and why
- ensure you don’t capture more footage than you need to achieve your purpose in using the system
- ensure the security of the footage you capture (keep footage securely, make sure nobody can watch it without good reason)
- only keep the footage for as long as you need it; delete footage regularly, and when it's no longer needed
- ensure the CCTV system is only operated in ways you intend, and can’t be misused for other reasons
- ensure anyone you share your property with, who uses the equipment, knows the importance of not misusing it
CCTV data protection rights
As a CCTV 'data controller' you must respect the data protection rights of the people whose images you capture.
You must:
- respond to Subject Access Requests (SARs) - if an individual asks (verbally or in writing) to access the personal data you hold about them (such as identifiable images), you must respond within 1 month and give them a copy of the data
- delete footage of people if they ask you to do so - you should do this within 1 month; you can refuse to delete it if you specifically need to keep it for a genuine legal dispute – in which case you need to tell them this and tell them they can challenge this in court or complain to the ICO.
- consider objections about your CCTV capturing someone's image in the future - this may be very difficult to do, so think about whether you need to capture images beyond your property boundary at all; it may be better to avoid potentially objectionable circumstances