Question 1

Drug Dealing and CCTV

Accepted Answer

Q: Do the Data Protection Regulations bar us from using CCTV? The premises have at times been used by people trading drugs which is causing leaseholders a considerable amount of concern. These "traders" are using an area near where our refuse bins are situated. The incidences have been reported to the police and we have had advice on what to do when reporting these incidents. One issue suggested is to install CCTV, not from the police, but from a leaseholder who has a contact for the police. Our managing agent has informed us that the use of CCTV for these incidents would contravene the Data Protection Regulations, as it would infringe the liberty of individual(s) without gaining their consent in the first place. I am aware that under the current Data Protection Regulations we need to be mindful of any information we obtain relating to leaseholders and cannot mention or release any personal information without the consent of the individual(s) concerned. However, I am unclear on how the use of CCTV would breach the Data Protection Regulations. Can you provide the directors with advice on this issue from a legal perspective, particularly the limits, if any, on the use of CCTV? FPRA Hon Consultant Mark Chick replies: To provide a complete overview of data protection compliance is beyond the scope of this reply. All resident associations should be mindful of compliance not just with CCTV but all data they hold. GDPR applies across the entirety of the EU but each individual country has the ability to make its own small changes. In the UK, the government has enacted the Data Protection Act 2018 (the DPA). This law is applicable regardless of Brexit. Data protection encompasses more than simply personal details, such as email addresses and names; it applies to any information that can identify someone and this includes CCTV. This does not mean that CCTV cannot be used entirely, rather the legislation introduces controls on how footage/data is gathered and stored. An organisation (which is known as a “Data Controller” and “Data Processor”) must comply with the provisions of the DPA. This introduces onerous obligations that a Residents Association may not be able to cope with. Perhaps this is the reason the managing agents have advised not to use CCTV. Possibly they want to ensure that the residents’ association does not unwittingly breach data protection rules. Maybe enquire whether the manging agents can recommend a security company who can provide DPA compliant CCTV for the property? While this is not an exhaustive list of requirements to ensure compliance, the following examples illustrate the complications the residents association may encounter if the use CCTV:

Is there adequate signage in the area being recorded informing people that they are on CCTV, why there is CCTV in operation, their rights and how they can request access to this information?
Where are the captured images stored, is this secure and who has access?
How often is the footage deleted?
Has a Data Impact Assessment been prepared?
Is there an appointed and qualified Data Protection Officer?
How would they deal with a request for images (a subject access request) from those people you are trying to deter?

[Submitted February 2020]

Question 2

Drug Dealing and CCTV

Accepted Answer

Q: Do the Data Protection Regulations bar us from using CCTV? The premises have at times been used by people trading drugs which is causing leaseholders a considerable amount of concern. These "traders" are using an area near where our refuse bins are situated. The incidences have been reported to the police and we have had advice on what to do when reporting these incidents. One issue suggested is to install CCTV, not from the police, but from a leaseholder who has a contact for the police. Our managing agent has informed us that the use of CCTV for these incidents would contravene the Data Protection Regulations, as it would infringe the liberty of individual(s) without gaining their consent in the first place. I am aware that under the current Data Protection Regulations we need to be mindful of any information we obtain relating to leaseholders and cannot mention or release any personal information without the consent of the individual(s) concerned. However, I am unclear on how the use of CCTV would breach the Data Protection Regulations. Can you provide the directors with advice on this issue from a legal perspective, particularly the limits, if any, on the use of CCTV? FPRA Hon Consultant Mark Chick replies: To provide a complete overview of data protection compliance is beyond the scope of this reply. All resident associations should be mindful of compliance not just with CCTV but all data they hold. GDPR applies across the entirety of the EU but each individual country has the ability to make its own small changes. In the UK, the government has enacted the Data Protection Act 2018 (the DPA). This law is applicable regardless of Brexit. Data protection encompasses more than simply personal details, such as email addresses and names; it applies to any information that can identify someone and this includes CCTV. This does not mean that CCTV cannot be used entirely, rather the legislation introduces controls on how footage/data is gathered and stored. An organisation (which is known as a “Data Controller” and “Data Processor”) must comply with the provisions of the DPA. This introduces onerous obligations that a Residents Association may not be able to cope with. Perhaps this is the reason the managing agents have advised not to use CCTV. Possibly they want to ensure that the residents’ association does not unwittingly breach data protection rules. Maybe enquire whether the manging agents can recommend a security company who can provide DPA compliant CCTV for the property? While this is not an exhaustive list of requirements to ensure compliance, the following examples illustrate the complications the residents association may encounter if the use CCTV:

Is there adequate signage in the area being recorded informing people that they are on CCTV, why there is CCTV in operation, their rights and how they can request access to this information?
Where are the captured images stored, is this secure and who has access?
How often is the footage deleted?
Has a Data Impact Assessment been prepared?
Is there an appointed and qualified Data Protection Officer?
How would they deal with a request for images (a subject access request) from those people you are trying to deter?

[Submitted February 2020]

Drug Dealing and CCTV

Search

Articles Archive