Code of practice for surveillance cameras comes into force

About the code

The code of practice sets out guidelines for CCTV and Automatic Number Plate Recognition (ANPR) systems with the aim of promoting an ethos of surveillance by informed consent and ensuring that any use of such systems is:

  • in pursuit of a legitimate aim
  • necessary to meet a pressing need
  • proportionate
  • effective and
  • compliant with any legal obligations.

The code was originally published in June 2013 and was brought into force on 12 August 2013.

To whom does it apply?

Relevant authorities (as defined by section 33 of the Protection of Freedoms Act 2012) – this includes (among other public bodies) local authorities, the Greater London Authority and any chief officer of a police force in England and Wales.

The code acknowledges that many surveillance systems in operation within public places are operated by the private sector, the third sector or other public authorities not currently covered by the code.

Guiding principles

The code includes the following guiding principles to be seen as best practice standards that system operators should adopt:

  1. The use of a surveillance camera system must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need.
  2. The use of a surveillance camera system must take into account its effect on individuals and their privacy, with regular reviews to ensure its use remains justified.
  3. There must be as much transparency in the use of a surveillance camera system as possible, including a published contact point for access to information and complaints.
  4. There must be clear responsibility and accountability for all surveillance camera system activities including images and information collected, held and used.
  5. Clear rules, policies and procedures must be in place before a surveillance camera system is used, and these must be communicated to all who need to comply with them.
  6. No more images and information should be stored than that which is strictly required for the stated purpose of a surveillance camera system, and such images and information should be deleted once their purposes have been discharged.
  7. Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.
  8. Surveillance camera system operators should consider any approved operational, technical and competency standards relevant to a system and its purpose and work to meet and maintain those standards.
  9. Surveillance camera system images and information should be subject to appropriate security measures to safeguard against unauthorised access and use.

Principles 1-4 address the development or use of surveillance camera systems, while principles 5-12 cover the use or processing of images and information.

Effect of the code

Relevant authorities must follow a duty to have regard to the guidance within it when deploying a surveillance camera system.

The code is overseen by the Surveillance Camera Commissioner, Andrew Rennison, who was appointed to the newly created position last year. Although the code has been approved by parliament the Surveillance Camera Commissioner has no powers to enforce its provisions and so must simply encourage compliance and report back to parliament with any concerns.

This lack of enforcement powers, together with limited definition of relevant authorities has led some campaign groups to criticise the code, suggesting that it does not go far enough to meet its aim of ensuring surveillance by consent.

Data protection obligations

Operators of surveillance camera systems should be aware that the new surveillance camera code does not affect the applicability of the Data Protection Act 1998, which covers the processing of personal data by a data controller. Images of individuals or car registration numbers taken by surveillance cameras that could be used to identify an individual either alone or in conjunction with other information in the data controller’s possession, are covered by the data protection regime.

These data protection obligations are enforced by the Information Commissioner, who has published a separate CCTV code of practice aimed at assisting operators of surveillance camera systems meet their obligations under the data protection regime.

What’s next?

The new code has been seen by some as a first step towards transparent, open and effective use of surveillance cameras, while others have criticised the lack of enforcement powers. Now that the code has been implemented the Surveillance Camera Commissioner will monitor action by public authorities to meet its requirements.

The code is set to be reviewed in 2015.

Anthony Taylor is a solicitor in the Lexis PSL®IP & IT team

Relevant Articles
Area of Interest