DPC issues guidance on CCTV, Body Worn Cameras and Drones
The Data Protection Commissioner (DPC) has published updated guidance on the use of CCTV, and new guidance on the use of Body Worn Cameras and Drones. While guidance issued by the DPC is not legally binding, it is regarded as best practice, and organisations should take steps to comply with same.
It is noteworthy that the guidance on Drones highlights that their operation is primarily regulated by the Irish Aviation Authority. Use of drones was also extensively examined by the Article 29 Working Party in its Opinion 01/2015.
Proportionality - Recommendations
Section 2(1)(c)(iii) of the Data Protection Acts 1988 & 2003 (the Acts) require that data are "adequate, relevant and not excessive" for the purpose for which they are collected. This means that data collected should be strictly limited to what is necessary to achieve a specific purpose. The guidance notes set out the steps which the DPC expects data controllers to take before using these devices to capture data, including:
- A risk assessment.
- A privacy impact assessment - to identify how the device could impact an individual's right to privacy and data protection and the necessary safeguards to address those risks.
- A specific written data protection policy - for use of the device in question in a limited and defined set of circumstances.
- Documentary evidence of previous incidents giving rise to security/health concerns.
- Clear signage indicating image recording is in operation.
Transparency – Recommendations
Section 2D of the Acts requires certain information to be supplied to a data subject before any personal data are recorded, including the identity of the data controller; the purposes for which the data are processed; and any third parties to whom the data may be supplied.
Covert Surveillance
Use of covert surveillance without an individual's knowledge is flagged as generally being unlawful, unless it is for the purpose of preventing, detecting or investigating an offence or apprehending or prosecuting an offender. In such an instance it must be focused and of short duration.
Audio Recording
The guidance regarding Body Worn Cameras highlights that use of audio recording for security purposes is a "considerable added intrusion into the privacy and data protection rights of individuals", and warns that the DPC "does not accept that the use of audio recording equipment is in any way justifiable or warranted for any purpose, even where members of the public or staff are aware that their voices are being recorded". It recommends that body worn cameras have separate video and audio recording capabilities so that audio recording is not automatically instigated in tandem with video recording.
Use of devices in a domestic setting
The guidance notes highlight the narrow scope of the "household exemption" in article 3(2) of the EU Data Protection Directive 95/46/EC, which provides that the Directive does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity. The Court of Justice of the European Union (CJEU) in the Rynes case (Case C-212/13) (as discussed in a previous blog here) held that the household exemption did not extend to video surveillance by an individual of a public area outside his home. As a result, the guidance notes recommend that anyone intending to use an image capturing device should ensure that it does not inadvertently capture personal data from third persons, as this will mean that the data protections laws will apply.
For further Information please contact Davinia Brennan, dbrennan@algoodbody.com
Date Published: 19/01/2016