CCTV cameras and captured images

The omni-presence of CCTV cameras. A subject I have been writing about for many years, including here and here.

Two new guidances, one by the Irish Data Protection commissionner

and one by the UK ICO.

I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.

What private CCTV camera surveillance can cause ?

Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.

Because privacy matters, CCTVs have to obey to strict rules :

You need :

  • To inform the public by clear warning,
  • Register your cameras with the Information Commissionner,
  • Assess the privacy impact of the surveillance recording in a DPIA,
  • Secure the data collected,
  • Limit access to data collected,
  • Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces,
  • Ensure that the CCTV images are clear and of a high quality,
  • Comply with the comprehensive ICO CCTV check list

The Surveillance Code of Practice has not yet been updated to comply with the GDPR. It states “Principle 7 – Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.” 

What is the nature of the pictures recorded by the CCTV cameras?

GDPR require higher protection for ‘special category data’. Recital 51 clarifies when pictures can be considered of ‘special category‘ or as previously called ‘sensitive data‘ : “Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.”

The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.IAPP comments

Therefore when a CCTV footage reveal an image identifying an individual with its racial or ethic origin, by the colour of the skin or any external religious sign, these should be considered special category data.

A management company intend to use CCTV images to name and shame fly tippers.

Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.

The UK ICO specifically request that “CCTV operators are not allowed to disclose images of identifiable people to the media – or to put them on the internet – for entertainment. Images released to the media to help identify a person are usually disclosed by the police.”  

Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.

Not noticing much improvement with the cameras, the management has now decided to name and shame the perpetrators. When public naming and shaming, they should be ready for this sort of out of control incidents https://www.bbc.co.uk/…/uk-england-coventry…

The issue of securing the data collected

CCTV cameras are easily hackable as shown in this case and therefore a burden to keep safe. Cameras footage can be interecepted to broadcast live online.

Smart cities and smarter hackers. ‘Japan is planning a mass hackathon after passing legislation to prepare their citizens in advance of their 2020 Olympics. The company’s government plans to test the security of 200 Million IoT devices to create awareness of IoT security and its importance in the run up to the big event next year.

Do you want to give access to your data footage to any hacker? Read more here.

The issue of over-reliance on technology

Wrong identification cans easily ruine someone’s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian.

Privacy, necessity and the balance of proportionality

Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. ‘Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.  In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.  A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.‘ The EDPB has published an Assessment and Necessity Toolkit.

Balancing fairness and proportionality

Article 6(1)f lawful ground of processing personal data balancing exercises require it to be ‘necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject’. In other words, the legitimate interests of the controller and those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.

The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered excessive and out of proportion.

When publicly naming and shaming, this sort of out of control incidents should be expected.

I understand dumping is bad but it doesn’t justify destroying someone’s life and reputation. Internet memory is indelible. In a more legal term, it doesn’t stand the balance of proportionality to publish the footage.

When the same result could be achieved in a less intrusive way

CCTV Code of Conduct suggests other measures such as more lighting for a bette security. In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge.

In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,

As example of issues created by pictures posted online to identify criminals:

Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal

The white van speaker scam explained, and how it moved to Craigslist and Facebook

How an internet hoax about a ‘white van kidnapper’ sparked violence in Paris

Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed that way? The sad reputation of the woman who dumped her cat in a bin.

In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company’s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?Read more here.

Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.