CCTV cameras and captured images
The omni-presence of CCTV cameras. A subject I have been writing about for many years, including here and here.
Two new guidances, one by the Irish Data Protection commissionner
and one by the UK ICO.
I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.
What private CCTV camera surveillance can cause ?
Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.
Because privacy matters, CCTVs have to obey to strict rules :
You need :
- To inform the public by clear warning,
- Register your cameras with the Information Commissionner,
- Assess the privacy impact of the surveillance recording in a DPIA,
- Secure the data collected,
- Limit access to data collected,
- Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces,
- Ensure that the CCTV images are clear and of a high quality,
- Comply with the comprehensive ICO CCTV check list
The Surveillance Code of Practice has not yet been updated to comply with the GDPR. It states “Principle 7 – Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.”
What is the nature of the pictures recorded by the CCTV cameras?
GDPR require higher protection for ‘special category data’. Recital 51 clarifies when pictures can be considered of ‘special category‘ or as previously called ‘sensitive data‘ : “Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.”
“The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.” IAPP comments
Therefore when a CCTV footage reveal an image identifying an individual with its racial or ethic origin, by the colour of the skin or any external religious sign, these should be considered special category data.
A management company intend to use CCTV images to name and shame fly tippers.
Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.
The UK ICO specifically request that “CCTV operators are not allowed to disclose images of identifiable people to the media – or to put them on the internet – for entertainment. Images released to the media to help identify a person are usually disclosed by the police.”
Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.
Not noticing much improvement with the cameras, the management has now decided to name and shame the perpetrators. When public naming and shaming, they should be ready for this sort of out of control incidents https://www.bbc.co.uk/…/uk-england-coventry…
The issue of securing the data collected
CCTV cameras are easily hackable as shown in this case and therefore a burden to keep safe. Cameras footage can be intercepted to broadcast live online. [Update: The tech flaw that lets hackers control surveillance cameras ; Hacked Hikvision IP Camera Map USA And Europe
Smart cities and smarter hackers. ‘Japan is planning a mass hackathon after passing legislation to prepare their citizens in advance of their 2020 Olympics. The company’s government plans to test the security of 200 Million IoT devices to create awareness of IoT security and its importance in the run up to the big event next year.‘
Do you want to give access to your data footage to any hacker? Read more here.
The issue of over-reliance on technology
Wrong identification cans easily ruine someone’s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian.
Privacy, necessity and the balance of proportionality
Privacy is a fundamental human right resulting from the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. ‘Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right. In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure. A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.‘ The EDPB has published an Assessment and Necessity Toolkit.
Balancing fairness and proportionality
Article 6(1)f lawful ground of processing personal data balancing exercises require it to be ‘necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject’. In other words, the legitimate interests of the controller and those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controller has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.
The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered excessive and out of proportion.
When publicly naming and shaming, this sort of out of control incidents should be expected.
I understand dumping is bad but it doesn’t justify destroying someone’s life and reputation. Internet memory is indelible. In a more legal term, it doesn’t stand the balance of proportionality to publish the footage.
When the same result could be achieved in a less intrusive way
CCTV Code of Conduct suggests other measures such as more lighting for a bette security. In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge.
In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,
As example of issues created by pictures posted online to identify criminals:
Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal
The white van speaker scam explained, and how it moved to Craigslist and Facebook
How an internet hoax about a ‘white van kidnapper’ sparked violence in Paris
Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed that way? The sad reputation of the woman who dumped her cat in a bin.
‘In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company’s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?‘ Read more here.
See how Data Protection Authorities around the EU have enforced the GDPR to protect people’s privacy and security.
Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.
UPDATE 27/06/2023 :
Last night our hard efforts fuelled a bombshell BBC Panorama investigation, unveiling the rampant spread of Chinese surveillance cameras within the UK.
TELL THE HOME SECRETARY TO BAN CHINESE CCTV
Explosive revelations include:
💥 HUGE security risks with CCTV cameras made by human rights-abusing, Chinese state-owned firm, Hikvision.
“I own that device now – I can do whatever I want with that” says hacker
💥 Over 60% of public bodies, from schools to councils, are using either Hikvision, or Dahua cameras.
💥 Security experts fear the cameras have the potential to be used as a Trojan horse to play havoc with computer networks, which in turn could spark civil disruption.
We are urgently calling on the Home Secretary to ban these rights-abusing surveillance companies from the UK. We need to make sure this can’t happen again, so we are also urging the Government to instigate an independent national review of the scale, capabilities, ethics and rights impact of modern CCTV in the UK.
The time for action is NOW – don’t stand by!
DEMAND A WIDE-SCALE REVIEW OF CCTV IN THE UK
Watch our director Silkie Carlo on the BBC Panorama episode by clicking here or on the image below.
This news report is a huge boost for our campaign to #BanHikvision.
Following actions from subscribers like you, we have successfully persuaded Tesco, Morrisons and M&S to stop using these cameras.
Our campaigning pressure and investigatory work has also led the UK Government to issue a ban of these cameras on their own “sensitive sites”.
Surveillance cameras made by Hikvision & Dahua have also been used to facilitate serious human rights abuses in Xinjiang, Tibet and Hong Kong. Some of the CCTV cameras boast features such as “Uyghur alerts” and “ethnicity recognition” widely thought to be used in the Chinese Communist Party’s persecution of minorities.
The evidence is overwhelming, and the threat to our individual privacy couldn’t be any clearer… Yet the government is failing to take proper action.
Are you concerned about Chinese surveillance and the threat of growing capabilities of modern CCTV in the UK?
Now is the time to urge them to take action!
From BIG BROTHER WATCH.
To send a letter to call for #banHikvision invasion of our privacy and security https://bigbrotherwatch.org.uk/campaigns/ban-hikvision/#EMAILMP
FURTHER READING RESOURCES CURATED ON PEARLTREES
- This work is licensed under a Creative Commons Attribution 4.0 International License.