Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face.
What are the UK rights for accessing all the footage captured of me on these cameras? Also, what happens if the owners reject my request, or lie such as 'these CCTV cameras are not working' despite stationing signs in the area indicating they're in use?
You have a right to access per Art 15 GDPR. You can make a request to the data controller (the person managing those cameras) free of charge. In your request, you should mention the approximate time periods during which you might appear, and you should make it possible to identify you in the footage.
The data controller has one month to respond. The response should include the following items:
If the data controller denies your request, they should describe their reasons for doing so. Here, they could at most argue that your request was excessively broad (cf. Art 12(5) GDPR). In principle, they could also argue that your right to access is restricted by an exemption in Schedule 1 Part 2 of the Data Protection Act 2018, however none of those will fit.
The data controller cannot deny your request with the argument that the CCTV surveillance is a “purely personal or household activity” (Art 2(2)(c) GDPR) since the cameras seem to cover a public space. The ICO also writes:
If your CCTV captures images beyond your property boundary, such as your neighbours’ property or public streets and footpaths, then your use of the system is subject to the data protection laws.
If the data controller has no footage (because the cameras are dummies, are switched off, don't make persistent recordings, or footage was deleted prior to your request) then of course you can't get a copy of your data. The other elements of the response should still be provided, in particular an explanation of the purpose of processing and the retention periods.
If you are not satisfied with the data controller's response to your request, you have the following remedies:
It is possible that the CCTV cameras as currently set up are actually unlawful. A basic GDPR principle (Art 5(1)(b)) is that data shall be collected only for “specified, explicit and legitimate purposes”. If there is no pressing purpose for using the camera, it violates the GDPR. In particular, cameras that are directed away from the controller's property and primarily cover a public space are unlikely to serve a legitimate purpose.
Additionally, the GDPR requires all such collection to be transparent. As soon as public spaces are involved, there must be a privacy notice per Art 13 GDPR. The ICO asks controllers to
Let people know you are using CCTV by putting up signs saying that recording is taking place, and why.
A great resource in this context is the Fairhurst v Woodard case from 2021. A neighbour had mounted multiple cameras, all of which were covering public spaces to some degree. The neigbour claimed that some of these cameras were dummies. The court considered the lawfulness of each camera separately. While a Ring doorbell camera that primarily covered the owner's property but would also incidentally record passer-bys was considered legitimate, a camera that was primarily directed at a public space or other homes was not.
If they're not dummies, if any field of view that those CCTV cameras film is outside the private property boundary (like a walkway/road), then they are obliged to comply with the UK-GDPR/UK-DPA :
Once you have installed your CCTV system, you should regularly check that:
- you are complying with the GDPR and the DPA if your CCTV system captures images outside the boundaries of your home
Which means that, if you've ever been recorded outside of the property, under Chapter 3 of the UK-GDPR, you have the right to access (Section 2-Article 15)/erasure (Section 3-Article 17-18)
