You have a right to access per Art 15 GDPR. You can make a request to the data controller (the person managing those cameras) free of charge. In your request, you should mention the approximate time periods during which you might appear, and you should make it possible to identify you in the footage.
How the data controller may respond
The data controller has one month to respond.
The response should include the following items:
- the purpose of these cameras
- the retention period for the footage
- a reminder that you may have a right to request erasure of your data
- a reminder that you have a right to lodge a complaint with the ICO
- a copy of the footage, if any exists
If the data controller denies your request, they should describe their reasons for doing so. Here, they could at most argue that your request was excessively broad (cf. Art 12(5) GDPR). In principle, they could also argue that your right to access is restricted by an exemption in Schedule 1 Part 2 of the Data Protection Act 2018, however none of those will fit.
The data controller cannot deny your request with the argument that the CCTV surveillance is a “purely personal or household activity” (Art 2(2)(c) GDPR) since the cameras seem to cover a public space. The ICO also writes:
If your CCTV captures images beyond your property boundary, such as your neighbours’ property or public streets and footpaths, then your use of the system is subject to the data protection laws.
If the data controller has no footage (because the cameras are dummies, are switched off, don't make persistent recordings, or footage was deleted prior to your request) then of course you can't get a copy of your data. The other elements of the response should still be provided, in particular an explanation of the purpose of processing and the retention periods.
If you are not satisfied with the data controller's response to your request, you have the following remedies:
- you can lodge a complaint with the ICO
- you can sue the data controller directly
Legality of residential CCTV surveillance also covering public spaces
It is possible that the CCTV cameras as currently set up are actually unlawful. A basic GDPR principle (Art 5(1)(b)) is that data shall be collected only for “specified, explicit and legitimate purposes”. If there is no pressing purpose for using the camera, it violates the GDPR. In particular, cameras that are directed away from the controller's property and primarily cover a public space are unlikely to serve a legitimate purpose.
Additionally, the GDPR requires all such collection to be transparent. As soon as public spaces are involved, there must be a privacy notice per Art 13 GDPR. The ICO asks controllers to
Let people know you are using CCTV by putting up signs saying that recording is taking place, and why.
A great resource in this context is the Fairhurst v Woodard case from 2021. A neighbour had mounted multiple cameras, all of which were covering public spaces to some degree. The neigbour claimed that some of these cameras were dummies. The court considered the lawfulness of each camera separately. While a Ring doorbell camera that primarily covered the owner's property but would also incidentally record passer-bys was considered legitimate, a camera that was primarily directed at a public space or other homes was not.