30

Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face.

What are the UK rights for accessing all the footage captured of me on these cameras? Also, what happens if the owners reject my request, or lie such as 'these CCTV cameras are not working' despite stationing signs in the area indicating they're in use?

4
  • When you say private property is it a business or a private house?
    – richardb
    Mar 13 at 13:36
  • @richardb I'm specifically referring to a private house. They have a walled fence surrounding the property, it's a very large private house so I can partially understand why they have cameras. However! they have several cameras situated on their wall which is approximately 175cm tall - enough to have the cameras facing right at you and a few inches away from you. They are all facing towards the pedestrian walkway, and do not cover anything in their property - though I presume they have installed others for this. Mar 13 at 14:34
  • 3
    What makes you think you have any right to request this information in the first place? Most places have laws where you can be filmed in public without your consent. For example if you're in the background of somebody's pictures. It doesn't give you a right to a copy of that picture, or any right to request that it's destroyed.
    – Ron Beyer
    Mar 13 at 18:22
  • 1
    Back in 2008, UK Band "The Get Out Clause" produced a video for their song "Paper" that used requested government CCTV footage; this appears to be about half the footage in the video, with the remainder being filmed in more-conventional ways.
    – Roger
    Mar 15 at 4:27

2 Answers 2

33

You have a right to access per Art 15 GDPR. You can make a request to the data controller (the person managing those cameras) free of charge. In your request, you should mention the approximate time periods during which you might appear, and you should make it possible to identify you in the footage.

How the data controller may respond

The data controller has one month to respond. The response should include the following items:

  • the purpose of these cameras
  • the retention period for the footage
  • a reminder that you may have a right to request erasure of your data
  • a reminder that you have a right to lodge a complaint with the ICO
  • a copy of the footage, if any exists

If the data controller denies your request, they should describe their reasons for doing so. Here, they could at most argue that your request was excessively broad (cf. Art 12(5) GDPR). In principle, they could also argue that your right to access is restricted by an exemption in Schedule 1 Part 2 of the Data Protection Act 2018, however none of those will fit.

The data controller cannot deny your request with the argument that the CCTV surveillance is a “purely personal or household activity” (Art 2(2)(c) GDPR) since the cameras seem to cover a public space. The ICO also writes:

If your CCTV captures images beyond your property boundary, such as your neighbours’ property or public streets and footpaths, then your use of the system is subject to the data protection laws.

If the data controller has no footage (because the cameras are dummies, are switched off, don't make persistent recordings, or footage was deleted prior to your request) then of course you can't get a copy of your data. The other elements of the response should still be provided, in particular an explanation of the purpose of processing and the retention periods.

Remedies

If you are not satisfied with the data controller's response to your request, you have the following remedies:

  • you can lodge a complaint with the ICO
  • you can sue the data controller directly

Legality of residential CCTV surveillance also covering public spaces

It is possible that the CCTV cameras as currently set up are actually unlawful. A basic GDPR principle (Art 5(1)(b)) is that data shall be collected only for “specified, explicit and legitimate purposes”. If there is no pressing purpose for using the camera, it violates the GDPR. In particular, cameras that are directed away from the controller's property and primarily cover a public space are unlikely to serve a legitimate purpose.

Additionally, the GDPR requires all such collection to be transparent. As soon as public spaces are involved, there must be a privacy notice per Art 13 GDPR. The ICO asks controllers to

Let people know you are using CCTV by putting up signs saying that recording is taking place, and why.

A great resource in this context is the Fairhurst v Woodard case from 2021. A neighbour had mounted multiple cameras, all of which were covering public spaces to some degree. The neigbour claimed that some of these cameras were dummies. The court considered the lawfulness of each camera separately. While a Ring doorbell camera that primarily covered the owner's property but would also incidentally record passer-bys was considered legitimate, a camera that was primarily directed at a public space or other homes was not.

Further reading

7
  • 4
    With a lot of camera systems, the footage gets overwritten within two weeks. Thus, if they take a 4 week period to respond, the dates and times mentioned in the request will not longer be valid. So it looks like they can always avoid providing footage? Mar 14 at 5:40
  • 3
    @GregoryCurrie The response must be made “without undue delay”. Intentionally waiting for the month to almost pass wouldn't be compliant, but of course that's difficult to prove. In reality, the purpose of such a camera loop feature is that if something happens during the retention period that you can save the relevant parts for permanent storage. For example, if a break-in happens, that footage would be saved. Similarly, the controller should save the footage they need for responding to the DSAR. There's also an argument that an Art 18 Restriction could be requested to prohibit deletion.
    – amon
    Mar 14 at 9:53
  • 8
    Quick technical note of interest: some cameras allow creating regions which are not saved. It's a super handy feature allowing you to point cameras in directions that include both private and public property. The reason one would do this is typically because of limitations in where and how you can mount the camera. Mar 14 at 15:24
  • 2
    And in case others are wondering - the UK is unfortunately not planning to abolish their GDPR-like regulations despite Brexit, as they've put them into a separate law back in 2018. So the degree to which one can monitor the safety of their property is still limited and will be for the foreseeable future. Mar 14 at 20:19
  • 2
    @JonathanReez More precisely, all relevant EU laws including the GDPR were transposed into UK law on Exit Day. The DPA 2018 is a closely related but distinct law. The Tory government had mulled abolishing the restrictions on automated decision making in Art 22 GDPR so that more AI could be used, but eventually shelved the plan. Even as it currently stands, UK data protection law does not prohibit camera surveillance that is adequate and necessary for a legitimate purpose such as safety.
    – amon
    Mar 14 at 21:50
6

If they're not dummies, if any field of view that those CCTV cameras film is outside the private property boundary (like a walkway/road), then they are obliged to comply with the UK-GDPR/UK-DPA :

Once you have installed your CCTV system, you should regularly check that:

  • you are complying with the GDPR and the DPA if your CCTV system captures images outside the boundaries of your home

source

Which means that, if you've ever been recorded outside of the property, under Chapter 3 of the UK-GDPR, you have the right to access (Section 2-Article 15)/erasure (Section 3-Article 17-18)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.