CCTV Brings Data Protection Fines

CCTV Brings Data Protection Fines

Fine of £120,000 issued to company for careless use of CCTV.

A company has been fined £120,000 by the Information Commissioner for filming people, even though it deleted the footage without using it, and left notices on display that filming was taking place.

The company set up CCTV cameras and microphones in the waiting room and examination rooms at a clinic in order to make a documentary on stillbirths. Although the company had the Hospital Trust’s permission to film on site, it did not provide patients with adequate information about the filming or get proper permission in advance from those affected.

The company had posted notices advising patients of the filming near the cameras and in the waiting room and left letters on some of the waiting room tables, although these did not provide adequate information and were, in some cases, incorrect – one stated that patients and visitors would not be filmed without consent, which was not the case. The ICO found that patients would not have expected cameras to be placed in examination rooms and that all patients would expect to have been clearly told about the filming.

Recording stopped in November 2017 following negative press coverage but then resumed after a short while until the spring of 2018, but using different filming techniques and the new film was subsequently used in a documentary. The unlawfully obtained footage was never used and was deleted.

The case is a timely reminder of the need for all those who use CCTV cameras on or around private premises to ensure that they comply with GDPR. More so, given that this £120,000 penalty notice was issued under the ‘old’ Data Protection Act 1998 (as the incidents occurred prior to the Data Protection Act 2018 taking effect). Had this occurred after the new Act had come into effect, the fine could have been considerably higher.

The use of cameras to monitor a private house and garden is permitted but care needs to be taken with cameras monitoring front doors, garden gates, driveways and gardens that they do not record neighbours’ activities or passers-by the property on public roads or footpaths unless there is a valid legal reason and a Data Protection notice is clearly displayed.