Guidance for CCTV Users

Summary

This guidance from the Guernsey Office of the Data Protection Authority explains how organisations operating CCTV must comply with the Data Protection (Bailiwick of Guernsey) Law, 2017. It works through each of the seven data protection principles as they apply specifically to CCTV use, and ends with a self-assessment checklist controllers can use to review their compliance.

• Who it applies to: Organisations and individuals responsible for operating CCTV (as data controllers); it does not apply to private householders filming for personal or family purposes, or journalists/media outlets using recording equipment for journalistic, literary or artistic purposes, though they may use it as good practice guidance.
• Lawfulness and transparency: Identify a lawful processing condition before installing CCTV, and use clear signage or notices telling people who the controller is, why CCTV is used, and where to get further details.
• Purpose limitation and disclosure: Only use footage for the stated purpose; restrict third-party disclosure (e.g. for crime prevention, limit to law enforcement, courts, legal representatives) and log disclosures made.
• Minimisation: Site cameras and configure recording (including audio) only to the extent needed for the stated purpose; audio recording generally requires a Data Protection Impact Assessment and documented justification.
• Accuracy, storage limitation and security: Keep time/location references accurate, set and document a justified retention period and erase data afterward, and restrict access to images to authorised personnel with logging of viewings.
• Accountability and subject access: Document compliance decisions, handle data subject access requests for CCTV images (including identity verification and limited grounds for refusal), and put a controller/processor contract in place if using an external editing company.

The guidance also reminds organisations that if they process personal data, including via CCTV, they are legally required to maintain an annual registration with the ODPA. No specific compliance deadline or transition period is set out in this guidance itself; it describes ongoing obligations under the existing Law.

Key obligations

• Identify and document a valid lawful processing condition for CCTV use before installation, including for any special category data captured
• Provide clear information to individuals at the point images are captured (identity of controller, purpose of CCTV, where to get further details), typically via prominent signage
• Use personal data captured by CCTV only for the purpose(s) originally communicated to individuals, and document date, recipient, reason and extent of any third-party disclosures
• Limit CCTV camera siting and recording (including avoiding audio recording) to the minimum necessary for the stated purpose; conduct a Data Protection Impact Assessment if audio recording is used
• Keep CCTV time and location references accurate
• Set and document a justified retention period for footage and erase images once that period expires, unless needed for legal proceedings
• Store and restrict access to CCTV images/recordings to authorised personnel, and log details of each time images are viewed or removed
• Put a controller/processor contract in place with any third party (e.g. editing company) that processes CCTV footage on the controller's behalf
• Maintain a current annual registration with the ODPA as a data controller/processor if processing personal data via CCTV
• Establish a procedure to respond to data subject access requests for CCTV images, including identity verification, while noting limited grounds for refusal (e.g. prejudice to crime prevention/detection)

Applies to

CCTV operators/controllers, organisations processing personal data via CCTV