Checklist Home Surveillance and CCTV

Summary

This is a self-assessment checklist published by the Jersey Office of the Information Commissioner (JOIC) to help homeowners decide whether a home CCTV or doorbell camera system triggers obligations under the Data Protection (Jersey) Law 2018 (DPJL 2018), and if so, how to use it responsibly. It is guidance rather than binding law, but it explains when a homeowner becomes a data controller and what that entails.

• Scope trigger: If a camera only captures images/audio within your own property boundary, DPJL 2018 does not apply; if it captures neighbours' property, communal or public areas, you become a data controller and must comply with the law.
• Necessity and proportionality: Consider why CCTV is needed, whether less intrusive alternatives exist, and whether continuous recording or audio capture is actually necessary.
• Impact on others: Consider speaking to neighbours or others affected, explaining coverage areas and use of footage, since CCTV is considered highly privacy intrusive.
• Camera placement: Ensure coverage is limited to your own property and does not capture neighbours' property or communal/public areas.
• Responsible use: Limit retention of footage, delete unnecessary footage promptly, secure footage against hacking or loss, and restrict access to those who need it.
• Sharing footage: Keep records of any requests for footage (e.g. from police or insurers) and only share the specific footage requested, editing out irrelevant material.
• Individual rights: Where footage captures people outside your property, be able to respond to rights under DPJL 2018 including the right to be informed, right of access, rectification and erasure, including displaying a notice about CCTV use.

The checklist does not impose fixed deadlines but sets out ongoing practical steps a homeowner acting as a data controller should take before and during use of a home CCTV system.

Key obligations

• If CCTV captures images or audio beyond your own property boundary, you must comply with the DPJL 2018 as a data controller.
• Retain footage only for as long as necessary and delete unnecessary footage at the earliest opportunity.
• Implement physical and access security measures to prevent hacking or loss of footage, and restrict access to those who need it.
• Keep records of any requests to share footage (e.g. with police or insurers) and only share the specific footage requested.
• Provide a notice informing people that CCTV is in operation and who to contact with concerns.
• Be able to respond to individuals' rights under DPJL 2018, including the right to be informed, right of access, rectification and erasure, for anyone captured outside your property boundary.

Applies to

homeowners using CCTV or doorbell cameras, data controllers under DPJL 2018