2. CCTV cameras and audio recording of workers 


The ICO Employment Practices Code states that where employers carry out video and audio monitoring of workers it should, where possible, be targeted at areas of particular risk and confined to areas where expectations of privacy are low. It states that continuous video or audio monitoring of particular individuals is “only likely to be justified in rare circumstances.”


The Code stipulates that workers should be informed of the extent and nature of any monitoring, unless covert monitoring is justified. Visitors or customers who may inadvertently be caught by monitoring should also be given a “clear notification.” 


The Code also states that covert audio or video monitoring should not be used in areas where workers “would genuinely and reasonably expect to be private.”


In 2015, the ICO issued a revised Code of Practice, In the picture, a data protection Code of Practice for surveillance cameras and personal information. As well as surveillance cameras, it covers Automatic Number Plate Recognition, body-worn cameras, “unmanned” aerial systems (drones) and any other system that captures information relating to identifiable individuals, such as iris or face recognition technology. This applies to employers in both the public and private sectors across the UK.


With regard to the installation of CCTV, the revised Code states that the employer should always conduct a Privacy Impact Assessment (PIA) (see page 83) to decide whether this is a proportionate response to a particular problem, examine whether other less intrusive solutions might work, and consult those who will be under surveillance, addressing any specific concerns raised. 


Important issues to cover include:


• identifying the purpose of the CCTV and addressing whether it is likely to resolve the problem; 


• asking whether another less intrusive solution might work equally well;


• finding out the views of those who will be under surveillance; and


• examining how to minimise intrusion for those who will be monitored, in particular, addressing any specific concerns raised during the consultation.


Employers using CCTV capable of capturing personal data must comply with the core data protection principles (see page 60). In particular, the Code says employers should:


• consider privacy-by-design when choosing the system at the outset;


• establish clear rules about who is to have responsibility for control of information and deciding what is to be recorded, how information is to be stored and used, who gets to see it, how it is to be encrypted, how long it is retained, and so on; 


• audit the system regularly to make sure the Data Protection Act 1998 is being complied with, including at least an annual review;


• where images are recorded and retained, have a procedure in place for dealing with Data Subject Access Requests (see page 72);


• not keep recordings longer than necessary to meet the purpose of the monitoring, and put measures in place to ensure permanent deletion at the end of the period;


• have technological and other processes in place to prevent personal data falling into the wrong hands;


• site the system carefully to avoid capturing irrelevant or private images.


The Code describes the use of audio recording, especially when continuous, as “more privacy intrusive than purely visual recording” in most situations. As a result it requires “much greater justification” based on the identification of a pressing social need that must be addressed. This also involves the following:


• considering other less intrusive methods and conducting a thorough privacy impact assessment;


• ensuring that all appropriate privacy-by-design features have been incorporated into the system;


• the recording must provide a high enough quality recording to achieve the stated aim; and


• those affected should be clearly warned that audio recording is taking place, over and above any visual recording.


Employers should be reminded that, according to the ICO Code, monitoring is usually intrusive, workers legitimately expect to keep their personal lives private and they are entitled to some privacy in the work environment. 


The Code also contains detailed guidance on managing the privacy implications of automatic number plate recognition and body cameras. Body cameras are particularly intrusive as they are able to pick up audio recordings as well as visual images (see below). 


A Code of Practice on surveillance cameras was also published in 2013 under the Protection of Freedoms Act 2012 (POFA 12). This is separate to that published by the ICO and deals with issues unrelated to data protection (see page 78).