Data Protection Commissioner
Data Protection Commissioner

  

Guidance on the use of Body Worn Cameras

 
This guidance below should be read in conjunction with the guidance on CCTV systems
The Data Protection Acts set out responsibilities for organisations or persons (data controllers) that hold and control the uses of information and provide rights to individuals in relation to how their information is processed.
 
There are a number of data protection considerations to be met in relation to the use of surveillance systems as generally they clearly involve the processing of personal data and must comply with the transparency requirements of data protection law.
 
In general, there is no great difficulty from a data protection perspective with the use of CCTV cameras for security purposes. The use of surveillance equipment (limited to image recording) must comply with the transparency requirements of data protection law. We would expect that individuals are made aware of the existence of the surveillance and are clearly informed of all the purposes for which the personal data will be used, e.g. security purposes; the persons that will have access to this information and for how long this information will be retained. However the use of body worn devices or other image recording devices, which by their very nature are mobile, present difficulties from a data protection and privacy perspective as they can lead to inadvertent recordings.
 
Complaints in relation to recordings can, in such circumstances, be legitimately brought to the attention of this Office for investigation. Our general guidance in this area is that we would consider that the mobile CCTV devices should only be activated in extreme cases in response to specific pre-defined criteria, where it could be justified for security and safety purposes. This does not allow for automatic recording of images but only in response to specified circumstances.
 
The recording of sound or voices (audio recording) by equipment used for security purposes is a considerable added intrusion into the privacy and data protection rights of individuals. For the sake of clarity, the Office of the Data Protection Commissioner does not accept that the use of such audio recording equipment is in any way justifiable or warranted for any purpose, even where members of the public or staff are aware that their voices are being recorded.
 
In terms of system specifications, body worn cameras should at the very least have separate video and audio recording capabilities so that if a situation arises which requires the video recording of an incident, the audio recording is not automatically instigated in tandem.
 
Proportionality - What data can be captured?
Section 2(1)(c)(iii) of the Acts require that data are "adequate, relevant and not excessive" for the purpose for which they are collected. This means that the data from such processing should be limited to what is strictly necessary to achieve a specific purpose (s). Under this principle, this Office would expect that a data controller would have carried out detailed assessments as to how the use of such equipment meets with these requirements and would have the following steps carried out and documented:
 
·         A Risk Assessment
·         A Privacy Impact Assessment
·         A  Specific Data Protection policy drawn up for use of the devices in a limited and defined set of circumstances only (this policy should include documented data retention and disposal policy for the footage)
·         Documentary evidence of previous incidents giving rise to security/health and safety concerns
·         Clear signage indicating mobile image recording is in operation
 
This Office considers that a substantive Risk Assessment as to how the use of Body Worn Cameras could mitigate any identified security concerns is required. This Risk Assessment should be balanced against a Privacy Impact Assessment with regard to how the use of Body Worn Cameras could impact on an employee’s or a member of the public’s fundamental right to privacy and data protection.
 
The Office of the Data Protection Commissioner retains serious concerns about the proportionality and justification of using body worn cameras especially when consideration is given to the fact that, generally, law enforcement agencies do not deploy such equipment.
 
Transparency – Notifying the public
In the case of body worn cameras, individuals may not be aware that they are being recorded or that a person is equipped with recording equipment. It is necessary to do as much as possible to make members of the public aware  that recording is taking place.
If necessary, the information should be made clear to the general public by means of by means of;
1.      Conspicuous signage in the area in which the body worn camera are in  operation
2.      The person operating the body worn camera should be identifiable visually.
3.       This person should, where possible/practicable, announce to the subject(s) of an encounter that video and audio recording is taking place using a body worn camera.
Recording should only commence at the start of an incident and should terminate once the incident is concluded. Under no circumstances should recordings  be used to monitor staff in their general duties.
Data controllers and data processors:
Where processing is not carried out directly by the controller, (external security companies) this processing should be governed by a contract or legal act that requires the processor to act only on instructions from the controller.
Storage and retention:
Access Requests:
Recommended Steps:
There are several practical steps you can take to ensure that you comply with the data protection regulations when using body worn camera systems;
·         Ensure that the camera systems are equipped only with the material necessary to achieve the purposes for which they are intended i.e. the equipment should not have microphones or this functionality should be disabled. In any case, the system should have separate video and audio recording capabilities
 
·         Have robust access controls in place ensuring only authorised persons have access to the images.
 
·         Explore the possibility of built in mechanisms that automatically blur faces when they are inadvertently filmed during  data collection.
 
·         Use a software programme that automatically deletes the data collected once the task is completed.
 
·         Ensure that a Privacy Impact Assessment (PIA) is completed prior to the use of same.
 
·         If the operation of  the BWCs is to be outsourced to a third party security company, ensure appropriate contracts are in place.
 
·         Put a written Body Worn Camera Usage Policy in place, which includes reference to the collection, processing, retention and security of personal data being processed.
 
·         Comprehensive training would need to be provided to  camera operators in relation to how such a system would operate.
 
·         Ensure  camera operators comply with the proportionality and transparency rules outlined above.
 
ENDS – Dec 2015