ICO guidance on video surveillance, including CCTV 2022

Employers may use overt surveillance for safety, public health or security reasons, but employees do not always expect video or audio monitoring in their daily roles, so it should be used rarely. The employer must consult its workforce (staff, trade unions or both), above all as part of the DPIA; give adequate notice to employees of the nature, extent and purposes of the surveillance; make others caught by it, such as visitors and customers, aware of it and why; and respect staff rights, giving staff a direct route to take complaints or concerns to the employer.

People must be told when they are in an area under surveillance, and Article 13 information provided. Signs should be clearly visible and readable, sized for pedestrians or drivers, placed prominently before the entrance to the field of vision and reinforced inside, far enough away that people see them before being captured, and should state the operator (unless obvious), the purpose and at least a website, telephone number or email for queries; signs should be bigger and more numerous in places where monitoring is unexpected. A website notice alone is not enough, but signs can link to it as a layered notice; audio announcements can reinforce them, and staff should know how to handle enquiries.

Processing that is lawful can still be unfair: people should only be recorded in ways they would reasonably expect, judged objectively in the circumstances, and without unjustified adverse effects. Places with heightened privacy expectations, such as private property, public toilets and changing rooms, should be monitored only in the most exceptional circumstances to deal with very serious concerns (cameras in school toilets are unlikely to be proportionate). The organisation should weigh new or unexpected technology, intrusion where behaviour is not modified and the chilling effect on how people behave and move, and reflect this in a DPIA before deployment.

No fixed retention period applies; the purpose sets it, and the period should be the shortest the purpose needs, after which footage should be deleted. It should not be set by storage capacity or the manufacturer's default (six months merely because the system allows it) or kept in case it proves useful; the policy should be documented and understood by operators, deletion should be permanent and secure, and adherence should be checked. Longer retention can be justified for a specific purpose, such as preserving footage at the request of police investigating a crime.

A DPIA is a legal requirement before processing likely to result in high risk, which covers most video surveillance, including large-scale systematic monitoring of publicly accessible places. It must set out what the processing is, its scope, context and purposes, weigh necessity and proportionality and the compliance measures, identify and rate the risks to people, and set out further measures to reduce them; a decision not to do one must be documented and justified. The organisation should consider lawfulness and transparency, whether the system is necessary and proportionate and actually solves the problem on reliable evidence, and less intrusive alternatives; if high residual risk remains it must consult the ICO and not proceed until it has. Failing to do a required DPIA is itself an infringement.