Recording recognisable images or markers of individuals is the processing of personal data and is subject to data protection legislation (GDPR). Recording must occur in a manner that respects the rights of the individual and for a specific justifiable purpose. The collection of personal data which does not conform with the acts, or that is used for a purpose not stated, would be difficult to protect in a court of law.
Given the prevalence of these forms of surveillance, there are established norms and rules around obtaining, retention, processing and access. There is an obligation to be compliant and to fully document and demonstrate compliance, to avoid exposure penalty. An unlawful recording is unusable by law enforcement authorities, is inadmissible in court, and could act against the purpose for which it was intended.
Areas accessible to the public
Systematic Monitoring of publicly assessable areas typically necessitates the completion of a Data Protection Impact Assessment.
The key issues are;
- Ensuring that data is adequate, relevant and not excessive for it’s purpose
- Ensuring that data is obtained and processed fairly
- Subject/processor contracts
- The ability to provide copies of the data to subjects
- Data storage and retention
The Office of the DPC ‘would expect that the data controller would have carried out detailed assessments’ of the risks to the subjects to ensure that the activity is proportionate.
First Compliance can provide advice, risk and impact assessments, and guidance on how best to avoid unlawful processing and hands on support to minimise your exposure.