Inappropriate use of CCTV footage by W.W.C. [2007] IEDPC 3 (15 June 2007)
I received a complaint from a data subject alleging breaches of the Data Protection Acts by inappropriate use of CCTV footage at W.W.C. in Dublin. In her complaint she informed my Office that on 4th March, 2006 she visited the W.W.C. as a member to use the steam/sauna rooms and the swimming pool. A customer service issue arose in relation to the cleanliness of the facilities on the day which were the subject of a phone-call by the complainant from the steam/sauna rooms. The data subject wrote a subsequent letter of complaint about the matter to the Club following which she was asked to meet the manager to discuss the matter. Upon doing so she was presented with CCTV footage which it was claimed supported the club's view of the customer service issues arising and refuting the claim that she had made a phone-call on the issue on the morning in question. In this respect, three CDs of CCTV footage were presented each of which in turn were claimed to be the data subject engaging in leisure activities within the gym on the morning in question. They in fact were not the data subject and were other female members of the gym.
Shortly afterwards the data subject's membership of the gym was revoked.
The data subject informed my Office that she found it acceptable to be shown CCTV footage to assure her that the sauna/steam rooms had been cleaned but she found it unbelievable that W.W.C. kept and viewed footage to discredit members' genuine complaints. She felt strongly that the CCTV footage was shown to her to intimidate her and question her good character and was used to say that she was lying.
My Office commenced an investigation and wrote to the Managing Director of W.W.C. expressing our concern at what appeared to be excessive and disproportionate use by W.W.C. of CCTV footage for the purpose of dealing with the data subject's complaint. A response was received from the solicitors for the Club and an exchange of correspondence subsequently took place between my Office and the solicitors. Among other things, my Office was informed that the only purpose for which CCTV was used in the Club was for security. They also confirmed that members and staff of the Club were aware that their images were being recorded as there were several signs displayed in the Club regarding the operation of CCTV. It was also confirmed to my Office that CCTV footage was automatically erased at the end of each month.
However, the Solicitors contested any suggestions that the Data Protection Acts prohibit data that has been bona fide obtained and temporarily stored for one general purpose from being used in specific circumstances for some other useful purpose that is for the general good. They also stated that the purpose of the CCTV system in operation at W.W.C. was, like most CCTV systems, security and that this included the issues of theft and personal safety and integrity. They contended that this was a health and safety issue, coming under the general heading of security, on the grounds that the data subject made a complaint that the sauna was unhygienic because it had not been cleaned. I disagreed with the data controller's position on this matter. I accepted that the purpose of 'security' may include the issues of theft and personal safety in certain circumstances related to security risk. However, the issues of integrity, health and safety are clearly separate purposes to the purpose of 'security.'
Section 2(1)(c)(ii) provides that data shall not be further processed in a manner incompatible with that purpose or those purposes for which it was obtained. It was clear from my Office's correspondences with the data controller's solicitors that W.W.C. processed images which were recorded for 'security' purposes by showing them to the data subject in response to a complaint which she had made concerning the sauna/ steam rooms not being operational on the morning of 4 March, 2006. Her complaint had nothing whatsoever to do with 'security' issues and, therefore, it was entirely inappropriate for the data controller to produce personal data, about other individuals as it transpired, which was obtained for 'security' purposes, to attempt to deal with this matter.
I had no reason to doubt the version of events given to me by the data subject. I concluded that W.W.C. did indeed set out to refute the data subject's complaint through the use of CCTV footage which was recorded for a 'security' purpose.
I was required to make a Decision on this case under Section 10(1)(b)(ii) of the Acts. I formed the opinion that W.W.C. breached Section 2(1)(c)(ii) of the Acts by the further processing of CCTV footage which was obtained for security purposes in a manner incompatible with that purpose. I found it disturbing that the data subject's membership of W.W.C. was invalidated following a breach of the Data Protection Acts by W.W.C.. It is unacceptable that an entity against whom a complaint is made would contravene the Data Protection Acts in dealing with the complaint and thereby infringe on the data protection rights of the complainant or others.
CCTV recordings have become an everyday part of our lives. Their usage, and seeming acceptance, for so many different purposes is troubling. In this case, the use of CCTV in the private areas of a sauna/steam room in a gym is questionable in itself from a data protection perspective. To then use the footage captured (notionally for security purposes) in an attempt to discredit a gym member making a customer service complaint is totally unacceptable. In the circumstances I had no hesitation in finding in favour of the complainant.