We received a complaint in October 2009 from a solicitor, acting on behalf of a data subject, against a commercial premises located in Co. Cork. The complaint concerned the alleged gross misuse of CCTV footage at the premises. The solicitors informed us that the commercial premises had no signage in place to inform the public of the presence of CCTV and of its purpose. The complaint also alleged that on 1 October 2009 the data subject visited the premises and purchased some items. The staff member on duty was known to the data subject who spent some time speaking with him. The member of staff received a letter from the company that runs the premises dated 5 October 2009. The letter concerned a number of work performance issues relating to 1 October, including the fact that the staff member had spent time chatting with the data subject. The letter stated that the manager of the premises had examined footage from the security cameras at the premises. The employee concerned gave a copy of the letter to the data subject. That letter was passed on to my Office with the complaint.
Recognisable images captured by CCTV systems are personal data. Therefore they are subject to the provisions of the Data Protection Acts 1988 & 2003. To satisfy the fair obtaining principle of the Data Protection Acts with regard to the use of CCTV cameras, those people whose images are captured on camera must be informed about the identity of the data controller and the purpose(s) of processing the data. This can be achieved by placing easily-read signs in prominent positions. A data controller needs to be able to justify obtaining and using personal data by means of a CCTV system.
The subject of our investigation of this complaint was the capture and subsequent processing of the data subject's image on CCTV without his knowledge or consent. In its initial response to our investigation, the company informed us that it uses CCTV cameras in its commercial premises for security purposes. It also confirmed that CCTV was operating in this particular store without being properly notified to those visiting the store. It informed us that it was undertaking a review of the signage used in all of its stores throughout the country. It also apologised for any distress or inconvenience caused to the data subject by capturing his image on CCTV without having informed him by means of appropriate notices in the store.
The first breach of the Data Protection Acts occurred when the data subject's image was captured on a CCTV camera located in a commercial premises that did not have appropriate signage in place. The second breach occurred when the company processed the data subject's image for a non-security matter (i.e. to address a work performance issue). We pointed out to the company that, regardless of whether there was signage in the shop to inform members of the public that CCTV cameras were in operation and their purpose, the processing of the data subject's image for a non-security matter was a breach of the Acts.
The Acts provide that, in the first instance, we must try to arrange an amicable resolution to a matter that is the subject of a complaint. The company agreed to seek an amicable resolution of the complaint. To that end it proposed to offer the data subject a letter of apology and a monetary goodwill gesture. The solicitor for the data subject subsequently confirmed his client's acceptance of the amicable resolution proposed. The company's letter of apology included confirmation to the data subject that his personal data had been erased and that the store in question now had a clearly displayed notice that CCTV was in operation.
Substantial guidance is available on our website in relation to the use of CCTV in a business or workplace. We encourage all data controllers, particularly those who may already have such recording systems in place, to familiarise themselves with this guidance.