Back
Print
knowledge 8 January 2016 |

New DPC Guidance on CCTV, Wearable Cameras and Drones

The Data Protection Commissioner recently published an updated guidance note on data protection issues in connection with the use of CCTV and new guidance notes on body worn cameras and drones. The updated guidance on CCTV is particularly noteworthy since CCTV systems are so widely used and the changes might require some businesses to update their internal policies to comply with best practice. Each of the notes provides useful practical guidance on the application of data protection principles to these technologies regarding matters such as proportionality, transparency, security, retention, disclosure to third parties and complying with access requests.

Key points arising from these guidance notes include the following:

  • The guidance notes set out recommended steps for a data controller to take and document before using CCTV, body worn cameras or drones, which include a risk assessment, a privacy impact assessment and a specific data protection policy. These imply, and in the case of CCTV specifically state, that the Office of the Data Protection Commissioner expects such steps to be carried out and documented, with the inference that a failure to do so will be viewed in an unfavourable light in the event of an investigation or audit.
  • Each of the notes specifically refers to the ruling on the ‘household exemption’ by the Court of Justice of the European Union in the Ryneš case (Case C-212/13). In this case it was held that Article 3(2) of the Data Protection Directive, which provides that the Directive does not apply to the processing of personal data “by a natural person in the course of a purely personal or household activity”, is to be construed narrowly. In particular, the Court stated that “to the extent that video surveillance [by an individual for security purposes at their own home] covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity” for these purposes. The consequences of this ruling for the application of section 1(4)(c) of the Data Protection Acts 1988 and 2003 (which provides for the ‘household exemption’) to the use by individuals of CCTV, body worn cameras and drones are explained in the guidance notes.
  • It is emphasised that covert surveillance is generally unlawful, except in very limited circumstances. In the case of body worn cameras and drones, in particular, (since these devices may be inconspicuous) it is expected that appropriate steps will be taken to make individuals aware that personal data relating to them may be recorded by such equipment.
  • The guidance note regarding drones emphasises that their use is primarily governed by the Irish Aviation Authority and that it addresses data protection issues only. It specifically cross-refers to Opinion 01/2015 of the Article 29 Working Party on Privacy and Data Protection Issues relating to the Utilisation of Drones.

This document has been prepared by McCann FitzGerald LLP for general guidance only and should not be regarded as a substitute for professional advice. Such advice should always be taken before acting on any of the matters discussed.