Use of CCTV images

[ostell]

Perhaps someone could give an opinion on this please.

I am in charge of the CCTV system at my sailing club. I was warned by the boat yard next door that there was a known thief about and lo and behold I found him on our CCTV taking a look around the club, probably looking for suitable items, even shoulder charging a door to see if he could get into an outbuilding.

The CCTV system is registered and for the use of crime prevention (it's my name with the ICO) and I have suggested to the officers of the club that I put up a notice within the club with the image of the trespasser, together with the VRM of his car, and asking members to challenge him as a non member and ask him to leave the site.

The images were taken within the bounds of the club property and the notice would be displayed internally to the club and not visible externally.

I have now got the "We will discuss it in committee", "it's not allowed", "It's against DP". My take is that the the images were taken within club goprunds AND the CCTV is for crime prevention then it is valid to post the notice within the club.

Anybody got any comments about it, one way or the other?

No doubt everybody will be complaining when items of value are stolen again. The last incident was when £1,000s of pounds worth of outboards were stolen about 2 years ago

[ploddertom]

Forward it to your local Police. You do have to be careful about publishing pictures of folks, being in the retail trade see a lot of this and the complaints that are made when the pictures appear.

[ostell]

The local police already know about him and have asked the boat yard next door to get in touch. But dialing 101 locally gets no where "We are busy can you call back later"

We are registered for CCTV for crime prevention purposes. Any pictures would be purely within the club, the pictures were taken within the club. I know it's a fraught area but really need others to identify him if he appears again so that he can be asked to leave.

He is known, in fact I found this little item

[2222]

This comment on your linky seems concerning: "The trouble with posting his face and name all over t'internet is that when it goes to court it can get thrown out or turned over as the defence cam say they aren't having a fair trial as it has been influenced by this and he has suffered since."

I'd have thought (but don't know!) that it's reasonable to post a notice saying this gentleman is not a member, without saying anything more about your suspicions.

[ostell]

Thenotice i was going to post on the noticeboard was simply: here's the guy, here's his car details, he's not a member, ask him to leave (if you feel safe in doing so).

Yep insinuating otherwise could be fraught with danger.

Had another email confirming committee must decide what to do, I reckon this lot would call a committee meeting to decide the action if the building caught fire.

P.S. that link was not connected with our club.

[Wylderose]

As the registered Data Controller with the ICO, I assume you have all the requisite signage (CCTV in operation) etc. Whilst the CCTV images are being taken for Security purposes, the introduction of GDPR this year has had an impact on how you use those images. The man who you have captured on CCTV (your data-subject), although attempting to gain unlawful entry, has unfortunately got rights too.

By making the images available, you are processing his personal data as this is what the image amounts to. While it is lawful to pass them to the Police in order to prevent crime, it is not OK to display them on your premises as you open yourself up to Breach of Data Protection

Your trespasser would also have the right to view any images that you hold on him under SAR.

[2222]

As the registered Data Controller with the ICO, I assume you have all the requisite signage (CCTV in operation) etc. Whilst the CCTV images are being taken for Security purposes, the introduction of GDPR this year has had an impact on how you use those images. The man who you have captured on CCTV (your data-subject), although attempting to gain unlawful entry, has unfortunately got rights too.

By making the images available, you are processing his personal data as this is what the image amounts to. While it is lawful to pass them to the Police in order to prevent crime, it is not OK to display them on your premises as you open yourself up to Breach of Data Protection

Your trespasser would also have the right to view any images that you hold on him under SAR.

I have not found it possible to get the ICO to do anything, so the chances of anything bad happening to the club are negligible in practice.

As to SAR, indeed why not send him copies of any videos if he pays his 10 quid?

[ploddertom]

As to SAR, indeed why not send him copies of any videos if he pays his 10 quid?

Ahem it is free and gratis now.

[R0b]

Ostell,

You would be wise to consult with the ICO in the first place and (perhaps by email) get an opinion from them. As already mentioned, CCTV image capturing is processing personal data for the purposes of GDPR and there are very limited reasons as to why you can post someone's picture in plain view. I wonder if one might see you posting up the picture as simply preventing a criminal offence from taking place and if so, you generally have to be some kind of law enforcement agency to do that.

Leaving that issue to one side for the time being, because you would be processing his personal data, I think you would need to carry out a data protection impact assessment (DPIA) before you even considered posting the alleged criminal's face.

I do remember years that the ICO considered posting people's faces who were on pub watch in pub windows were found to be processing their data unlawfully. The ICO also has a specific CCTV Code of Practice and you'll see at page 15 it says the following (CCTV Code of Practice):

5.2.2 Disclosure

Disclosure of information from surveillance systems must be controlled and consistent with the purpose(s) for which the system was established. For example, it can be appropriate to disclose surveillance information to a law enforcement agency when the purpose of the system is to prevent and detect crime, but it would not be appropriate to place them on the internet in most situations. It may also not be appropriate to disclose information about identifiable individuals to the media.

Placing such information on the internet incorrectly, or without full consideration of what is being done, may cause the disclosure of individuals’ personal data and sensitive personal data. In severe cases, this may lead to the ICO taking enforcement action. Information can be released to the media for identification purposes; this should not generally be done by anyone other than a law enforcement agency.

This will help you to demonstrate compliance with Guiding Principle 7 of the POFA code.

NOTE: Even if a system was not established to prevent and detect crime, it would still be acceptable to disclose information to law enforcement agencies if failure to do so would be likely to prejudice the prevention and detection of crime. Any other requests for information should be approached with care as wider disclosure may be unfair to the individuals concerned. In some limited circumstances it may be appropriate to release information to a third party, where their needs outweigh those of the individuals whose information is recorded.

Although the CCTV Code of Practice refers to internet publication, I also think it would apply to disclosure in public generally. If the image of that person is restricted to those who are members of the club, and you've carried out a DPIA prior to doing so, then you might have reasonable cause and justification to show to the ICO that there was a legitimate interest in the disclsoure to members (a notice board with member access only?) which is a restricted group as opposed to being on the front window in full public view.

As long as you've gone through the process of following the correct procedures such as the DPIA, committee discussions etc. then if the ICO deemed it unlawful, you are unlikely to get anything more than a warning from them not to do it again. Probably because it is a first offence but also you can show that you considered the interests of the individual before actually going ahead and doing it. If you blatantly ignored all of the safeguards and guidance then you might end up with something more serious, such as a monetary penalty, though as any breach would be limited to one particularly person, I doubt any monetary penalty would be significant.

So in summary, it's a judgment call by you, but if you do go ahead and do it, make sure to carry out all the necessary assessments in case it comes back to bite you.

[2222]

Ahem it is free and gratis now.

Thanks.

[ostell]

Bearing in mind the problems that could potentially be caused by public disclosure I was suggesting posting on a notice board internal to the club, behind doors with member only access, vis security fob. No mention , of course, of previous convictions etc, just a specific trespasser that we do not want on site without mentioning why.

Thanks for the ICO suggestion, will take that one up.

There is of course suggestions that it will be discussed at committee after a police visit to cover security in general so goodness knows when that would be, probably long after several items have already gone.

It is the season of boat jumbles, so a ready market for stolen items. I have been informed that he uses bolt croppeers to liberate items he wants.