CCTV and Data Protection

[MrSparkle]

If a business publishes CCTV footage of children/teenagers on facebook in order to identify them, are they breaching data protection or any other laws?

Just to clarify, all faces are clearly seen and identifiable on the video, no attempt was made by the business to conceal the faces..

[MrSparkle]

It seems that the business is in breach of the GDPR because they are using the cctv footage for a purpose it was not collected for and that they are not registered to use it for.

How do I report a business for breaching GDPR?

Ive looked on the ICO site and that only allows me to report breaches to my data being used. Nowhere can I find a link to report a business for breaching GDPR.

[R0b]

You can try casework@ico.org.uk but you should make it clear the complaint is not in relaiton to your data.

[MrSparkle]

Thanks I will give that a go.

Curious that there is no way on the ICO site to report a business for using someone elses data in breach of GDPR. Is it a case of if the person doesnt know their data is being misused then its not being misused?

[YorkshireMan]

Bit of a late reply, but there is no context to the original question so I'm not sure how the likes of the GDPR can be considered breached without all the relevant facts. If you think a business has breached someone else's rights, you are likely to have a lot more joy contacting the registered Data Controller for the business and asking them the question - rather than putting a report into the ICO.

For example, are the children/teenagers in a shop and being captured on CCTV in the act of shoplifting or intimidating staff/customers? If the CCTV is declared correctly for crime detection/prevention purposes and the requisite notices in the shop are present, the business may be able to argue the publishing of the coverage in such a case is justified.

Doesn't necessary mean it's a good idea though. In fact, the Police recommend business's CCTV footage in cases like that is left to them to deal with - but the reasons have more to do with prejudicing criminal cases, and potentially wrongly incriminating someone - than GDPR. The problem is whether the Police have the bandwidth and inclination to properly investigate such cases and put the coverage on the sort of local forums that might yield results. So I can certainly understand why businesses affected by such crime try to do a bit of groundwork for the Police, and they are certainly using the data for its intended purpose - but they would be advised to seek permission to post from the Police first.

Where the business may get into trouble is if they aren't on solid ground with any direct/implied allegation, leaving themselves open to a defamation case and by implication, the misuse of data.

ICO publish a code of practice for CCTV use by businesses which is worth a read.