Appropriate use of CCTV in pubs to monitor customers activities can benefit your business and the community – for example where footage is used to secure a criminal conviction.
If you decide to install, or are required to install CCTV, then it is not just a question of buying the equipment and putting it in place. There are various ongoing responsibilities that you need to be aware of.
When you install a CCTV system you must register with the Information Commissioner and name the “data controller” – this should be whoever controls the images captured by CCTV and who has authority to disclose them. There may be more than one data controller – it could be both tenant and pubco if responsibility is shared.
You will need to pay an annual registration fee, currently £35. There is a fine and a risk of criminal conviction if this is not done.
You are required by law to notify the public that CCTV is in operation on your premises. This is usually done by displaying notices.
Policy on handling data
It is important that you have a written internal policy which covers how CCTV images are to be stored and how requests for disclosure of images are dealt with. This is a good basis for training individuals involved with the process. It is also important to be able to demonstrate to the Information Commissioner that you take your data protection responsibilities seriously in case of a complaint being made about how you stored or used personal data.
Disclosure of information
The Data Protection Act 1998 sets out the circumstances in which CCTV footage can be disclosed to a third party. In essence, images can be provided to the police if they are necessary for investigating or preventing a crime or for apprehending or prosecuting an offender.
NB It is these requirements that you must comply with rather than any general stipulation in your licence that you must provide images to the police “on request.”
You are not bound but are rather encouraged to follow the Surveillance Camera Code of Practice
When it comes to using CCTV to monitor employees at work, a recent case has highlighted the dangers of this practice. A Spanish supermarket chain installed hidden surveillance cameras to monitor the checkouts and area behind the cash desks. 5 members of staff were subsequently disciplined and dismissed for theft. The staff brought claims to the European Court of Human Rights claiming that the use of covert CCTV breached their human rights and in particular their right to privacy. The European Court decided that the use of hidden cameras had breached the employees’ privacy rights. The decision was based on the fact that although the cameras had been installed after suspicions of theft had arisen they were not aimed at just the claimants but recorded all staff. They were left in place for a number of weeks and were in use during all working hours. The employer had not complied with its obligations to notify staff under Spanish Data Protection laws.
- If you are considering surveillance of your staff it is important that data protection laws are complied with.
- Surveillance must be targeted at suspects and used for only a limited time. It can only be justified if the adverse effect on the employee is justified by the benefits to the employer and others of collecting the data.
- As an employer you must carry out an impact assessment in order to decide whether monitoring is justified in a particular case.
The Information Commissioner has published guidance for employers in the Employment Practices Code. This covers the use of video surveillance in the workplace. The Code is aimed at helping employers to comply with the Data Protection Act by adopting good practices. Section 3 of the Code covers both video monitoring and covert monitoring in the workplace and sets out practical advice and examples of how to carry out an impact assessment.
Register now to receive future topical industry updates
The content of this page is a summary of the law in force at the present time and is not exhaustive, nor does it contain definitive advice. Specialist legal advice should be sought in relation to any queries that may arise.