This organisation is aware of its responsibilities in the use of CCTV equipment and of the need to ensure it is fully compliant with relevant legislative requirements. This policy sets out the use, and the safeguards in place covering the use, of any type of CCTV or surveillance equipment on any premises owned or leased by the company. Within the health and social care sector, the case of surveillance equipment has risen markedly in the last five years. There have also been case law judgements, in particular relation to privacy issues, which has led to the Code of Practice from the Information Commissioners’ Office (ICO,) issued in June 2015.

Careful consideration needs to be given as to the reasoning behind the introduction of any type of surveillance system.
The general public needs to be aware of any covert usage.
Staff, where possible, should be included in discussions about the use of such systems.
Individual service users must be fully involved in decisions regarding the use of such equipment. Where they lack capacity, as defined by the Mental Capacity Act 2005, a best interest decision will be taken, following the guidance in the act.

The first Code of Practice was introduced in 2000 and, since then, the use of CCTV has moved to a much more sophisticated system of digital and increasingly portable technology. Privacy has become an issue in the use of such systems, and the code aims to keep users of such systems on the right side of the law. The code provides good practise advice for those involved in operating CCTV and other surveillance camera devices that view or record individuals, e.g. vehicle registration using automatic number plate recognition (ANPR).

The Protection of Freedoms Act (POFA) has introduced a commissioner, the Surveillance Camera Commissioner, to promote the code. It is designed to help those who use surveillance cameras to collect personal data to stay within the law.

The terms ‘surveillance system(s)’, ‘CCTV’, and ‘information’ are used throughout the code for ease of reference. Information held by organisations that is about individuals is covered by data protection legislation; the guidance in the code will assist organisations to comply with these obligations.

This Code of Practice is consistent with the POFA code and there is a memorandum of understanding between the Information Commissioner and Surveillance Camera Commissioner. The code covers the use of surveillance systems that are used to monitor or record the activities of individuals or both. As such, they process individuals’ information – their personal data. Most uses of surveillance systems will therefore be covered by the Data Protection Act and the provisions of the code, whether the system is used by a multinational company to monitor entry of staff or visitors or a local newsagent recording information to help prevent crime.

The code also covers the use of camera-related surveillance equipment including:

The code provides guidance on information governance, such as data retention and disposal.

It is important that the data controller of the organisation (Carly Fortune) is fully conversant with the Code of Practice and the principles set out below.

Adult Safeguarding
Confidentiality
Consent
Cyber Security
Data Protection Legislative Framework (GDPR)

ICO CCTV:
https://ico.org.uk/for-organisations/guide-to-data-protection/encryption/scenarios/cctv/

Gov.UK: Surveillance camera code of practice:
https://www.gov.uk/government/publications/surveillance-camera-code-of-practice

CQC Using surveillance: information for service providers:
https://www.cqc.org.uk/guidance-providers/all-services/using-surveillance-information-service-providers

All staff responsible for data control receive training concerning CCTV.
All staff, during induction, are made aware of the organisation’s policies and procedures, all of which are used for training updates. All policies and procedures are reviewed and amended where necessary, and staff are made aware of any changes. Observations are undertaken to check skills and competencies. Various methods of training are used, including one to one, online, workbook, group meetings, and individual supervisions. External courses are sourced as required.

Date Reviewed: May 2021
Person responsible for updating this policy: Carly Fortune
Next Review Date: May 2022

This is not a full explanation of the principles. For more general information, see the ICO’s Data Protection Act 1998 Legal Guidance, available on the ICO website:

www.ico.org.uk

System operators should adopt the following twelve guiding principles:

In communal areas, we consult with those where the fitting of such cameras may impact their privacy.
In bedroom areas, consent, as defined by the Mental Capacity Act 2005, is sought, as this setting is covered by the handling of sensitive personal data under the Data Protection Act 2018.

We are aware of the Care Quality Commission guidance of the use of CCTV in a social care setting and we have adopted the checklist contained in the Code of Practice, which will be reviewed annually.

This policy excludes the use of medical devices or treatment that gathers information; any use of technology with the knowledge and explicit consent of the patient, e.g. filming a surgical procedure; or any communication system controlled by the person using it, e.g. webcams, alarm buttons etc.

These would not be considered as surveillance, but issues of privacy still need to be considered.

It is therefore important that all factors are taken into consideration and recorded before the decision to undertake any form of surveillance is authorised.

A privacy impact assessment (PIA), where appropriate, must be completed, following the guidance issued by the ICO. Using the following screening questions will assist in determining whether a PIA is necessary. Yes, as the answer to any of the questions, will indicate that a PIA would be a useful exercise.

If a PIA is deemed necessary, then complete the following six steps.

The collection, use and deletion of personal data should be described here. It may also be useful to refer to a flow diagram or another way of explaining data flows. You should also say how many individuals are likely to be affected by the project.

Consultation requirements:

Identify the key privacy risks and the associated compliance and corporate risks.
Larger-scale PIAs might record this information on a more formal risk register.
Step three can be used to help identify the compliance risks related to the Data Protection Act.