Releasing CCTV for evidence
Arguably, closed circuit television (CCTV) is one of the most
powerful tools to be developed during recent years to assist with
efforts to combat crime and disorder whilst enhancing community
safety. Equally, it may be regarded by some as the most potent
infringement of people's liberty.
If users, owners and managers of such systems are to command the
respect and support of the general public, the systems must not
only be used with the utmost probity at all times, they must be
used in a manner which stands up to scrutiny and is accountable to
the very people they are aiming to protect. Carlisle
City Council is committed to the belief that everyone has the
right to respect for his or her private and family life. Although
the use of CCTV cameras has become widely accepted in the UK as an
effective security tool, those people who do express concern tend
to do so over the handling of the information (data) which the
system gathers.
Primary request to view data
Primary requests to view data generated by a CCTV system are
likely to be made by third parties for any one or more of the
following purposes:
- providing evidence in criminal proceedings
- providing evidence in civil proceedings or tribunals
- the prevention of crime
- the investigation and detection of crime (may include
identification of offenders)
- identification of witnesses.
Third parties, which are required to show adequate grounds for
disclosure of data within the above criteria, may include, but are
not limited to:
- police
- statutory authorities with powers to prosecute, (eg. Customs
and Excise; Trading Standards, etc.)
- solicitors
- claimants in civil proceedings
- accused persons or defendants in criminal proceedings
- other agencies, (as agreed by the Data Controller and notified
to the Information Commissioner) according to purpose and legal
status.
Secondary request to view data
A 'secondary' request for access to data may be defined as any
request being made which does not fall into the category of a
primary request. Before complying with a secondary request, the
data controller shall ensure that:
the request does not contravene, and that compliance with the
request would not breach, current relevant legislation, (eg. Data
Protection Act 1998, Human Rights Act 1998, section 163 Criminal
Justice and Public Order Act 1994, etc);
- any legislative requirements have been complied with, (e.g. the
requirements of the Data Protection Act 1998);
- due regard has been taken of any known case law (current or
past) which may be relevant; and
- the request would pass a test of 'disclosure in the public
interest'.
Individual subject access under data protection
legislation
Under the terms of Data Protection legislation, individual
access to personal data, of which that individual is the data
subject, must be permitted providing:
- the request is made in writing
- a specified fee is paid for each individual search
- the data controller is supplied with sufficient information to
satisfy him or her self as to the identity of the person making the
request
- the person making the request provides sufficient and accurate
information about the time, date and place to enable the data
controller to locate the information which that person seeks, (it
is recognised that a person making a request is unlikely to know
the precise time. Under those circumstances it is suggested that
within one hour of accuracy would be a reasonable requirement)
- the person making the request is only shown information
relevant to that particular search and which contains personal data
of her or him self only, unless all other individuals who may be
identified from the same information have consented to the
disclosure.
In the event of the data controller complying with a request to
supply a copy of the data to the subject, only data pertaining to
the individual should be copied, (all other personal data which may
facilitate the identification of any other person should be
concealed or erased). Under these circumstances an additional fee
may be payable.
The data controller is entitled to refuse an individual request
to view data under these provisions if insufficient or inaccurate
information is provided, however every effort should be made to
comply with subject access procedures and each request should be
treated on its own merit.
In addition to the principles contained within the Data Protection
legislation, the data controller should be satisfied that the data
is:
- not currently and, as far as can be reasonably ascertained, not
likely to become, part of a 'live' criminal investigation
- not currently and, as far as can be reasonably ascertained, not
likely to become, relevant to civil proceedings
- not the subject of a complaint or dispute which has not been
actioned
- the original data and that the audit trail has been
maintained
- not removed or copied without proper authority
- for individual disclosure only (i.e. to be disclosed to a named
subject).