Protection of Freedoms

Memorandum submitted by Liberty (National Council for Civil Liberties) (PF 63)

Chapter 1 Part 2

Regulation of CCTV and other surveillance camera technology

Clause 29 of the Bill requires the Secretary of State to prepare a code of practice including guidance about the development or use of surveillance camera systems and the use or processing of information obtained by such systems. [1] The Bill provides a non-prescriptive, non-exhaustive list of issues which the guidance may address including considerations to be taken into account when deciding whether to use surveillance cameras, the appropriate types of system or apparatus to use and where cameras should be located. [2] Under the provisions of the Bill, whilst preparing her code, the Secretary of State must consult with a number of named authorities, including the Association of Chief Police Officers, the Information Commissioner and the newly appointed Surveillance Camera Commissioner. [3] The resulting code must be approved by both Houses of Parliament, and if the Secretary of State wishes to amend it that amendment too must be passed by Parliament. [4] The Bill requires that the code be published and that all of a list of ‘relevant authorities’ including policing bodies and local authorities must have regard to it. [5]

Clause 34 requires the appointment of a new Surveillance Camera Commissioner, charged with encouraging compliance with the surveillance camera code, reviewing the operation of the code and providing advice about its requirements. [6] The Commissioner is required to produce annual reports about the exercise of his functions. [7]

Background

Liberty has never opposed the targeted use of CCTV cameras where it can be shown to be necessary and proportionate. It is undeniable that in certain limited well placed locations the use of CCTV cameras can be of assistance in crime detection (although research has not demonstrated any discernible link with crime prevention). But to date the use of such technology, which is ever changing and increasingly intrusive, has largely taken place outside of formal regulation.

It is nearly fourteen years since the then Home Secretary, Michael Howard, made the initial decision to commit substantial sums of public money to set up hundreds of public sector surveillance systems throughout the UK, making use of the untested medium of closed circuit television. The original aim was to establish public systems as a crime prevention and detection measure, run principally by local authorities, or through partnerships with the police, with an emphasis on public safety: "to reduce crime and the fear of crime". [8] A frenzy of public investment followed in parallel with the expansion of CCTV in the commercial sector. This trend gathered force under the Labour Government, and the UK is now one of the world leaders in CCTV use. [9]

Initially, as a result of concerns about civil liberties expressed by local councillors and organisations such as Liberty, the emerging industry relied upon voluntary codes of practice, published first by the Local Government Information Unit, and later by the security industry. The revision of data protection law provided the opportunity for the introduction of a code of practice, published in 2000 by the Information Commissioner and revised in 2008. [10] With data protection requirements being the only applicable domestic law, and interpretations of the European Convention on Human Rights still emerging, the progressive expansion of CCTV in the UK has relied more on stretching the boundaries of what is acceptable to the public and politicians, than on meeting any testing regulatory standards. The provisions of the Protection of Freedoms Bill, which make few substantive prescriptions as to the content of a proposed code of practice for surveillance camera systems, do little to assuage our concerns.

Two prominent and recent examples of the misuse of surveillance technology bring into sharp focus the need for firm and comprehensive regulation. West Midlands Police’s controversial CCTV and automatic number plate recognition (ANPR) scheme, Project Champion, aptly demonstrates the divisive, damaging and counter-productive impact of disproportionate and ill-targeted surveillance operations. The scheme involved the installation of hundreds of cameras (overt and covert) in two areas of Birmingham targeted because of a high proportion of Muslims residents. The project was falsely sold to the local Muslim community as a general crime prevention scheme when it was purely a counter-terror measure. [11] Following Liberty’s intervention, a review of the scheme was established and the report which resulted, authored by the Chief Constable of Thames Valley, Sarah Thornton, acknowledged that the scheme had dramatically undermined confidence in police legitimacy. [12] The report flagged up the particularly damaging impact of these measures in the context of a counter-terror project where the need to maintain public support is especially strong. Needless to say members of the community were left feeling alienated and distrustful of the authorities.

The case of Geoff Peck is a striking example of the misuse of images captured by surveillance camera systems. Mr Peck was captured on a local council’s CCTV system attempting to commit suicide by cutting his wrists. The images were made available to media outlets and as a result, scenes of the suicide attempt were broadcast by Anglia Television and later "Crime Beat", a BBC series on national television with an average of 9.2 million viewers.

These extreme examples aside, surveillance technology can have a chilling effect on individuals, inhibiting people from taking part in public activities and preventing them from behaving freely in, or entering spaces covered by CCTV cameras. The presence of a large number of cameras and the sense of being continuously under surveillance, increases the risk of this reaction. There is a need for clarity over the purpose and scope of individual schemes, to avoid imposing unnecessary restrictions on behaviour, something in which everyone has a common interest [13] . Unnecessary surveillance may also have an adverse impact on freedom of movement [14] . Failures of technology, inadequate public understanding, and the need for safeguards and protection systems become more important as technology becomes more sophisticated.

Amended Scheme

Clause 29, page 19, line 27, delete Clauses 29 to 36 and insert –

"Privacy duties

29 Surveillance camera systems privacy duties (1) All public or commercial surveillance camera operators falling within the scope of subsection (2) must ensure that: (a) they are registered with the Information Commissioner, (b) every operational surveillance camera system located in an area to which the public have lawful access is clearly signposted, (c) no surveillance camera is positioned in such a way that it can capture images from inside a private dwelling, (d) no surveillance camera system is positioned in such a way that it can capture images from toilet areas or any room or area used primarily for dressing or undressing, (e) no surveillance camera system is positioned in such a way that it can capture images of school premises without the express permission of the Information Commissioner, (f) no image captured by a surveillance camera system shall be disclosed to any person, save for law enforcement agencies, without the express permission of the Information Commissioner, (g) the viewing of live images on monitors is restricted to the surveillance camera operator unless the monitor displays a scene which is also in plain sight from the monitor location, (h) the viewing of recorded images is restricted to the surveillance camera operator and takes place in an area to which others do not have routine access, (i) a maximum time period for the retention of images is set and approved by the Information Commissioner,

(j) a maximum number of surveillance cameras can be operated is set and approved by the Information Commissioner.

(2) For the purposes of this Chapter, a public or commercial surveillance camera operator includes: (a) any public authority as defined at section 35(6) below; or (b) any company as defined at section 35(3) where any of the surveillance camera systems under the control of the operator is so positioned as to capture images of areas to which any employee or member of the public has lawful access at any time.

Surveillance camera systems regulations

30 Regulations for public surveillance camera operators

(1) The Secretary of State must, by regulations, for the purpose of - (a) protecting individual privacy, (b) safeguarding against misuse of surveillance camera systems, and (c) ensuring proportionate use of surveillance camera systems, make regulations with respect to the development or use of surveillance camera systems, and the use or processing of images or other information obtained by virtue of such systems by public authorities. (2) Regulations made under subsection (1) above are known as Public Surveillance Camera Systems (Statutory Duties) Regulations.

(3) Such regulations must, in particular, include provision about - (a) considerations as to whether to use surveillance camera systems; (b) types of systems or apparatus; (c) technical standards for systems or apparatus; (d) locations for systems or apparatus; (e) the publication of information about systems or apparatus; (f) standards applicable to persons using or maintaining systems or apparatus; (g) standards applicable to persons using or processing information

obtained by virtue of systems; (h) access to, or disclosure of, information so obtained and (i) procedures for complaints or consultation.

(4) In the course of preparing public surveillance camera systems (statutory duties) regulations, the Secretary of State must consult-

(a) such persons appearing to the Secretary of State to be representative of the views of persons who are, or are likely to be, subject to the duty to have regard to the public security camera systems regulations as the Secretary of State considers appropriate,

(b) the Association of Chief Police Officers,

(c) the Information Commissioner,

(d) the Chief Surveillance Commissioner,

(e) such persons appearing to the Secretary of State to be representative of the views of persons who are, or are likely to be, affected by breaches of the public surveillance camera systems regulations,

(f) the Welsh Ministers, and

(g) such other persons as the Secretary of State considers appropriate.

(5) The obligation to make surveillance camera regulations is to be exercised by statutory instrument, which is subject to annulment in pursuance of a resolution of either House of Parliament. (6E+W+S+N.I. ) An obligation imposed by the public surveillance camera systems (statutory duties) regulations shall be a duty owed to any person who may be affected by a contravention of the obligation by any person operating a surveillance camera system subject to any provision to the contrary in the regulations and to the defences and other incidents applying to actions for breach of statutory duty. A contravention of any such obligation shall be actionable accordingly.

31 Regulations for private surveillance camera operators

(1) The Secretary of State must, by regulations, for the purpose of - (a) protecting individual privacy, (b) safeguarding against misuse of surveillance camera systems, and (c) ensuring proportionate use of surveillance camera systems, make regulations with respect to the development or use of surveillance camera systems, and the use or processing of images or other information obtained by surveillance camera operators not falling within the definition of a public authority set out at section 35(6) below. (2) Regulations made under subsection (1) above are known as Private Surveillance Camera Systems (Statutory Duties) Regulations.

(3) Such regulations must, in particular, include provision about - (a) considerations as to whether to use surveillance camera systems,

(b) types of systems or apparatus,

(c) technical standards for systems or apparatus, (d) locations for systems or apparatus, (e) procedures for complaints or consultation.

(4) In the course of preparing private surveillance camera systems (statutory duties) regulations, the Secretary of State must consult-

(a) such persons appearing to the Secretary of State to be representative of the views of persons who are, or are likely to be, subject to the duty to have regard to the private security camera systems regulations as the Secretary of State considers appropriate,

(b) the Association of Chief Police Officers,

(c) the Information Commissioner,

(d) the Chief Surveillance Commissioner,

(e) such persons appearing to the Secretary of State to be representative of the views of persons who are, or are likely to be, affected by breaches of the private surveillance camera systems regulations.

(f) the Welsh Ministers, and

(g) such other persons as the Secretary of State considers appropriate.

(5) The obligation to make surveillance camera (statutory duties) regulations is to be exercised by statutory instrument, which is subject to annulment in pursuance of a resolution of either House of Parliament.

(6E+W+S+N.I. ) An obligation imposed by surveillance camera systems (statutory duties) regulations shall be a duty owed to any person who may be affected by a contravention of the obligation subject to any provision to the contrary in the regulations and to the defences and other incidents applying to actions for breach of statutory duty, a contravention of any such obligation shall be actionable accordingly.

Additional functions of the Information Commissioner

32 Specific duties

(1) The Information Commissioner shall have the following additional functions - (a) considering limits set by public or commercial surveillance camera operators on the maximum number of surveillance cameras operated by any one operator, and (i) where satisfied of the proportionality of the scheme, granting approval, (ii) where not satisfied of the proportionality of the scheme, substituting a proportionate maximum figure, (b) considering limits set by public or commercial surveillance camera operators on the maximum length of time for which images captured by a surveillance camera system can be retained, and (i) where satisfied of the proportionality of the scheme, granting approval, (ii) where not satisfied of the proportionality of the scheme, substituting a proportionate time limit, (c) enforcing compliance with the surveillance camera systems privacy duties,

(d) reviewing the operation of the surveillance camera systems privacy duties and the private and public surveillance camera systems regulations, (e) providing information and advice about the surveillance camera systems

privacy duties, including advice on compliance, breach and the consequences of breach, (d) compiling a register of all public and commercial surveillance camera systems operators required to register with the Commissioner under section 29(1)(a).

33 General duties

(1) It shall be the duty of the Commissioner to promote the following of good practice by surveillance camera systems operators and, in particular, so to perform his functions under this Act as to promote the observance of the requirements of this Act and the private and public surveillance camera systems regulations by surveillance camera systems operators.

(2)The Commissioner shall arrange for the dissemination, in such form and manner as he considers appropriate, of such information as it may appear to him expedient to give to the public about the operation of this Act, about good practice, and about other matters within the scope of his functions under this Act, and may give advice to any person as to any of those matters.

(3) The Secretary of State may pay in respect of the Commissioner’s new functions any expenses, remuneration or allowances that the Secretary of State may determine.

(4) The Secretary of State may, after consultation with the Commissioner, provide the
Commissioner with-
(a) such staff, and (b) such accommodation, equipment and other facilities, as the Secretary of State considers necessary for the carrying out of the Commissioner’s functions under sections 32 and 33.

34 Reports by Commissioner

(1) As soon as reasonably practicable after the end of each reporting period-

(a) the Commissioner must-

(i) prepare a report about the exercise by the Commissioner during that period of the functions of the Commissioner as set out at sections 32 and 33 above, and (ii) give a copy of the report to the Secretary of State,

(b) the Secretary of State must lay a copy of the report before Parliament, and (c) the Commissioner must publish the report.

(2) The reporting periods are-

(a) the period- (i) beginning with this Act first coming into force, and (ii) ending with the next 31 March or, if the period ending with that date is 6 months or less, ending with the next 31 March after that date, and (b) each succeeding period of 12 months.

Interpretation

35 Interpretation: Chapter 1

(1) In this Chapter "surveillance camera systems" means-

(a) closed circuit television or automatic number plate recognition systems, (b) any other systems for recording or viewing visual images of objects or events for surveillance purposes, (c) any systems for storing, receiving, transmitting, processing or checking images or information obtained by systems falling within paragraph (a) or (b), or

(d) any other systems associated with, or otherwise connected with, systems falling within paragraph (a), (b) or (c).

(2) In this Chapter "surveillance camera operator" means any body or individual responsible for the operation of a surveillance camera system. In the case of surveillance camera systems operated by or on behalf of a public authority or a company, the public authority or company and not any private individual shall be the surveillance camera systems operator.

(3) In this Chapter "company" has the meaning given to it at section 1(1) of the Companies Act 2006.

(4) In this Chapter "Information Commissioner" has the meaning given to it at section 6(1)-(2) of the Data Protection Act 1998.

(5) In this Chapter "Tribunal" refers to the "Information Tribunal" the constitution of which is outlined at 6(3)-(5) of the Data Protection Act 1998.

(6) In this Chapter "public authority" has the meaning given to it at section 6 of the Human Rights Act 1998.

(7) In this Chapter "good practice" means such practice in the operation of surveillance camera systems as appears to the Commissioner to be desirable having regard to the need to safeguard individual privacy and includes (but is not limited to) compliance with the surveillance camera systems duties and the public and private surveillance camera systems regulations;

(8) In this Chapter - - "the Chief Surveillance Commissioner" means the Chief Commissioner appointed under section 91(1) of the Police Act 1997, - "processing" has the meaning given by section 1(1) of the Data Protection Act 1998.

Enforcement

36 Enforcement of the surveillance camera systems privacy duties

E+W+S+N.I.

(1) If the Commissioner is satisfied that a public or commercial surveillance camera systems operator has contravened or is contravening any of the surveillance camera systems privacy duties set at section 29 above, the Commissioner may serve him with a notice (in this Act referred to as "an enforcement notice") requiring him to take or refrain from taking, within such time as may be specified in the notice, such steps as are so specified in a manner so specified.

E+W+S

This section has no associated Explanatory Notes

(2) An enforcement notice must contain- (a) a statement of the specific surveillance camera system privacy duty or duties which the Commissioner is satisfied have been or are being contravened and his reasons for reaching that conclusion, and (b) particulars of the rights of appeal conferred by section 41.

(3) Subject to subsection (4), an enforcement notice must not require any of the provisions of the notice to be complied with before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal.

(4) If by reason of special circumstances the Commissioner considers that an enforcement notice should be complied with as a matter of urgency he may include in the notice a statement to that effect and a statement of his reasons for reaching that conclusion; and in that event subsection (3) shall not apply but the notice must not require the provisions of the notice to be complied with before the end of the period of seven days beginning with the day on which the notice is served.

37 Cancellation of enforcement notice

E+W+S+N.I.

(1) If the Commissioner considers that all or any of the provisions of an enforcement notice need not be complied with in order to ensure compliance with the surveillance camera systems privacy duties to which it relates, he may cancel or vary the notice by written notice to the person on whom it was served.

(2) A person on whom an enforcement notice has been served may, at any time after the expiry of the period during which an appeal can be brought against that notice, apply in writing to the Commissioner for the cancellation or variation of that notice on the ground that, by reason of a change of circumstances, all or any of the provisions of that notice need not be complied with in order to ensure compliance with the surveillance camera systems privacy duties.

38 Request for assessment.

E+W+S+N.I.

(1) A request may be made to the Commissioner by or on behalf of any person who

is, or believes himself to be, directly affected by any surveillance camera system operated by a public or commercial surveillance camera operator for an assessment as to whether it is likely or unlikely that the surveillance camera system has been or is being operated in compliance with the surveillance camera privacy duties.

(2) On receiving a request under this section, the Commissioner shall make an assessment in such manner as appears to him to be appropriate, unless he has not been supplied with such information as he may reasonably require in order to-

(a) satisfy himself as to the identity of the person making the request, and (b) enable him to identify the surveillance camera system in question.

(3) The matters to which the Commissioner may have regard in determining in what manner it is appropriate to make an assessment include- (a) the extent to which the request appears to him to raise a matter of substance, and (b) any undue delay in making the request.

(4) Where the Commissioner has received a request under this section he shall notify the person who made the request-

(a) whether he has made an assessment as a result of the request, and (b) to the extent that he considers appropriate, of any view formed or action taken as a result of the request.

39 Information notice

E+W+S+N.I.

(1) If the Commissioner-

(a) has received a request under section 38 in respect of any surveillance camera system operated by a public or commercial surveillance camera operator, or

(b) reasonably requires any information for the purpose of determining whether the public or commercial surveillance camera operator has complied or is complying with the surveillance camera systems duties,

he may serve the public or commercial surveillance camera operator with a notice (in this Act referred to as "an information notice") requiring the operator, within such time

as is specified in the notice, to furnish the Commissioner, in such form as may be so specified, with such information relating to the request or to compliance with the duties as is so specified.

(2) An information notice must contain-

(a) in a case falling within subsection (1)(a), a statement that the Commissioner has received a request under section 38 in relation to the specified surveillance camera system, or (b) in a case falling within subsection (1)(b), a statement that the Commissioner regards the specified information as relevant for the purpose of determining whether the public or commercial surveillance camera system operator has complied, or is complying, with the surveillance camera systems duties and regulations and his reasons for regarding it as relevant for that purpose.

(3) An information notice must also contain particulars of the rights of appeal conferred by section 41.

(4) Subject to subsection (5), the time specified in an information notice shall not expire before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the information need not be furnished pending the determination or withdrawal of the appeal.

(5) If by reason of special circumstances the Commissioner considers that the information is required as a matter of urgency, he may include in the notice a statement to that effect and a statement of his reasons for reaching that conclusion; and in that event subsection (4) shall not apply, but the notice shall not require the information to be furnished before the end of the period of seven days beginning with the day on which the notice is served.

(6) The Commissioner may cancel an information notice by written notice to the person on whom it was served.

40 Failure to comply with notice

E+W+S+N.I.

(1) A public or commercial surveillance camera operator which fails to comply with an

enforcement notice or an information notice is guilty of an offence.

(2) A public or commercial surveillance camera operator who, in purported compliance with an information notice or a special information notice-

(a) makes a statement which he knows to be false in a material respect, or

(b) recklessly makes a statement which is false in a material respect,

is guilty of an offence.

(3) It is a defence for a public or commercial surveillance camera operator charged with an offence under subsection (1) to prove that he exercised all due diligence to comply with the notice in question.

41 Rights of appeal

E+W+S+N.I.

(1) A public or commercial surveillance camera systems operator on whom an enforcement notice or an information notice has been served may appeal to the Tribunal against the notice.

(2) A person on whom an enforcement notice has been served may appeal to the Tribunal against the refusal of an application under section 37(2) for cancellation or variation of the notice.

(3) Schedule 6 of the Data Protection Act 1998 has effect in relation to appeals under this section and the proceedings of the Tribunal in respect of any such appeal.

42 Determination of appeals

E+W+S+N.I.

(1) If on an appeal under section 41(1) the Tribunal considers- (a) that the notice against which the appeal is brought is not in accordance with the law, or

(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice or decision as could have been served or made by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2) On such an appeal, the Tribunal may review any determination of fact on which the notice in question was based.

(3) If on an appeal under section 41 the Tribunal considers that the enforcement notice ought to be cancelled or varied by reason of a change in circumstances, the Tribunal shall cancel or vary the notice.

(4) Any party to an appeal to the Tribunal under section 42 may appeal from the decision of the Tribunal on a point of law to the appropriate court; and that court shall be- (a) the High Court of Justice in England if the address of the person who was the appellant before the Tribunal is in England or Wales,

(b) the Court of Session if that address is in Scotland, (c) the High Court of Justice in Northern Ireland if that address is in Northern Ireland.

43 Prosecutions and penalties

E+W+S+N.I.

(1) No proceedings for an offence under this Act shall be instituted-

(a) in England or Wales, except by the Commissioner or by or with the consent of the Director of Public Prosecutions;

(b) in Northern Ireland, except by the Commissioner or by or with the consent of the Director of Public Prosecutions for Northern Ireland.

(2) A person guilty of an offence under any provision of this Act is liable, on summary conviction, to a fine not exceeding the statutory maximum."

Effect

The proposed new legislative scheme would replace the optional code of practice provided for in the Bill with two parallel schemes.

Surveillance camera systems privacy duties

Proposed clause 29 would enshrine in primary legislation a series of duties to which all public or commercial surveillance camera operators, including companies operating cameras in any area to which the public or their employees have lawful access, would be subject ("the privacy duties"). This scheme would rely on an extension of the functions of the Information Commissioner, as opposed to the scheme proposed in the Bill which involves the appointment of a new Surveillance Camera Commissioner. The proposed privacy duties would be enforced by the Information Commissioner. The privacy duties set minimum standards and provide for conduct which will never be permissible in the context of public or commercial surveillance camera systems, including filming in toilets, changing areas and private dwellings. Other of the duties contain a prohibition which is subject to the permission of the Information Commissioner, for example, surveillance camera systems may not film school premises without the express permission of the Commissioner. Public or commercial surveillance camera operators will also be obliged to set maximum limits on the number of surveillance cameras they may operate and the length of time that images captured by surveillance camera systems can be retained. If the Commissioner considers any figure proposed by the operator too large, he would be able to substitute a lower figure which the operator would not be permitted to exceed. The operator would be able to make further applications, putting forward additional justifications for a higher cap on camera numbers which would fall to be considered by the Commissioner.

Under the proposed scheme the Information Commissioner would have a series of general and specific duties. His general duties would include promoting good practice amongst surveillance camera operators and dissemination to the public of information about the operation of the privacy duties and the private and public surveillance camera systems regulations (Clauses 30 and 31 above). Although he would have general duties to promote compliance with the regulations, for example through the distribution of information, his enforcement activities would be specifically limited to enforcing the privacy duties. The proposed Information Commissioner enforcement regime set out at Clauses 36-43 largely mirrors the model set out in the Data Protection Act 1998 which deals with the failure of data controllers to comply with the data protections principles.

Under the amended scheme, three steps could be taken by the Information Commissioner in his capacity as enforcer of the statutory privacy duties. Firstly, in circumstances where he is satisfied that an operator has contravened or is contravening the privacy duties, he may serve him with an enforcement notice requiring him to bring the surveillance camera systems he operates into line with the surveillance camera systems privacy duties. Enforcement notices must state which of the duties are or have been broken and draw attention to the appeal regime provided for under Clauses 41-42 above. If no appeal is pursued, compliance with the notice would be required within the period in which an appeal can be brought (as specified in the notice). In exceptional cases, the Commissioner could make provision for the scheme to be complied with as a matter of urgency, but no sooner than 7 days from deemed date on which the notice was served. A failure to comply with an enforcement notice would be an offence punishable, on summary conviction, by a fine. The definition of surveillance camera operator set out at Clause 35(2) above is designed to ensure that where an individual is operating a surveillance camera system on behalf of a public authority or a company, liability attaches to the authority or company, rather than to the individual agent.

The second step the Commissioner can take is to make an assessment of the extent to which a public or commercial surveillance camera operator is complying with the privacy duties. As with the scheme established under the Data Protection Act, an assessment will be made in response to a request for an assessment which can be made by or on behalf of anyone who is or believes herself to be affected by a publically or commercially operated surveillance camera system. On receiving a request, the Commissioner would be obliged to contact the requester to let them know whether an assessment has been undertaken and if so what view was formed and what action will be taken as a result of the assessment.

If the Commissioner, having received a request for an assessment, requires any information from the operator for the purposes of determining whether she is complying with the privacy duties, he can issue an information notice requiring that the operator furnish him with the information necessary to make an assessment of compliance. The proposed scheme includes a series of requirements as to the information that must be set out in the notice, including particulars of the right to appeal against the issuing of a notice. As with an enforcement notice, failure to comply with an information notice (save where there is a successful appeal or the appeal process is ongoing) or the provision of false information is an offence punishable, on summary conviction, with a fine.

The appeal system under which the issuing of an information or enforcement notice can be challenged is modelled on the system provided for in the Data Protection Act. The relevant Tribunal will be the Information Tribunal and upward appeals will be possible on a point of law.

The Public and Private Surveillance Camera Systems (Statutory Duties) Regulations

Proposed Clauses 30 and 31 provide, respectively, for regulations effective in relation to public authorities and private individuals or organisations operating surveillance camera systems. Unlike the privacy duties scheme which would be enforced by the Information Commissioner and, in the event of non compliance, carries a criminal sanction, breach of the regulations would not have criminal law consequences. The scheme places an obligation on the Secretary of State, after consultation with a number of listed individuals and organisations, including those likely to represent the views of individuals likely to be affected by any breach of the regulations, to draft two sets of regulations. The first and lengthier set are to regulate the activities of public authorities and must contain provisions dealing with a number of aspects of CCTV regulation, including standards applicable to operators. Breach of the regulations would make an operator liable, in tort law, for breach of statutory duty. The Information Commissioner would not be involved in this part of the process; the civil duty owed by the operator would be owed directly to the person affected by a failure to comply with the provisions of the regulations. As with other torts, breach of statutory duty is actionable through the civil courts.

Briefing

Liberty believes that the critical issue of CCTV regulation should be addressed, in substance, in primary legislation to the greatest extent possible. We were concerned that the Bill as drafted fails even to make firm prescriptions as to the content of a non-binding code of practice, instead setting out a series of suggested areas of regulation that the code may address. [15] In contrast to the enforcement powers granted to the Information Commissioner under the Data Protection Act 1998, the Surveillance Camera Commissioner created by the Bill would have no enforcement powers, but would rather have general ‘soft’ duties, including responsibility for ‘encouraging compliance’ and ‘reviewing the operation of the code’. [16]

Liberty’s proposed scheme would place clear-cut abuses by public and commercial operators on a statutory footing prohibiting, absolutely, certain types of conduct, such as placing cameras in changing rooms, whilst requiring the permission of the Information Commissioner for others. The privacy duties would apply to commercial operators in addition to public authorities, addressing the largely unregulated use of surveillance technology by the private sector. It is clear that the UK has far too many cameras – and the Protection of Freedoms Bill provides an excellent opportunity to regulate the number of cameras in use. The proposed scheme would place initial responsibility for determining the maximum number of cameras to be operated by a single operator with the operator himself, but subject to the approval of the Information Commissioner. This provision is designed to take account of the varying needs of different operators, but provides an additional protection against overzealous companies and local authorities. In the same way the privacy duties would regulate the length of time for which images captured by surveillance cameras systems could be retained.

We are not opposed to the appointment of a Surveillance Camera Commissioner and indeed welcomed the proposal as an additional independent check on the use of surveillance camera systems. For practical reasons, however, we believe that enforcement of the regulation provided for in the Bill could be more effectively undertaken by the Information Commissioner, subject to the provision of necessary additional resources. Obligations surrounding the capture and retention of CCTV images, intersect, at many points, with obligations under the Data Protection Act 1998 ("the DPA") and the Freedom of Information Act 2000 ("the FOIA"), and it is important that there is a coherent and joined up approach to these issues. The disclosure of images, for example, by an operator to a media outlet would raise issues under both the privacy duties outlined above and the DPA, whilst a refusal by a public authority to disclose CCTV images to an individual would engage the FOIA and the proposed privacy duties.

As opposed to the ‘soft’ powers granted to the Surveillance Camera Commissioner in the Bill, the scheme outlined above would introduce an enforcement system comparable to that operated by the Information Commissioner under the data protection regime. A comprehensive appeal system would protect operators against inaccurate assessment, but those operators who do not comply with the privacy duties would be issued with an enforcement notice; failure to comply would result in a criminal sanction in the form of a fine. Under this model, the Commissioner would retain general obligations to promote good practice in the use of surveillance technology and to report on compliance with the privacy duties across the public and private sector, but these functions would be used in conjunction with substantial enforcement responsibilities.

The proposed scheme takes account of the difference between clear proscriptions or requirements which can be set out in primary legislation, and more malleable considerations involving the balancing of different interests and the consideration of locality or industry specific evidence. If implemented, proposed Clauses 30 and 31 would oblige the Secretary of State to make regulations and create a mandatory list of areas which must be addressed. Unlike breach of the code of practice provided for in the Bill, under the scheme proposed above, breach of the regulations would be actionable in tort law as a breach of statutory duty. Because of the nuances and balancing exercises which will likely form a feature of compliance with the regulations, the judiciary will be the arbiter of any dispute between individuals and operators as to the requirements of the regulations in a given situation. A system of regulations brings the scheme into line with areas of, for example, environmental or construction law which place actionable obligations on organisations carrying on activities which can have a serious adverse impact on the general public. [17] Liberty believes that the operation of surveillance technology falls into the same broad category and should be regulated in a similar way.

The proposed scheme recognises the different levels of regulation to which private and public actors should be subject. Whilst Liberty is concerned that the operation of surveillance technology by private actors should not remain in its current, largely unregulated, state the requirements which can be legitimately made of an arm of state must exceed those which can be placed on individuals or companies carrying out private functions. It may not be reasonable, for example, to expect an individual operating a single surveillance camera outside of business or residential premises for the purposes of deterring vandals, to attain accreditation in the use of surveillance technology, whereas there is a legitimate expectation that council employees working on a regular basis with surveillance technology are well trained and supervised.

April 2011


[1] Clause 29(1)-(2).

[2] Clause 29(3), with the full list including guidance about technical standards for systems or apparatus, standards applicable to persons using or obtaining apparatus or processing information collected, access to or disclosure of information obtained and procedures for complaint or consultation.

[3] Clause 29(5), the requirement of consultation also extends to persons appearing to the Secretary of State to represent the views of the persons likely to be required to have regard to the code, Welsh Ministers, the Chief Surveillance Commissioner and such other persons as the Secretary of State considers appropriate.

[4] Clause 30-31.

[5] Clause 33, with ‘relevant authorities’ listed at Clause 33(5).

[6] Clause 34(2).

[7] Clause 35.

[8] The Impact of CCTV: fourteen case studies , Home Office Online Report 15/05, 2005

[9] http://www.ico.gov.uk/for_organisations/data_protection/topic_guides/cctv.aspx .

[10] CCTV Code of Practice: Revised Edition 2008. Issued by the Office of the Information Commissioner: http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/ico_cctvfinal_2301.pdf .

[11] Project Champion Review: p. 46.

[12] Thames Valley Police’s Project Champion Review: http://www.west-midlands.police.uk/latest-news/docs/Champion_Review_FINAL_30_09_10.pdf . See in particular the foreword to the report.

[13] A Report on the Surveillance Society , Surveillance Studies Network, ICO 2006, at 45.2.2 It is argued that, “albeit an individual value and a human right, privacy is also a common value because all persons have a common interest in a right to privacy even though they may differ on (its) specific content”

[14] Opinion 4/2004 on the Processing of Personal Data by means of Video Surveillance , Article 29 Data Protection Working Party, 11750/02/EN WP89

[15] See Clause 29(3).

[16] Clause 34(2).

[17] See, for example, the Building Regulations and The Building (Approved Inspectors etc.) Regulations 2010 or the Environmental Permitting Regulations ( England and Wales ) 2010.

[17]