Landlords who rent properties that have communal areas such as lobbies, communal stairways, entry systems and car parks might well be tempted to install CCTV cameras to monitor those communal areas to help keep residents and property safe and secure. Whilst this is perfectly legal and often a very good idea, in this article we take a look at the rules and regulations around CCTV and what a landlord should be aware of when considering installing a CCTV system.
GDPR and data protection
First things first, if the CCTV cameras that are installed only show live feeds and do not record anything, then GDPR rules do not apply, but if images and sound are being recorded then GDPR rules need to be followed and, in the UK, this is governed by the Data Protection Act 2018. The GDPR and Data Protection Act, set down specific requirements when using CCTV to record images.
Complying with Data Protection laws
The first step is to decide if using CCTV is right in the first place. Is there another way to protect or monitor the communal areas? Make sure to write this justification down as part of the data protection policy. Some things to take into consideration, if it is felt that CCTV is the only method that can be used:
- Do not install cameras in places where they can “see” into someone’s private space. So, in a block of flats, for example, the cameras should not be able to see into someone’s flat
- In pretty much all cases, recording of conversations would be considered unreasonable so ensure that, unless you have a very good reason to do otherwise, that sound recording is off.
When installing the CCTV, to be compliant, the following must be done:
- Make a written statement explaining why the use of CCTV and the recording images is required and for what purpose and what areas are to be covered. This forms the basis of a CCTV and data protection policy. Also ensure that any images being recorded are only used for the reasons specified and in the areas specified
- Signs need to be put up in prominent locations clearly stating that images are being recorded and who the data controller is and how they can be contacted.
- The system should be set up so that no more than is absolutely necessary is recorded. Do not record 5 mins of footage if only 30 seconds is needed.
- Any videos that are captured are stored in a secure manner so that access to them is strictly limited. The data protection policy should be very clear as to who has day-to-day access to images and why they have access and what security measures are in place to secure the images and how access to the images will be controlled and monitored
- Recordings should only be kept for as long as absolutely needed, so should be deleted regularly. The policy should state how long images will be kept for, why they need to be kept that long and how deletions will be controlled.
- The recordings are only used for the manner in which they were intended according to the written statement.
- Register with the ICO and pay the correct registration fee
- Have a fully controlled subject access request process and if a member of the public wishes to check what recordings have been made of them, the camera owner must withing 1 month give them a copy of the recordings.
- If asked by a member of the public all images of them must be deleted within one month unless there is a legitimate legal dispute which requires the images to be kept. In this case, the person requesting that the data is deleted must be informed of this
- Ensure that no recordings are uploaded or streamed online without robust justification. It is very rare that uploading or streaming images online without the person’s written consent would be justified.
Anyone failing to comply with data protection laws could be subject to enforcement by the ICO and also could be subjected to legal action by any individuals who feel they have had their rights violated so it is important to comply with the legislation.
CCTV in communal areas can be a very positive security measure, helping to protected property and individuals, but it also needs to be handled in the right way in order to be compliant and not intrusive for your tenants and members of the public.
