Irish Data Protection Commission Case Studies

Use of CCTV by a housing association [30/05/2011]

 

In November 2009, we received a complaint concerning the operation of CCTV by a local housing association in a small village.  The complainant informed us that there were three CCTV cameras in operation in the village, one of which was located in the vicinity of a housing development for the elderly and the other two at private dwellings.  The complainant alleged that all three cameras were monitoring public areas of the village.

 

We contacted the housing association and informed it of its obligations under the Acts in respect of CCTV usage.  Recognisable images captured by CCTV cameras constitute personal data and, as such, are subject to the provisions of the Data Protection Acts, 1988 and 2003.  Any data controller who uses CCTV needs to be able to justify obtaining and using personal data by means of the CCTV system.  We provided the housing association with a copy of our guidance material on the use of CCTV.  We asked it to outline how the processing of the images obtained from the CCTV cameras complied with the Acts and to give details of any signage that was in place informing individuals that CCTV was in operation.  In response we were informed that the purpose of the cameras was to provide security for both the housing development for the elderly and for the village.  The housing association asserted that the cameras only monitored public areas of the village and we were provided with more specific details about the operation of the CCTV system.  According to the housing association, while the CCTV cameras had been installed, they were not yet operational.  However, once planning permission for the poles had been approved by the local authority it was intended that the cameras would become operational.  The housing association also stated that the housing development for the elderly was built by the housing association and was managed by it.  We informed the housing association that, provided it was in compliance with the requirements of the Acts in relation to the operation of CCTV at the housing development for the elderly for which it had management responsibility, it could operate the CCTV system in respect of the exterior of those houses for security purposes.  However, all other CCTV cameras recording footage from areas of the village which were not part of the housing development for the elderly could not be operated by the housing association.  The housing association was also informed that, in the event that it obtained planning permission for the erection of the cameras in the village, this would not legitimise use of the CCTV system from a data protection perspective.

 

To ensure compliance with the Acts, we served an Enforcement Notice on the housing association.  This is a legal notice requiring the housing association to cease or not to commence operating a CCTV system in the general areas of the village.  It also required the housing association to comply with the provisions of the Data Protection Acts, 1988 and 2003, in respect of the operation of the CCTV cameras in the vicinity of the housing development for the elderly.  We subsequently received an assurance from the legal representatives of the housing association that it would comply with the requirements of the Enforcement Notice.  They informed us that the housing association proposed to apply in due course to the Department of Justice & Law Reform to operate the CCTV under the Code of Practice for Community Based CCTV Systems scheme provided for in the Garda Act 2005.  It would be surprising if such approval was granted to a small village with relatively little history of crime; to do so would raise serious questions as to the proportionality of the measure.