6. Not Following Legislation and Police Recommendations
Not following legislation is the single most disastrous mistake you can make when it comes to CCTV cameras. Being recorded at work or in a public place is a problem that everyone takes seriously. Leaking or misusing recorded information can have disastrous consequences for the persons recorded, even when they are not caught doing anything illegal.
This is why the UK has very strict legislation related to what you can record and under what conditions. The fundamental act which governs how you are allowed to use information from CCTV cameras is the Data Protection Act (DPA) In short, according to the Data Protection Act, if you are using CCTV cameras on your London commercial property, you must:
- Let everyone know that CCTVs are being used and why (usually by putting up a sign announcing that “you may be recorded”).
- Keep images only as long as your business needs them.
- Be able to provide images within 40 days to anyone who has been recorded and, if you are asked, to the authorities.
The DPO itself is augmented by a number of other regulatory documents, primarily the Freedom of Information Act (FOIA) and the Protection of Freedoms Act (POFA). These requirements are outlined in the Surveillance Camera Code of Practice, issued under the POFA. The ICO’s handy code of practice also includes a useful, more down-to-earth overview of your responsibilities.
The legislation in this field is very murky and probably best left to experts in matters of law. However, you should at least be aware of its scope, and you should ensure that any third-party you work with is aware of it as well.
7. Bad Storage and Archival Practices
Most CCTV footage is not used immediately after being recorded. At a minimum, many burglary attempts against commercial properties take place during the night, so it can be hours before someone retrieves the recording. In other cases, it may take days or even weeks before someone notices something wrong and decides to look at CCTV footage, or before an official request from the authorities is delivered.
Consequently, CCTV footage needs to be properly archived. The basic guideline is that your system should be able to store 31 days of good-quality pictures; there is rarely any reason to reduce this period, but for some businesses, it can make sense to extend it.
Good storage practices are not just about storage capacity, though. You also need to keep in mind that:
- All recordings must be retained in a secure environment with adequate access controls and logging.
- The tokens used to access secured data (passwords, encryption keys, etc.) should be kept secure, only by authorised operators, but must be available at all times. Footage that can no longer be accessed is of no use.
- Footage should be archived and indexed so that the desired fragment (usually identified by date and time) is easy to locate.
Fortunately, the Home Office issues a leaflet with 19 simple guidelines to follow in order to ensure the quality and safe storage of your CCTV footage.
Does your storage meet these guidelines?