CCTV - releasing for evidence

Arguably, closed circuit television (CCTV) is one of the most powerful tools to be developed during recent years to assist with efforts to combat crime and disorder whilst enhancing community safety. Equally, it may be regarded by some as the most potent infringement of people's liberty.

If users, owners and managers of such systems are to command the respect and support of the general public, the systems must not only be used with the utmost probity at all times, they must be used in a manner which stands up to scrutiny and is accountable to the very people they are aiming to protect. Carlisle City Council is committed to the belief that everyone has the right to respect for his or her private and family life. Although the use of CCTV cameras has become widely accepted in the UK as an effective security tool, those people who do express concern tend to do so over the handling of the information (data) which the system gathers.

Primary request to view data

Primary requests to view data generated by a CCTV system are likely to be made by third parties for any one or more of the following purposes:

• providing evidence in criminal proceedings
• providing evidence in civil proceedings or tribunals
• the prevention of crime
• the investigation and detection of crime (may include identification of offenders)
• identification of witnesses.

Third parties, which are required to show adequate grounds for disclosure of data within the above criteria, may include, but are not limited to:

• police
• statutory authorities with powers to prosecute, (eg. Customs and Excise; Trading Standards, etc.)
• solicitors
• claimants in civil proceedings
• accused persons or defendants in criminal proceedings
• other agencies, (as agreed by the Data Controller and notified to the Information Commissioner) according to purpose and legal status.

Secondary request to view data

A 'secondary' request for access to data may be defined as any request being made which does not fall into the category of a primary request. Before complying with a secondary request, the data controller shall ensure that:

the request does not contravene, and that compliance with the request would not breach, current relevant legislation, (eg. Data Protection Act 1998, Human Rights Act 1998, section 163 Criminal Justice and Public Order Act 1994, etc);

• any legislative requirements have been complied with, (e.g. the requirements of the Data Protection Act 1998);
• due regard has been taken of any known case law (current or past) which may be relevant; and
• the request would pass a test of 'disclosure in the public interest'.

Individual subject access under data protection legislation

Under the terms of Data Protection legislation, individual access to personal data, of which that individual is the data subject, must be permitted providing:

• the request is made in writing
• a specified fee is paid for each individual search
• the data controller is supplied with sufficient information to satisfy him or her self as to the identity of the person making the request
• the person making the request provides sufficient and accurate information about the time, date and place to enable the data controller to locate the information which that person seeks, (it is recognised that a person making a request is unlikely to know the precise time. Under those circumstances it is suggested that within one hour of accuracy would be a reasonable requirement)
• the person making the request is only shown information relevant to that particular search and which contains personal data of her or him self only, unless all other individuals who may be identified from the same information have consented to the disclosure.

In the event of the data controller complying with a request to supply a copy of the data to the subject, only data pertaining to the individual should be copied, (all other personal data which may facilitate the identification of any other person should be concealed or erased). Under these circumstances an additional fee may be payable.

The data controller is entitled to refuse an individual request to view data under these provisions if insufficient or inaccurate information is provided, however every effort should be made to comply with subject access procedures and each request should be treated on its own merit.
In addition to the principles contained within the Data Protection legislation, the data controller should be satisfied that the data is:

• not currently and, as far as can be reasonably ascertained, not likely to become, part of a 'live' criminal investigation
• not currently and, as far as can be reasonably ascertained, not likely to become, relevant to civil proceedings
• not the subject of a complaint or dispute which has not been actioned
• the original data and that the audit trail has been maintained
• not removed or copied without proper authority
• for individual disclosure only (i.e. to be disclosed to a named subject).