The recent EU case of Ryneš (http://tinyurl.com/mhs6btl ) raises some interesting issues for users of CCTV systems on domestic premises.
The decision of the court is quite clear. If the CCTV is set up so as to also record people in public spaces, e.g. the adjoining street or footpath then the exemption does not apply. See paragraph 33 of the judgement (my emphasis):
To the extent that video surveillance … covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity for the purposes of the second indent of Article 3(2) of Directive 95/46.
Consequences include, under the current Data Protection Act 1998 and associated regulations:
- The operator needs to register as a data controller since, without the s36 exemption from Part III of the Act, no other exemption from notification seems to apply
- Running the system without such notification is a criminal offence (ss 17 and 21 of the Act
- The system would probably be unlawful (principle 1 fairness) unless the operator could reasonably show that he could not record on-premises without inevitably covering some public space
- The operator must respond to subject access requests from anyone who may have been recorded in the public space, and may need to be able to remove third party images if supplying a copy of the data
- The operator needs to have similar regard to the need for clear and visible signage as would apply to other CCTV surveillance
- If the operator takes a risk, perhaps rightly surmising that the ICO is unlikely to proactively enforce the strict legal position, and does not register he must respond to any request for information about the system within 21 days under s24. Failure to so respond is a criminal offence.
The judgement itself says very little about the rationale. In addition to paragraph 33 it adds at 35:
Article 3(2) of Directive 95/46 must be interpreted as meaning that the operation of a camera system, as a result of which a video recording of people is stored on a continuous recording device such as a hard disk drive, installed by an individual on his family home for the purposes of protecting the property, health and life of the home owners, but which also monitors a public space, does not amount to the processing of data in the course of a purely personal or household activity, for the purposes of that provision.
The combination of these provisions as set out in the judgement, without explanation, would seem to lead to the logical conclusion that activities such as: recording video on a mobile phone; cyclists using a helmet camera; or using a car dash camera would be equally outside the s36 exemption. These activities meet the criteria in paragraphs 33-35 of the judgement. That is however probably not the intention of the court. We need to look at the advocate general’s opinion (http://tinyurl.com/kmmul4f ) to see that domestic CCTV is in effect a special case which can be distinguished from these other activities. See paragraph 33:
recordings of this kind taken as a whole, may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them.
It is of course much more difficult, and therefore has much less impact on privacy, to draw such conclusions from non-static recording. It is probably safe to assume for now at least, that this decision only applies to the specific case of a home CCTV. Indeed the advocate general effectively says as much at paragraph 30
the present question … relates to a type of fixed surveillance system which covers a public space as well as the door of the house opposite, thereby enabling the identification of countless individuals without them having been informed of such surveillance beforehand. By contrast, the legal questions associated with recordings made using mobile phones, camcorders or digital cameras are of a different nature, and so will not be addressed in this Opinion.
It will be interesting to see over the coming months whether and to what extent ICO amends his guidance on these issues. One possibility might be a specific exemption from notification for domestic CCTV, but it is at least doubtful whether that could be achieved. S17(3) limits exemption to cases where processing is “unlikely to prejudice the rights and freedoms of data subjects” and such a conclusion would seem to fly in the face of the judgement which is strongly based on the need to protect the “fundamental rights and freedoms of natural persons, in particular their right to privacy” – see paragraph 27.
See also the discussion here: http://tinyurl.com/pf4338c