SIA CCTV CCTV Legislation 2 — Questions and Answers
Question 1: What is the maximum penalty the ICO can issue for serious breaches of data protection law relating to CCTV?
- £500,000
- £1 million
- £17.5 million or 4% of annual turnover (Correct answer)
- £10 million
Correct answer: £17.5 million or 4% of annual turnover
Under the UK GDPR, the ICO can impose fines of up to £17.5 million or 4% of annual worldwide turnover (whichever is higher) for the most serious breaches.
Question 2: Which principle of the Surveillance Camera Code of Practice states that CCTV should only be used for a specified purpose?
- Principle 1 (Correct answer)
- Principle 3
- Principle 7
- Principle 12
Correct answer: Principle 1
Principle 1 states that surveillance camera systems should be used for a specified purpose that is in pursuit of a legitimate aim and necessary to meet an identified pressing need.
Question 3: Under the Regulation of Investigatory Powers Act 2000 (RIPA), what type of surveillance is covert CCTV classified as?
- Intrusive surveillance only
- Directed surveillance (Correct answer)
- Neither directed nor intrusive
- Always requires a warrant
Correct answer: Directed surveillance
Under RIPA, covert CCTV used as part of a specific investigation is typically classified as directed surveillance, which requires authorisation from a designated person.
Question 4: What signage requirement applies to most CCTV systems in the UK?
- No signage is required
- Signs must be placed only at entry points
- Signs must be clearly visible, showing who operates the system and contact details (Correct answer)
- Signs need only show a camera symbol
Correct answer: Signs must be clearly visible, showing who operates the system and contact details
The ICO requires that CCTV signs be clearly visible, include the identity of the organisation operating the system, and provide contact details for enquiries.
Question 5: A member of the public requests to see CCTV footage of themselves. Under UK GDPR, this is known as what?
- A freedom of information request
- A subject access request (SAR) (Correct answer)
- A court order
- A disclosure notice
Correct answer: A subject access request (SAR)
Under UK GDPR, individuals have the right to make a Subject Access Request (SAR) to see any personal data held about them, including CCTV footage.
Question 6: How long does an organisation have to respond to a Subject Access Request for CCTV footage?
- 7 days
- 14 days
- One calendar month (Correct answer)
- Three months
Correct answer: One calendar month
Under UK GDPR, organisations must respond to a Subject Access Request within one calendar month of receiving it.
SIA CCTV CCTV Legislation 2
What is the maximum penalty the ICO can issue for serious breaches of data protection law relating to CCTV?