SIA CCTV Legal Framework for CCTV 1 — Questions and Answers
Question 1: Which legislation is the primary law governing the processing of personal data (including CCTV images) in the UK?
- The Freedom of Information Act 2000
- The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (Correct answer)
- The Security Industry Authority Act 2001
- The Computer Misuse Act 1990
Correct answer: The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
CCTV images are personal data. The UK GDPR (retained from EU GDPR post-Brexit) and the Data Protection Act 2018 together govern the lawful processing of personal data, including CCTV footage, in the UK.
Question 2: Under UK data protection law, which of the following is a lawful basis for processing CCTV footage?
- Any purpose the operator chooses
- Legitimate interests of the controller or a third party, where not overridden by individuals' rights (Correct answer)
- Curiosity or entertainment purposes
- Commercial gain through footage sale
Correct answer: Legitimate interests of the controller or a third party, where not overridden by individuals' rights
Under UK GDPR Article 6, one lawful basis for processing is 'legitimate interests' — where the processing is necessary for legitimate purposes (e.g., crime prevention, safety), and those interests are not overridden by data subjects' rights and freedoms.
Question 3: What document provides authoritative guidance on the lawful and responsible use of surveillance camera systems in public places in England and Wales?
- The SIA CCTV Operator Licence Guide
- The Surveillance Camera Code of Practice (issued under the Protection of Freedoms Act 2012) (Correct answer)
- The ICO Employment Practices Code
- The British Security Industry Association Guidelines
Correct answer: The Surveillance Camera Code of Practice (issued under the Protection of Freedoms Act 2012)
The Surveillance Camera Code of Practice, issued by the Home Office under the Protection of Freedoms Act 2012, provides authoritative guidance on the responsible and effective use of surveillance camera systems by relevant authorities in England and Wales.
Question 4: Under UK GDPR, what is the maximum period that CCTV footage should typically be retained, as recommended by the ICO?
- 6 months
- 31 days, unless there is a specific reason to keep it longer (Correct answer)
- 1 year
- Indefinitely for security purposes
Correct answer: 31 days, unless there is a specific reason to keep it longer
The ICO's guidance recommends that CCTV footage is typically retained for no longer than 31 days unless there is a specific reason to retain it longer (e.g., it is needed as evidence). Longer retention requires justification under the UK GDPR data minimisation and storage limitation principles.
Question 5: The Information Commissioner's Office (ICO) is the UK's independent supervisory authority for data protection. What power does the ICO have if a CCTV operator commits a serious breach of UK GDPR?
- To issue guidance only — it cannot impose penalties
- To issue fines up to £17.5 million or 4% of global annual turnover (whichever is higher), issue enforcement notices, and prosecute for criminal offences (Correct answer)
- To revoke the operator's SIA licence
- To report the breach to the police only
Correct answer: To issue fines up to £17.5 million or 4% of global annual turnover (whichever is higher), issue enforcement notices, and prosecute for criminal offences
The ICO has extensive enforcement powers under the UK GDPR and DPA 2018, including fining organisations up to £17.5 million (or 4% of global annual turnover, whichever is higher), issuing enforcement notices requiring compliance, and prosecuting certain criminal offences under the DPA 2018.
Question 6: A member of the public requests a copy of CCTV footage that shows them under what right?
- The right to erasure
- The right of subject access under UK GDPR (a Subject Access Request) (Correct answer)
- The right to restriction of processing
- The Freedom of Information Act 2000
Correct answer: The right of subject access under UK GDPR (a Subject Access Request)
Under UK GDPR Article 15, individuals have the right of access to personal data held about them (a Subject Access Request — SAR). CCTV footage in which they are identifiable is their personal data, and they can request it. The response deadline is one calendar month.
SIA CCTV Legal Framework for CCTV 1
Which legislation is the primary law governing the processing of personal data (including CCTV images) in the UK?