/ Smart Home

GDPR and home CCTV

Accross the streets of the UK there are CCTV cameras everywhere; councils have it installed on street lights and camera poles up and down our high streets, businesses have it installed throughout shops and offices, even leisure centres have it installed in gyms and swimming pools. Increasingly though you will see CCTV cameras installed on the front of homes in the suburbs recording the comings and goings of home owners and would be ne'er-do-wells prowling the suburban streets. The question is, how many of these home CCTV systems are legal? And what are the implications for not operating home CCTV legally?

Does CCTV prevent crime?

There is a lot of debate whether CCTV actually helps, would it prevent a criminal? Well some research conducted by Co-op Insurance and reported on by The Guardian suggests that absolutely yes. The majority of criminals are opportunistic roaming the streets looking for things they can steal quickly and easily. The Co-op surveyed criminals and they said that CCTV and barking dogs were the two most likely things to put them off and prompt them to look elswhere for easier targets.

Incidentally 11 of 12 criminals said they would be put off targeting a smart connected home. An intruder alarm was 13th on the list of things criminals said would put them off robbing a home.

So yes, CCTV does prevent crime it would seem.

Does GDPR apply to home CCTV?

Yes. Installation of CCTV at a home, just like in a business needs to be done in a way that is compliant with the law. The installation of any CCTV system is goverened by a number of pieces of legislation but the most relevant is the General Data Protection Regulations introduced throughout Europe on May 25th 2018. There are also some other bits and pieces you need to think about such as Human Rights laws relating to a right to privacy etc.

What do I need to do? Do I need to register with the ICO?

Complying with the law isn't difficult, but the key thing to know first of all is that under GDPR you now no longer need to register as a data controller with the ICO, so you've said some money there each year at least. There are some steps you should do to make sure you comply though.

  1. Do you actually need CCTV? The first thing to consider is whether CCTV actually solves a particular problem or concern, you need to have legitimate reason to need CCTV on your property. Crime prevention is a perfectly valid reason, just make sure that's why you want it, and it's not because you want to keep an eye on neighbourhood kids playing in the street, spying on children is not a good (or legal) reason.

  2. What sort of cameras are appropriate? It is unlikely that a pan/tilt/zoom dome camera mounted on the eaves of your house is appropriate as you probably only need to monitor your driveway and/or garden. A fixed field static camera is probably more than sufficient and will save you having trouble with the next point.

  3. Where are the cameras pointed? What will they see? It's important that you don't infringe the privacy of the people you record on your CCTV, you don't want to be recording people in the street if you can avoid it, and you certainly don't want to be recording people over the top of your garden fence in the privacy of their own gardens. Make sure your cameras are aimed in a way that meets your justification for CCTV from point 1, and nothing more. Some incidental recording of public spaces due to viewing angle etc is acceptable but if you can blur or mask the public areas, you ideally only want to record people on your property. Whilst you are deciding where to install the camera though, make sure it isn't so high up looking down that you can't see someones face, in the event you are robbed you're going to struggle to identify someone from the top of their head, so install out of reach looking at a shallow angle to see faces, not high up looking down.

  4. What will the cameras hear? Nothing! Make sure the cameras record nothing, many cameras are able to record audio but under the legislation it is questionable that you could ever justify the need to record private conversations of individuals, especially on the front of your property where you will likely record conversations of people on the public footpath walking past. To be safe, turn off the microphones.

  5. Make sure to display signage. It's important when operating CCTV that you inform people that you are recording and why you are recording. Your signs should be displayed at the points of entry to your property and the area being monitored and should include contact information and who is operating the CCTV system, the sign should also be an appropriate size, if it's intended to be read by pedestrians than A5 should be fine, from a vehicle it should be A4 or bigger really. A sign that just says "CCTV in operation" is not compliant. Here's a compliant sign on Amazon you could consider.

  1. Publish a CCTV policy. It sounds very official but you should have something resembling a policy around CCTV, what it's used for, and outlining the rights of those who are recorded by your CCTV. You can see the privacy policy used for my home at https://kieran.ie/cctv

  2. Talk to your neighbours! CCTV can be a source of consternation for some people, before installing anything it would be a good idea to discuss it with your neighbours, offer to show them what your system records. Be very upfront and honest with them and hopefully your CCTV won't become the reason for a dispute.

  3. How long do you need to record for? In all probability you do not need to keep recordings for years, if the purpose of the system is to detect crime then it's likely you would notice a crime within 30 days of it happening, likely much much sooner so set your retention period for recordings to something realistic. Anything beyond 30 days is hard to justify so it's best to make sure 30 days is your maximum.

What happens if I don't do anything and just install cameras without any of this legal nonsense?

Most likely nothing, it's highly unlikely any of your neighbours are going to notice or care, but if they do notice and care, particularly if you are recording them in their back gardens or in a public place, then the fines can be large. In 2015 a Scottish court awarded £17,000 in damages two one neighbour in a neighbour dispute over CCTV where CCTV had been installed monitoring the others garden including recording audio of conversations held there. This was awarded under the old Data Protection Act legislation, the new GDPR legislation is even stricter so it stands to reason the fines could be larger still.

The other thing to keep in mind is that presumbly your CCTV is installed to help in the unfortunate event that you are a victim of crime. If your CCTV is not legal and compliant then there is a chance that your CCTV footage may not be useful as evidence at all, which defeats the point somewhat.

What about video doorbells?

Video doorbells are an interesting case, by their very nature they are intended to record audio and video of someone visiting your house and due to their positioning on your front door will most likely record a public space.

They key with video doorbells is to do your best to comply, can it be installed in a way to not see the street and still serve it's purpose? Do you really need to record conversations with visitors or can you live with just real time access but no historical access?

I have a Ring doorbell that does point towards the street and does record. I have installed a Ring solar powered illuminated sign warning people of audio and video recording (in addition to normal CCTV signage) and I have made it clear in the CCTV policy that I link to on my CCTV signage that audio and video recording takes place when you interact with the doorbell.

In the case of Ring they are relucant to give options to set retention periods on their cloud recording subscripiton, I'm in discussions with their legal department to have this feature introduced as recording audio is pretty risky as it is, but retaining it for 60 days is in my opinion inexcusable within the confines of the GDPR legislation.

Final thoughts...

If you are worried about crime or your personal safety, or have been a victim of crime then absolutely install CCTV, that and buying a dog are likely the most effective things you can do to keep you safe in your home. But do it legally and properly so that your CCTV does what you intended it to do and you don't land yourself with a heavy fine or falling out with your neighbours.

My final tip is to ensure you have good quality CCTV. So many people buy a cheap WiFi camera from an unknown Chinese brand and smack it on the house. Make sure it's something that is a decent quality camera, no point having recordings if it's so low resolution you can't see anything identifiable of the criminal you caught in the act. As a price guide a good quality camera should cost you between £100-200 or so. Ideally go for a wired network camera as it can then use something called PoE so easier to install, and if you aren't sure speak to a professional.

Personally I recommend the Ubiquiti Networks UVC-G3 1080p camera and the Ubiquiti Networks NVR for a really great quality professional grade system that is fairly easy to install with free cloud access and local recording on the NVR, plus some nice mobile apps for local and remote access.

Important! This is not intended as legal advice, merely a helpful starter guide. You should consult a solicitor, data protection expert, professional CCTV installer, or the Information Commissioner's Office for advice before installing a CCTV system.