Overlooked - Liberty

38 Overlooked: Surveillance and personal privacy in modern Britain
adapting, transferring and viewing of images were all considered to be covered when the DPA was
introduced, and the Principles became the foundation of a code of practice for CCTV, devised by
the ICO 74 .
Most important is the requirement for fair and lawful processing; this requires that data be processed
for limited purposes and not in a manner incompatible with those purposes. This principle is behind
requirements for signage and a range of control room practices in public visual surveillance systems.
The processor of images (whether the public body itself or a security company contractor) is
responsible for ensuring that processing is carried out lawfully. Where it has grounds, the ICO can
serve a notice asking a data controller for information on its practices, and in extreme cases can
obtain a warrant for inspection and take enforcement action.
Durant v Financial Services Authority
Data protection legislation was not originally envisaged as covering camera operated visual
surveillance, and before 1998 a conceptual stretch was made to demonstrate that it covered video
recording. The emergence of digital methods, and changes in the law following the implementation
of the European Directive 75 , have meant that visual surveillance is becoming a more natural fit
within the data protection regime, although a recent decision of the Court of Appeal 76 has rather
curtailed this more positive trend. The issue in this case arose over the need to show the relevance
of retained data, in order to make a successful application for access to records. In order for the
data protection legislation to apply, information must comply with the definition of ‘personal data’
in the DPA.
The Appeal Court refused Mr Durant access to certain records in the Financial Services Authority’s
(FSA’s) filing system connected with a complaint he had made against Barclay’s Bank, on the
grounds that it did not qualify as personal data. In order to count as ‘personal data’, and so be
covered by the DPA, it must be information that affected his privacy, whether in his personal or family
life, business or professional capacity. Mr Durant had not been able to show that the information
was close enough to this standard. The tests should be, whether information was biographical in a
significant sense, and whether the individual was the focus of the information on file. As a result of
the Durant case, whether any particular piece of information is covered by the DPA, will depend on
where it falls along a continuum of circumstances in which an individual might have been involved
to a greater or lesser degree. The implications of the Court’s decision for visual surveillance are
particularly complex, and are still being considered.
The key question must be; how far does the scenario outlined by the court limit the degree to which
data protection bites on the use of visual surveillance technologies
The Information Commissioner’s initial assessment was that this would depend on the use and
capacity of the system. A Good Practice Note, issued in February 2004, distinguished between
focusing cameras or examining recorded images looking for particular people or examining the
74
CCTV Code of Practice, Information Commissioner, 2000.
75
Directive 95/46/EC (OJ 1995 L281/31), on the protection of individuals with regard to the processing of
personal data and on the free movement of such data led to the Data Protection Act 1998.
76
Durant v Financial Services Authority [2004] F.S.R 28, CA.