The use of smart security devices and domestic CCTV systems is becoming increasingly common. If you use security cameras and similar devices in your home, data protection law may apply and it’s important to know your legal obligations.

Does data protection law apply?

Provided that you’re only capturing images within the boundaries of your private domestic property and garden, data protection law will not apply. If, however, your device is positioned such that it also captures a neighbour’s property, a communal area, or a public space (such as the pavement outside your home), then you will be subject to data protection law including the UK’s General Data Protection Regulation and Data Protection Act 2018.

You are not necessarily breaking the law by capturing images beyond your private boundary, but you will need to make sure that you are complying with certain legal obligations. You may otherwise be fined or subject to legal action by an affected individual.

How do I comply?

Any infringement of others’ rights to privacy (ie by recording them in public) must not be excessive; you must therefore consider carefully whether you actually need to capture images beyond the boundaries of your property. For example, could you angle the device so that it only covers your own private land?

Both from a legal and from a community-minded perspective, it is also important to be open and transparent with your neighbours. You must put up a clear and visible sign telling others you’re using security cameras to record public space. As an additional security deterrent, you may also choose to put up a notice even if you are only recording within your private property!

Take care that you do not capture more footage than is necessary and that it is deleted regularly to ensure it isn’t kept for any longer than needed to achieve your aims. Consider how to minimise the impact on other people’s privacy, for example, do you need to record constantly, or could the camera operate on a motion sensor? Would a series of still images alone suffice or do you need to capture all movements and sounds as well? Do you actually need to store the captured images/footage, or would a live feed fulfil your purposes?

You must also ensure that your footage is used only for the purpose for which the camera was originally installed, such as maintaining the security of your property. There might be limited circumstances where you would legally be permitted to use it for another legitimate purpose, but, for example, this is probably never going to include sharing or publishing your recordings/images of third parties online.

The Information Commissioner’s Office (ICO) may ask to see a record of why and how you’re capturing these images, and the length of time for which you’re keeping them, so it might help to document what you are doing and setting out your reasoning from the outset.

However, if you choose to operate your security system, make sure that you keep footage secure and ensure it can’t be misused by third parties.

Rights of affected individuals

You should also be aware of the following rights of affected individuals.

Individuals whose movements are captured in public spaces by your cameras are legally entitled ask to see what personal data you hold on them, which includes any identifiable images, and how you use it. This is known as a data subject access request, and you must respond within one month. However, depending on how regularly your footage is deleted, and assuming that you receive such a request while the footage is still in your possession, you should take care to respond as soon as possible before it is due for erasure.

You may also be asked to delete any footage you have of someone, or not to capture any footage of them at all, to the extent that this is possible, for example by changing the angle of your cameras to focus them away from a particular neighbour’s home.

Guidance recognises it may not always be possible to comply. Nevertheless, it’s key to show that you’ve considered your neighbours’ concerns, perhaps by inviting them to view any footage you do hold and being transparent about why you feel you need cameras trained on public space, what you are recording, how you use and store the footage, and how long you keep everything for.

A recent cautionary tale

The recent court decision of Fairhurst v Woodard concerned legal actions brought by Dr Fairhurst for harassment, nuisance, and breach of her data protection rights against her neighbour, Mr Woodard. Mr Woodard had installed several security cameras around his property, including Amazon’s ‘ring’ video doorbell which picked up audio and video footage beyond the boundaries of his property, a camera mounted on his shed overlooking a communal carpark which sent footage straight to his smartphone and a camera overlooking a shared driveway which led to the communal carpark.

Dr Fairhurst’s claims for harassment and breach of data protections rights were successful, and she was awarded £100,000 in damages. While the court’s ruling seemed to give primacy to individuals’ rights under data protection laws and attracted a lot of attention, the real lessons for users of home security systems arguably lie in the judge’s assessment of the Mr Woodard’s behaviour.

As an example, the judge found that Mr Woodard could have chosen to secure his property in a far less invasive way. His aim – maintaining the security of his property – did not justify wide-ranging recording extending beyond the boundaries of that property. The ring doorbell captured Dr Fairhurst’s house and garden, and the shed camera covered almost all of her garden as well as her parking space. The ring doorbell’s extensive audio recording capability was found by the court to be particularly excessive.

Mr Woodard was also held to have misled Dr Fairhurst regarding the scope and functionality of the cameras and to have targeted Dr Fairhurst personally in what amounted to harassment – for example, by sending her images of herself taken by the camera and threatening to put up concealed cameras on his property.

The case highlights how important it is to be transparent with those whose images you capture outside the boundaries of your own home, and to respect their rights. When complying with your legal duties, you must be able to show that your use of CCTV does not disproportionately infringe on their rights to privacy.

Further guidance

Recent guidance on the use of private domestic CCTV has been published by the ICO on its website and GOV.UK has also set out a list of general considerations to help you reduce the risk of your CCTV system intruding on the privacy of others.

Collyer Bristow’s data privacy team is available to advise on all aspects of data protection law, including the use of CCTV. If you need any further help on these matters, please contact Mette: mettemarie.kennedy@collyerbristow.com