As you may be aware, the Information CommissionerÃÂÃÂÃÂÃÂs Office is the UKÃÂÃÂÃÂÃÂs independent authority tasked with overseeing and enforcing the Data Protection Act 1998 (the ÃÂÃÂÃÂÃÂDPAÃÂÃÂÃÂÃÂ). The DPA covers the processing of personal data (i.e. data which relates to a living individual) within the UK.
As discussed, CCTV images which relate to an individual constitute personal data and are therefore covered by the DPA. As Phantom Ltd (ÃÂÃÂÃÂÃÂPhantomÃÂÃÂÃÂÃÂ) is simply installing the cameras rather than actually operating them, Phantom is not the company which is responsible for compliance with the DPA. Instead, this falls on the operator of the cameras.
In the case of a private individual who buys a camera for their own car, section 36 of the DPA is likely to apply. Section 36 provides an exemption from virtually all of the requirements of the DPA for any data processed by an individual for the purposes of their own personal, family or household affairs (including recreational purposes). In practical terms, this use of such a camera would be no different from an individual using a handheld camera inside their car.
However, if a company such as a car hire company wishes to install the cameras on their cars, this would not fall within the ÃÂÃÂÃÂÃÂdomestic purposesÃÂÃÂÃÂÃÂ exemption described above and the company would therefore have to ensure that any images collected were processed in compliance with the DPA. In particular, the company would have to ensure that:
- any individual driving a car fitted with a camera was aware of this and aware of how the data collected would be used;
- any third party individual involved in an accident recorded by the camera was made aware that they had been recorded and how their data would be used.
In both cases, individuals may have a right to copies of the data collected in relation to them. A company using cameras for this purpose would also have to ensure that it complied with the other principles of the DPA. These include ensuring that the data collected is adequate, relevant and not excessive, ensuring that the data is not kept for any longer than is necessary, ensuring that the data was only used for limited, stated purposes and ensuring that it was stored and disposed of securely. I would again reiterate, however, that the responsibility to comply with the DPA with regards to any images captured by cameras installed by Phantom lies with the operator of the cameras, rather than Phantom as the company that physically installs them.