Just for the record

The Data Protection Act 1998 regulates the use and management of "personal data". The deadline for compliance with provisions under the Act requiring notification to the information commissioner is October 23 2001.

What is personal data?​

Personal data is any information which relates to a living individual who can be identified by that information, including their name and address. Any individual or company who processes any such data must appoint a "data controller" who is responsible for the purpose and manner in which the material is processed.

What effect does the Act have on CCTV systems?​

The Act covers the use and management of CCTV systems that record camera output and will, therefore, have implications for those owning and/or managing such systems in respect of licensed premises.

Who is the information commissioner?​

The Government has created the role of "information commissioner" who must be notified by October 23 2001 of all CCTV systems in operation. The information commissioner must also be notified of any systems, which were previously registered under the Data Protection Act 1984, before the expiry date of that previous registration. Failure to comply with the Act is an offence and will result in a fine.

How do I comply?​

You can complete the notification form online. The Government website is at www.dataprotection.gov.uk. You will be required to give details of the "owner" of the system and the purpose for which it is used. The annual fee for notification is £35. Instructions are available on the website along with further details of the legislation and how to comply. Alternatively, you can call the notification helpline on 01625 545745 and a form will be sent to you.

Dealing with personal data​

The information must be dealt with "fairly and lawfully". People should be notified of the existence of CCTV cameras by signs which should be placed around the area where the cameras are located identifying the owner/operator of the system and giving a contact point or telephone number.

Data must be "adequate, relevant and not excessive."

For example, cameras placed outside a premises to record incidents of public disorder should not, where possible, overlook private residences.

Data must be accurate and up to date. To this end, efforts must be made in the use of CCTV to ensure clarity of image, good quality tapes must be used, tapes should be cleaned prior to re-use and replaced regularly to avoid over-use.

How long must I keep the data?​

It is recommended that data is not retained for any longer than 31 days. However, there may be good reason to keep tapes longer than this, for example if an incident resulting in a police investigation has been recorded.

What rights of access does the public have?​

Individual members of the public have the right to access the data records held by a data controller in relation to themselves. Written requests regarding data held by the controller must be submitted together with a fee.

Security​

Unauthorised access to the tapes must be avoided by the implementation of appropriate security measures.

What offences can be committed?​

• Failure to notify the information commissioner that you are processing personal data.
• Failure to notify the commissioner of any changes in your circumstances, for example, the appointment of a new data controller.
• Failure to comply with requests for information from "data subjects" or to deal with data in the manner outlined above.

What are the penalties?​

A fine in the magistrates court up to a maximum of £5,000. Alternatively, an unlimited fine in the crown court.

What about collection of data through other means?​

There are various other ways in which data might be processed in the day to day running of licensed premises. Examples are as follows:

• details of customers making restaurant bookings
• details of function room bookings
• customers taking part in competitions, promotions or quizzes
• employee records and information.

However, under the Act, certain types of activities are exempt from the requirement to notify the information commissioner and the above examples are unlikely to require notification.

Need to know more?​

If you are unsure as to whether a specific activity constitutes processing data and/or whether the information commissioner should be notified, further information as to which activities fall under the Act is available on the following website www.dataprotection.gov.uk