CCTV Systems – a cautionary tale
A GP Practice in our area recently had an issue with a CCTV system that they have kindly agreed I can reproduce here (anonymously of course and slightly simplified) as a warning to others out there who may just want to check their support contracts.
Some 6 years ago the practice had a modern CCTV system installed to cover the car park, entrance and waiting room. The system was linked to a stand-alone computer on site and at the time of installation was covered by a 5 year support contract.
When the support contract was due for renewal the practice did their sums and realised that they had never had to call the company for anything and decided not to renew it.
Recently the practice received a Subject Access Request from a patient asking for the images taken of him by the practice CCTV system during a visit to the premises. This is a legitimate request as the data comes under the Data Protection Act being “data from which an individual can be recognised”. However whilst the person requesting the data can be given or shown their data, they must not have access to other people’s data, that is anyone else who is potentially visible on the images. This is where you may have seen pixelated or blurred faces on news or police videos sometimes shown on TV.
At this point the practice realised they had an issue as without the support contract they had no way of doing the required action to pixelate or blur the faces of others on the video, a process that needs specialist software to complete. They contacted the requester to see if they would be satisfied with still images taken from the video clip which they could themselves generate but he was not prepared to accept this and requested the actual video. This has now led to the practice having to find a specialist company who can do this work and of course pay for it.
Some points to ponder then:
- If you have a CCTV system I’d suggest a review of it. What’s its purpose? Is it doing what you want it to do? When was the last time (if ever) that you needed to look at the images?
- Is it in the right place and are there appropriate warning signs? You must have signs visible, and you cannot operate a covert CCTV system.
- Is the system covered by a support contract that includes the work required if you get a Subject Access Request?