As the popularity of CCTV and Ring doorbells continues to increase, it is important for managing agents and leaseholders to understand the legal responsibilities associated with installing them. Depending on the location and coverage of the cameras, the installation may need to comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA). Failure to do so could lead to serious consequences, which may include regulatory action from the Information Commissioner’s Office (ICO).
Below are the key details to be considered when installing systems to record either your private property or communal and external areas.
Installing CCTV/Ring Systems in Communal Areas or on the Exterior of flats
If you are looking to install a system on the outside of a block or in a communal area, GDPR and DPA regulations will apply and below are the key requirements you need to consider:
- Register as a Data Controller: You will need to register with the ICO as a data controller, which involves an annual fee of £35.
- Data Processing Compliance: Under the UK GDPR and DPA 2018, any personal data you process must be:
- Adequate: Sufficient to fulfill the intended purpose.
- Relevant: Directly related to that purpose.
- Limited: Only holding as much data as necessary for the purpose.
- Data Retention: There is no specific amount of time CCTV footage can be retained for. However, the retention period should be determined based upon the purpose of footage being processed. For example, footage intended for crime prevention may be kept for a longer period of time. Regular deletion of recordings is recommended to remain compliant.
- Informing Residents: The ICO advises that you must inform all leaseholders that CCTV is in operation. This can be done by putting up signs around the building to notify people that they are being recorded and explaining the reasons for the surveillance.
- Responding to Subject Access Requests: CCTV data is subject to access requests. If you receive a request, you must provide a copy of the relevant footage within one month. Additionally, if an individual asks for their footage to be deleted, you must do so within a month unless there’s a valid reason for retaining it, such as a police investigation.
Installing CCTV/ Ring Systems for Personal Use
If you’re a leaseholder considering installing a CCTV or Ring system for your flat, it’s important to understand when GDPR and DPA regulations may apply to you. If your cameras only capture images within the boundary of your private property, you are generally exempt from these regulations. However, if your CCTV captures images outside of your property boundary, such as communal areas or public spaces, GDPR and DPA regulations come into play.
Additionally, as a leaseholder, you must adhere to the terms of your lease when installing any surveillance equipment. This could mean obtaining consent from the freeholder or managing agent before installation. Therefore we highly recommend reviewing your lease or having an expert do so on your behalf before proceeding.
Consequences of Non-compliance
Failure to comply with these regulations can result in enforcement action by the ICO. Enforcement could include fines or legal proceedings, which highlights the importance of ensuring you’re compliant with the GDRP and DPA regulations.
If you understand and abide by these guidelines, managing agents and leaseholders can improve the security of the property without any concerns in relation to enforcement action.
