CCTV shared unlawfully

Background 
A retailer had installed CCTV to cover the public areas of their premises for security purposes (prevention and detection of crime). There was an incident at the premises involving a small number of individuals. A complaint was made to 
the ODPA about a member of the retailer’s staff recording the CCTV footage of the incident on their phone and then sharing it with a friend via social media. Following an investigation by the ODPA, the organisation was found to have 
breached aspects of the Law relating to the lawfulness and transparency of the processing.

Learning points
• Data which identifies individuals that is collected by an organisation using CCTV is covered by the data protection law. Organisations using CCTV must have policies and procedures covering how this information is handled. All staff must be aware of their responsibilities.
• CCTV, when used for crime prevention and detection purposes, can capture special category data relating to alleged criminal activity. Special category data is given extra protection under the Law, and as such there are stricter rules around how it must be handled. 
• The member of staff had no legal basis under the data protection law to share the footage, therefore the sharing was unlawful. 
• It is important that people understand how their data will be used. This is why controllers should use CCTV signage to tell people that cameras are in place and why. In this case, signs were up stating that CCTV was used for the purposes 
of prevention and detection of crime and use for other purposes was not expected or appropriate, leading to the finding by the ODPA.