Human Rights and CCTV

When you're talking CCTV, only public authorities have to comply with the rules laid down by the Human Rights Act. Some of those public authorities will be quite obvious, including police services and Borough Councils. However, some private organisations perform a public function, and that's where matters start to become a little hazy... It is questionable as to whether they would fall within the category of a public authority, and thus have to comply with the Act.

Should an organisation that is not a public authority use CCTV images as evidence in a Court of Law or perhaps in a tribunal, they must be aware that the Court of Law and/or the tribunal represent a public authority and would take into account any breaches of Human Rights. Therefore, it would appear sensible that any CCTV system in operation is compliant with the Human Rights Act in the event that the images in question eventually find their way into the domain of a public authority.

The two Articles of the Human Rights legislation that most concern CCTV managers are Article 6 and Article 8. Let's examine each.

Focusing on Article 6

A number of police services are of the opinion that, if CCTV images are captured and the organisation responsible for that capture has neglected to notify the Information Commissioner they are processing personal data, then those images will be inadmissible as evidence in a Court of Law. The argument is that this would represent unlawful processing. Thus, it would be an unfair trial and a certain breach of Article 6 (which concentrates on the individual's right to a fair trial).

This suggestion was set before the Lord Chancellor's Office (as it used to be known). The Lord Chancellor's opinion was as follows: "It is up to the Judge and the barristers on either side to agree on whether or not evidence is admissible, the final decision resting with the Judge. Not to notify the Information Commissioner that you are processing personal data when required to do so is a minor offence. It is unlikely that the Judge would not allow the evidence if it affected the overall fairness of the case."

Human Rights and Article 8

Article 8 of the Human Rights Act states that everyone has the right to respect for his or her private and family life, their home and their correspondence. The European Court is quite clear that persons have a degree of expectation to privacy, even in public places like High Streets and bus stations. However, an organisation also has rights and is fully entitled to protect its property. That being the case, a balance needs to be struck between the rights of the organisation and the individual. An organisation with CCTV cameras viewing its perimeter fencing must ensure that it only captures images relevant to the protection of its own perimeter zones.

Seen in this light, they could well face an issue if their cameras capture images of individuals entering a medical centre across the road from the host organisation. Not only could this be a breach of Data Protection (in terms of being seen as excessive processing), but it may also be deemed an unnecessary intrusion on the privacy of an individual. As such, if the situation was taken into a Court of Law, it could be viewed as a breach of Article 8.

Covert video surveillance

The previous Information Commissioner went on record as stating that under no circumstances should covert video surveillance be undertaken without the involvement of the police. Current Commissioner Richard Thomas, though, has adopted a far more pragmatic view of the world.

An organisation has the right to defend itself, but while doing so must always show respect for an individual's privacy. It's advisable that, before authorising the covert video surveillance of an individual, less obtrusive methods of obtaining the desired information are applied. Covert video should really be the last method of surveillance that's considered by the CCTV manager. It should only be authorised by a senior member of staff, and then only after the thorough preparation of an impact assessment.

There is some case law that has dealt with the issue of covert surveillance. For example, in the case involving McGowan versus The Scottish Water Board, the latter employed private investigators to place under surveillance one of its employees whom the company suspected of submitting false timesheets. The investigators conducted a very thorough analysis, and were able to establish the exact times the subject left his home over a period of one week. Those times did not tie-in with his timesheets.

The employee was disciplined, and took the case to tribunal. The Judge ruled that the surveillance wasn't, in fact, disproportionate to the matter being investigated.

Justification for surveillance

Apart from being yet another case reinforcing the right of surveillance in civil matters, that involving McGowan versus The Scottish Water Board raises a number of salient points.

For one, the Scottish Water Board was able to demonstrate that it had given careful consideration to conducting surveillance. It had, in fact, carried out its own impact assessment. Having eliminated other methods of investigation, the surveillance regime could then be justified.

A number of police services are of the opinion that, if CCTV images are captured and the organisation responsible for that capture has neglected to notify the Information Commissioner they are processing personal data, then those images will be inadmissible as evidence in a Court of Law

As a result of procedures carried out by the Board, it was successful in withstanding a challenge from the individual that this was a breach of his Human Rights under Article 8.

What this means for CCTV managers is that they cannot immediately subject someone to surveillance during an investigation. In addition, they must run through less intrusive methods until such time as surveillance becomes the last resort.

Although the evidence obtained from covert video can be admissible in a Court of Law, it does have to be judged on a case-by-case basis. Therefore, it's advisable to log all of the steps you take - and details of the considerations you had to deal with - prior to authorising covert videoing. Ensure that, if you should decide to outsource the surveillance function, the organisation you choose is fully-cognisant of the privacy laws, that you have instructed them in accordance with the Data Protection Act and that the agency is not going to use the images rendered for any other purpose.

CCTV: contractual agreements

It should always be understood that when a company invites you to submit a tender, this is not part of the contractual agreement. This is referred to as ‘an invitation to treat'. It simply means that they are inviting you to make an offer to them for the work on the basis of the specifications they've already supplied to you.

When you have submitted your proposal, it does not stop them from altering their specifications. As a result of the tender submitted by yourself and other rival companies, they may well need to review their own requirements. It is highly likely, too, that further discussions may follow before final contractual terms are ratified.

Under UK law, a contract is required to have four clauses: offer, acceptance, consideration and to be legally binding. For its part, the offer must be clear and unambiguous (‘Could you maintain our CCTV system?', for example). Is that a clear offer, or merely a request for information? In a contract, once that clause has been sorted out, it would appear as something like: ‘ABC Ltd will maintain the CCTV system of XYZ Ltd as per the following specifications...'

In a similar vein, the acceptance will also need to be clear and unambiguous. For example: ‘We will maintain your system, but by using three members of personnel instead of the two you suggested'. That is more likely to be construed as a counter offer to your offer rather than an acceptance. The ball is now firmly back in the court of the original individual(s) making the offer for acceptance or rejection, or indeed a further counter offer.

Consideration means that something of value must be exchanged between the individual(s) making the offer and the person (or persons) being offered the deal, once a clear and unambiguous offer and a clear and unambiguous acceptance has been established. Consideration does not have to be money. It could be the competition of another service. For example: ‘To provide cover for your CCTV system, you will also provide a security guarding service to patrol the perimeter areas'.

Legally binding agreement

It should be clear that both parties intend for this contract to be legally binding within a mutually agreeable jurisdiction. For instance, if the supplier of the surveillance service is based in the USA and the client is in the UK, they would need to agree between them whether it was American contract law or UK law that had ultimate jurisdiction.

As you can see, a contract can become somewhat complicated. One side could make an offer to the other with a time limit on it (such as: ‘This offer is open to acceptance until 1 August'). If it is accepted on 2 August, it would seem that the contract is not in place.

However, if the written acceptance was sent on 30 July, and did not arrive until 2 August, could it be deemed that its contents were accepted on 30 July and, therefore, that the contract is in place? The term: ‘This contract is open to acceptance up to 1 August' - does that mean you can accept it on 1 August, or is it only up until midnight on 31 July?

If the supplier of the equipment is from the USA, the user of that equipment is in the UK and the maintenance teams are in Germany, which contractual jurisdiction is in force?

The complexity is not over. If part of the CCTV contract involves the capturing of images, then that is the processing of personal data and, as such, you are caught within the Data Protection Act 1998. Speaking of which...

The Data Protection Act has now added to UK contract law a fifth clause. This clause creates the legal relationship of Data Controller (the company that has decided to capture images) and Data Processor (the organisation that is capturing those images on behalf of the Data Controller). Failure to include this clause could lead to the processing of the images being challenged in a Court of Law.

Always remember that the responsibility falls upon the security and/or CCTV manager to ensure that any Data Processor employed is competent and fully-compliant with the Data Protection Act. Failure to do so could have serious consequences for your company.