Overview of Organisation
Maidstone Borough Council (MBC) is a council based in the southeast of the UK. It is the county town of Kent and has a population of approximately 170,000 people. The use of surveillance cameras by MBC is not new, and over the years, they have continually expanded their use of surveillance systems. This is common amongst councils, as surveillance cameras can be used for the purpose of preventing and detecting crime.
The purpose of the project was to identify which sites had surveillance systems in place, who was responsible (the data controller) for each system and provide an assessment of each site’s compliance to data protection laws. In addition to supporting the overall organisation with their compliance requirements, DPAS developed the relevant accountability documentation which would ensure they complied with the legislation.
Problem
Our client owns and is responsible for multiple sites to provide services to their residents and visitors. These services include waste management, housing services, parking, council owned vehicles, street care and cleaning, burials and cremations, and more. However, over the years, our client has outsourced the management aspects of several of its sites to external service providers, such as building management companies. This has added to their compliance responsibility, as they needed to understand who was liable for each site’s surveillance system, to comply with Principle 4 of the Surveillance Camera Commissioner (SCC) Code of Practice. With advances in technology over time, this has lead to the expansion of the type of surveillance systems in use in and around the client’s sites, such as body-worn video devices (BWVs), automatic number place recognition (ANPR), stand-alone, and re-deployable cameras.
Councils typically collect and process data on a large scale, due to the nature of their activities. As such, this puts a greater responsibility on them to ensure compliance and minimise the risk of such processing to data subjects and also the councils themselves. Developments in the law and changes to codes of practices, puts an additional burden on councils to constantly address the ever-changing compliance requirements.
A shortage of resources is often a common theme the public sector is facing. DPAS were approached by MBC to provide that additional resource capability and skills transfer, with the goal being not just to facilitate compliance via the current project, but also to empower the council’s staff to implement procedures that would ensure ongoing compliance.
Outcome
DPAS emphasised that compliance with data protection legislation and the Surveillance Camera Code of Practice goes beyond the initial installation of a surveillance camera system, which drove our approach.
Our approach was built on the four steps to ensure compliance. Step 1: installation, step 2: management, including training, step 3: operation, step 4: public awareness and signage.
Each service area was sent a short survey in advance of holding virtual meetings, so as to reduce disruption to the organisation. In each meeting, DPAS were provided with the opportunity to identify current processes and procedures, in order to complete a Data Protection Impact Assessment (DPIA). After this followed the completion of additional policies and procedures, retention schedules, data disclosure forms, a completed version of the surveillance camera self-assessment form, and an end of project report, detailing all of the findings.
By instructing DPAS to address its use of surveillance cameras, MBC was able to further expand its resource capability. DPAS was able to provide specialist expertise around the use of surveillance cameras, bringing together knowledge on various pieces of legislation as well as the practical implications of using both overt and covert surveillance. Our client was able to use the accountability documentation and end-of-project report within board meetings to demonstrate their organisation’s commitment to the importance of data protection and individuals’ rights.
Our knowledge on this subject matter area can provide your organisation with peace of mind. Knowing that your surveillance operations not only comply with the law, but that you are in a stronger position going forward, to tackle these issues yourself. We can support your staff with further training, from both a practical and privacy perspective, to ensure you are safely operating surveillance camera systems.
