As you may be aware, the Information Commissioners Office is the UKs independent authority tasked with overseeing and enforcing the Data Protection Act 1998. The DPA covers the processing of personal data (i.e. data which relates to a living individual) within the UK. As discussed, CCTV images which relate to an individual constitute personal data and are therefore covered by the DPA. As Phantom Ltd (Phantom) is simply installing the cameras rather than actually operating them, Phantom is not the company which is responsible for compliance with the DPA. Instead, this falls on the operator of the cameras. In the case of a private individual who buys a camera for their own car, section 36 of the DPA is likely to apply. Section 36 provides an exemption from virtually all of the requirements of the DPA for any data processed by an individual for the purposes of their own personal, family or household affairs (including recreational purposes). In practical terms, this use of such a camera would be no different from an individual using a handheld camera inside their car. However, if a company such as a car hire company wishes to install the cameras on their cars, this would not fall within the domestic purposes exemption described above and the company would therefore have to ensure that any images collected were processed in compliance with the DPA. In particular, the company would have to ensure that:
- any individual driving a car fitted with a camera was aware of this and aware of how the data collected would be used;
- any third party individual involved in an accident recorded by the camera was made aware that they had been recorded and how their data would be used.