Principle 2 is that personal data may be obtained only for lawful purposes and may not be further “processed” in a manner incompatible with those purposes.
Principle 3 is that the data must be “adequate, relevant and not excessive” for the relevant purpose.
Principle 4 is that data shall be accurate and, where necessary, kept up to date.
Principle 5 is that the data may not be kept for longer than is necessary for those purposes.
Principle 6 is that personal data shall be processed in accordance with the rights of data subjects under this Act .
Principle 7 is that proper and proportionate technical and organisational measures must be taken against the unauthorised or unlawful “processing” of the data.
Principle 8 is that personal data shall not be transferred outside the European Economic Area unless the country ensures an adequate level of protection.
Schedule 2 included the following conditions:
“1. The data subject has given his consent to the processing. … 5. The processing is necessary— (a) for the administration of justice, (b) for the exercise of any functions conferred on any person by or under any enactment, (c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or (d) for the exercise of any other functions of a public nature exercised in the public interest by any person.”
The DPA 1998 did not contain any definition of biometric data; nor was such data included within the definition of sensitive personal data within section 2 of the DPA 1998 .
Protection of Freedoms Act 2012 (" PFA 2012 ")
Chapter I of Part 2 of the PFA 2012 makes provision for the “Regulation of CCTV and Other Surveillance Camera Technology”. The relevant provisions of the PFA 2012 relate to the overt use of “surveillance camera systems” in public places by “relevant authorities” in England and Wales.
Section 29(1) mandates the Secretary of State to prepare a code of practice containing guidance about surveillance camera systems. Section 29(5) requires consultation with the National Police Chief's Council, the Information Commissioner, the Investigatory Powers Commissioner, the Surveillance Camera Commissioner, the Welsh Ministers and other persons the Secretary of State considers appropriate.
Section 29(6) provides that a surveillance camera system means:
“(a) closed circuit television or automatic number plate recognition systems, (b) any other systems for recording or viewing visual images for surveillance purposes, (c) any systems for storing, receiving, transmitting, processing or checking images or information obtained by systems falling within paragraph (a) or (b), or (d) any other systems associated with, or otherwise connected with, systems falling within paragraph (a), (b) or (c). ” (emphasis added)
A surveillance camera system which makes use of AFR therefore falls within this definition and is addressed within the Surveillance Camera Code of Practice.
Section 30 provides that the Secretary of State must lay the code of practice and order providing for the code to come into force before Parliament, and that such an order is to be a statutory instrument.
Section 31 provides that the Secretary of State must keep the code under review and may alter or replace it.
Section 33 requires “relevant authorities” (which includes a chief officer of a police force) to have regard to the code of practice when exercising any functions to which it relates.
Section 33 further sets out the responsibility of a relevant authority as follows:
“(1) A relevant authority must have regard to the surveillance camera code when exercising any functions to which the code relates. (2) A failure on the part of any person to act in accordance with any provision of the surveillance camera code does not of itself make that person liable to criminal or civil proceedings. (3) The surveillance camera code is admissible in evidence in any such proceedings. (4) A court or tribunal may, in particular, take into account a failure by a relevant authority to have regard to the surveillance camera code in determining a question in any such proceedings.” (emphasis added)
Section 33(5) provides the list of “relevant authorities” for the purposes of this part of the Act . Section 33(5) (j) sets out the inclusion of any chief officer of a police force in England and Wales. The Chief Constable of South Wales Police is therefore a relevant authority for the purposes of this Act .
Section 34 provides for the appointment of a Surveillance Camera Commissioner by the Secretary of State. The Surveillance Camera Commissioner is an arms-length body funded by, but independent of, the Home Office. His role is, inter alia , to ensure public confidence in surveillance systems. Section 34 provides that the Commissioner's functions include:
“(a) Encouraging compliance with the surveillance camera code; (b) Reviewing the operation of the code; and (c) Providing advice about the code (including changes to it or breaches of it).”
17. The Secretary of State issued and published a code of practice pursuant to ss.30 and 32 of the PFA 2012 in June 2013 as the Surveillance Camera Code of Practice (see further below).
Data Protection Act 2018 (“DPA 2018”)