Administration of justice
This condition is met if the processing is necessary for the administration of justice.
Legal claims
This condition is met if the processing-
is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings)…”
Section 42 contains requirements in respect of the “appropriate policy document” referred to in section 35(4) , that must be in place:
“ 42 Safeguards: sensitive processing (1) This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive processing in reliance on… a condition specified in Schedule 8). (2) The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which— (a) explains the controller's procedures for securing compliance with the data protection principles (see section 34(1) ) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and (b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained. (3) Where personal data is processed on the basis that an appropriate policy document is in place, the controller must during the relevant period— (a) retain the appropriate policy document, (b) review and (if appropriate) update it from time to time, and (c) make it available to the Commissioner, on request, without charge. (4) The record maintained by the controller under section 61(1) and, where the sensitive processing is carried out by a processor on behalf of the controller, the record maintained by the processor under section 61(3) must include the following information— (a) …which condition in Schedule 8 is relied on, (b) how the processing satisfies section 35 (lawfulness of processing), and (c) whether the personal data is retained and erased in accordance with the policies described in sub section (2 )(b) and, if it is not, the reasons for not following those policies. (5) In this section, “relevant period”, in relation to sensitive processing …in reliance on a condition specified in Schedule 8, means a period which— (a) begins when the controller starts to carry out the sensitive processing …in reliance on that condition, and (b) ends at the end of the period of 6 months beginning when the controller ceases to carry out the processing.”
Section 64 of the DPA 2018 provides:
“ Data protection impact assessment (1) Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a data protection impact assessment. (2) A data protection impact assessment is an assessment of the impact of the envisaged processing operations on the protection of personal data. (3) A data protection impact assessment must include the following— (a) a general description of the envisaged processing operations; (b) an assessment of the risks to the rights and freedoms of data subjects; (c) the measures envisaged to address those risks; (d) safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Part, taking into account the rights and legitimate interests of the data subjects and other persons concerned. (4) In deciding whether a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must take into account the nature, scope, context and purposes of the processing.”
Code and Guidance
Secretary of State's Surveillance Camera Code of Practice
The Surveillance Camera Code of Practice (“SC Code”) was issued by the Secretary of State in June 2013. There is a statutory obligation to have regard to that code when exercising any functions to which the code relates (see s.33 of the PFA 2012 above). The SC Code lays down a series of 12 “Guiding Principles” for the operators of surveillance camera systems. They are as follows:
“1. Use of a surveillance camera system must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need. 2. The use of a surveillance camera system must take into account its effect on individuals and their privacy, with regular reviews to ensure its use remains justified. 3. There must be as much transparency in the use of a surveillance camera system as possible, including a published contact point for access to information and complaints. 4. There must be clear responsibility and accountability for all surveillance camera system activities including images and information collected, held and used. 5. Clear rules, policies and procedures must be in place before a surveillance camera system is used, and these must be communicated to all who need to comply with them. 6. No more images and information should be stored than that which is strictly required for the stated purpose of a surveillance camera system, and such images and information should be deleted once their purposes have been discharged. 7. Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes. 8. Surveillance camera system operators should consider any approved operational, technical and competency standards relevant to a system and its purpose and work to meet and maintain those standards. 9. Surveillance camera system images and information should be subject to appropriate security measures to safeguard against unauthorised access and use. 10. There should be effective review and audit mechanisms to ensure legal requirements, policies and standards are complied with in practice, and regular reports should be published. 11. When the use of a surveillance camera system is in pursuit of a legitimate aim, and there is a pressing need for its use, it should then be used in the most effective way to support public safety and law enforcement with the aim of processing images and information of evidential value. 12. Any information used to support a surveillance camera system which compares against a reference database for matching purposes should be accurate and kept up to date.”
The SC Code concerns “conventional” CCTV systems, but specifically addresses the use of AFR as part of a surveillance camera system (see paragraph 3.2.3 below). The SC Code also covers the broader spectrum of statutory and procedural considerations which apply to surveillance camera operators, including Human Rights, Data Protection, Investigatory Powers and the forensic integrity of images.
Relevant paragraphs from the SC Code are as follows (with emphasis added):