CCTV Legal and Ethical Principles 5 — Questions and Answers
Question 1: When a CCTV operator discovers that the system has been hacked and footage is being accessed remotely by an unauthorized party, the first step should be:
- Continue monitoring to gather evidence about the hacker
- Immediately disconnect the system and notify management and IT security (Correct answer)
- Delete all footage to prevent further unauthorized access
- Change only the password and resume normal operations
Correct answer: Immediately disconnect the system and notify management and IT security
Immediately isolating the compromised system and notifying appropriate personnel is the correct first step to contain a cybersecurity breach of CCTV infrastructure.
Question 2: Under HIPAA, healthcare facilities that use CCTV must ensure that:
- Cameras are installed in all patient rooms for safety
- Footage capturing patient medical information is handled with appropriate safeguards (Correct answer)
- All footage must be reviewed by a licensed physician before storage
- CCTV systems must be approved by the Department of Health and Human Services
Correct answer: Footage capturing patient medical information is handled with appropriate safeguards
HIPAA requires that any footage capturing Protected Health Information (PHI), such as patients receiving treatment, must be handled with appropriate security safeguards.
Question 3: A CCTV operator is asked by a private investigator (PI) to share footage of a specific individual. Without a subpoena or court order, the operator should:
- Provide the footage if the PI shows valid credentials
- Decline to share footage and direct the PI to obtain proper legal authorization (Correct answer)
- Share the footage if the PI signs a non-disclosure agreement
- Provide footage only if the individual being investigated is suspected of a crime
Correct answer: Decline to share footage and direct the PI to obtain proper legal authorization
Without a subpoena, court order, or other valid legal process, releasing footage to a private investigator violates privacy obligations and potentially creates legal liability.
Question 4: The legal doctrine of 'negligent security' can arise in CCTV contexts when:
- A camera captures footage in low-light conditions
- A business fails to monitor or act on footage showing a foreseeable threat, resulting in harm (Correct answer)
- Security personnel take too long to review archived footage
- A camera system experiences technical downtime during business hours
Correct answer: A business fails to monitor or act on footage showing a foreseeable threat, resulting in harm
Negligent security liability can arise when a business had surveillance capability, observed or should have observed a threat, but failed to take reasonable action to prevent harm.
Question 5: Which of the following is the most appropriate way to handle a request from a media outlet for CCTV footage of a newsworthy incident?
- Provide all requested footage immediately to ensure press freedom
- Refer the media to the organization's legal counsel or designated spokesperson (Correct answer)
- Delete the requested footage to avoid media coverage
- Allow the media to view but not copy the footage on-site
Correct answer: Refer the media to the organization's legal counsel or designated spokesperson
Media requests for surveillance footage should be handled through proper legal and communications channels to ensure legal compliance and protect organizational interests.
Question 6: A CCTV system installed in a school must comply with which law that protects students' educational records and personally identifiable information?
- HIPAA (Health Insurance Portability and Accountability Act)
- FERPA (Family Educational Rights and Privacy Act) (Correct answer)
- COPPA (Children's Online Privacy Protection Act)
- ECPA (Electronic Communications Privacy Act)
Correct answer: FERPA (Family Educational Rights and Privacy Act)
FERPA protects the privacy of student education records, and schools must consider FERPA compliance when footage captures identifiable students in educational settings.
Question 7: When writing a CCTV usage policy, which element is most critical for establishing operator accountability?
- Specifying the brand and model of cameras to be used
- Defining clear, documented procedures for authorized access and use of footage (Correct answer)
- Listing the physical locations of all camera installations
- Describing the technical specifications of the recording system
Correct answer: Defining clear, documented procedures for authorized access and use of footage
Clear, documented access and usage procedures establish accountability by defining who can access footage, under what conditions, and for what purposes.
CCTV Legal and Ethical Principles 5
When a CCTV operator discovers that the system has been hacked and footage is being accessed remotely by an unauthorized party, the first step should be: