SIA CCTV Legal Framework for CCTV

Question 1

Which legislation is the primary law governing the processing of personal data (including CCTV images) in the UK?

Accepted Answer

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018

Answer

CCTV images are personal data. The UK GDPR (retained from EU GDPR post-Brexit) and the Data Protection Act 2018 together govern the lawful processing of personal data, including CCTV footage, in the UK.

Question 2

Under UK data protection law, which of the following is a lawful basis for processing CCTV footage?

Accepted Answer

Legitimate interests of the controller or a third party, where not overridden by individuals' rights

Answer

Under UK GDPR Article 6, one lawful basis for processing is 'legitimate interests' — where the processing is necessary for legitimate purposes (e.g., crime prevention, safety), and those interests are not overridden by data subjects' rights and freedoms.

Question 3

What document provides authoritative guidance on the lawful and responsible use of surveillance camera systems in public places in England and Wales?

Accepted Answer

The Surveillance Camera Code of Practice (issued under the Protection of Freedoms Act 2012)

Answer

The Surveillance Camera Code of Practice, issued by the Home Office under the Protection of Freedoms Act 2012, provides authoritative guidance on the responsible and effective use of surveillance camera systems by relevant authorities in England and Wales.

Question 4

Under UK GDPR, what is the maximum period that CCTV footage should typically be retained, as recommended by the ICO?

Accepted Answer

31 days, unless there is a specific reason to keep it longer

Answer

The ICO's guidance recommends that CCTV footage is typically retained for no longer than 31 days unless there is a specific reason to retain it longer (e.g., it is needed as evidence). Longer retention requires justification under the UK GDPR data minimisation and storage limitation principles.

Question 5

The Information Commissioner's Office (ICO) is the UK's independent supervisory authority for data protection. What power does the ICO have if a CCTV operator commits a serious breach of UK GDPR?

Accepted Answer

To issue fines up to £17.5 million or 4% of global annual turnover (whichever is higher), issue enforcement notices, and prosecute for criminal offences

Answer

The ICO has extensive enforcement powers under the UK GDPR and DPA 2018, including fining organisations up to £17.5 million (or 4% of global annual turnover, whichever is higher), issuing enforcement notices requiring compliance, and prosecuting certain criminal offences under the DPA 2018.

SIA CCTV Operator Practice Test

SIA CCTV Operator Practice Test

SIA CCTV Legal Framework for CCTV