Ireland – Irish Data Protection Commissioner issues guidance note on the use of body worn cameras
Published 1 February 2016
What does this cover?
The use of Body Worn Cameras (BWCs) has increased dramatically over the past few years. The Office of the Data Protection Commissioner (the ODPC) recognises that the use of BWCs, which by their very nature are mobile, presents difficulties from a data protection and privacy perspective as they can lead to inadvertent recordings capturing personal data. In its most recent guidance issued on 22 December 2015 (Guidance Note), the ODPC has indicated that it has serious concerns about the proportionality and justification of using BWCs. Operators must therefore use BWCs cautiously and ensure that they process personal information in accordance with the Data Protection Acts 1988 and 2003 (the Acts).
In order to ensure compliance with the Acts, the ODPC expects data controllers to carry out detailed assessments which should demonstrate that the use of BWCs is justified, proportionate, reasonable and transparent. These assessments should seek to balance the use of BWCs against an individual's fundamental right to privacy and data protection. Under no circumstances should recordings be used to monitor staff in their general duties.
According to the ODPC, BWCs should only be used in extreme cases and in response to specific pre-defined criteria where the use can be justified for security and/or safety purposes. Furthermore, the ODPC will not accept the use of audio recording equipment is in any way justifiable or warranted for any purpose, even where members of the public or staff are aware that their voices are being recorded. Operators of BWCs must therefore ensure that audio and video recordings are not automatically instigated in tandem.
Users of BWCs must also do as much as possible to make members of the public aware that recordings are taking place by: (i) using conspicuous signage in the area in which the BWC is in operation; (ii) ensuring that the operator of a BWC is visually identifiable; and (iii) announcing to data subjects that video recording is taking place using a BWC. Additionally, recordings should only commence at the start of an incident and should terminate once the incident is concluded.
The Guidance Note sets out several practical steps for operators of BWCs to ensure they are acting in compliance with the Acts:
- Carry out the required assessments including a risk assessment and a privacy impact assessment prior to using BWCs;
- Put a written BWC usage policy in place to include reference to the collection, processing, retention and security of personal data being processed;
- Review BWCs to ensure that they are equipped with the material necessary to achieve the purposes for which it was intended (i.e. microphones should be disabled);
- Have robust access controls so only authorised persons can access images;
- Explore the possibility of built in mechanisms that automatically blur faces when they are inadvertently filmed during data collection;
- Use a software programme that automatically deletes the data collected once the task is completed;
- Ensure that an appropriate contract is in place with any third party security providers;
- Train all operators to ensure that they comply with the policies;
- Have documentary evidence of previous incidents giving rise to security/health and safety concerns requiring the use of BWCs; and
- Have signage indicating image recording in operation.
To view the Guidance Note on the use of Body Worn Cameras, please click here.
Article submitted by Rowena McCormack, Associate – DAC Beachcroft Dublin
What action could be taken to manage risks that may arise from this development?
If financial services companies in Ireland are operating BWCs, the recommended practical steps set out in the Guidance Note should be taken to ensure compliance with the Acts.