further to andy’s earlier post here’s the relevant passage from the information commissioners regulations for the installation of cctv
the full document is available here
9.2 Subject access requests
Individuals whose images are recorded have a right to view the images of themselves and, unless they agree otherwise, to be provided with a copy of the images. This must be provided within 40 calendar days of receiving a request. You may charge a fee of up to £10 (this is the current statutory maximum set by Parliament). Those who request access must provide you with details which allow you to identify them as the subject of the images and also to locate the images on your system. You should consider:
• How will the staff involved in operating the CCTV system recognise a subject access request?
• Do you have internal procedures in place for handling subject access requests? This could include keeping a log of the requests received and how they were dealt with, in case you are challenged.
• A clearly documented process will also help guide individuals through such requests. This should make it clear what an individual needs to supply.
You should decide:
• What details will you need to find the images? Is it made clear whether an individual will need to supply a photograph of themselves or a description of what they were wearing at the time they believe they were caught on the system, to aid identification?
• Is it made clear whether details of the date, time and location are required?
•What fee will you charge for supplying the requested images (up to a maximum of £10) and how should it be paid? Make this clear to people making access requests.
• How will you provide an individual with copies of the images?
If images of third parties are also shown with the images of the person who has made the access request, you must consider whether you need to obscure the images of third parties. If providing these images would involve an unfair intrusion into the privacy of the third party, or cause unwarranted harm or distress, then they should be obscured. In many cases, images can be disclosed as there will not be such intrusion.
Example: A public space CCTV camera records people walking down the street and going about their ordinary business. Where nothing untoward has occurred, this can be released without editing out third party images.
Example: Images show the individual who has made the request with a group of friends, waving at a camera in the town centre. There is little expectation of privacy and the person making the request already knows their friends were there. It is likely to be fair to release the image to the requester without editing out the faces of their friends.
Example: Images show a waiting room in a doctor’s surgery. Individuals have a high expectation of privacy and confidentiality. Images of third parties should be redacted (blurred or removed) before release.
Where you decide that third parties should not be identifiable, then you will need to make arrangements to disguise or blur the images in question. It may be necessary to contract this work out to another organisation. Where this occurs, you will need to have a written contract with the processor which specifies exactly how the information is to be used and provides you with explicit security guarantees.
and here is an interesting article from the guardian
Film stars of CCTV
