At what point does CCTV go from being an acceptable security measure to an infringement of others' privacy – or even unlawful harassment? A recent case provides useful guidance on the position and highlights the key issues that businesses need to consider.
The use of CCTV and other security devices is a common way for individuals, businesses and public bodies to increase the safety and security of their property and their people. The visual and audio technology underlying these systems has become increasingly complex and sophisticated in recent years, as have the methods for gathering, analysing, storing and sharing the digital data collected. Surveillance technology is no longer a passive tool for recording images, but is now a proactive system that can be linked to AI and used for a number of activities from identifying people of interest to the police through to recording shoppers' responses to marketing activities. We have previously written about live facial recognition technology here. The use of surveillance cameras in this way has aroused public concern which has led to a strengthening of the regulatory landscape.
In this context, the recent County Court judgement of Fairhurst v Woodard is an interesting example of how the courts are likely to apply the regulatory regimes in practice. In this case, the judge decided that a homeowner who had installed security equipment in order to protect his cars, and had been dishonest with neighbours about the existence and scope of these devices, had engaged in both harassment and a breach of data protection laws.
This case was decided in the County Court and is therefore not a binding authority, and relates to residential not commercial property, but is nevertheless a useful reminder of the key principles that commercial property owners and occupiers should bear in mind when using CCTV and other security devices on and around their properties.
The parties in this case are neighbours who both have access to a shared driveway leading into a large private parking area containing a number of spaces used by local residents. Both of their properties back onto this car park. Dr Fairhurst became aware that Mr Woodard had installed a floodlight and sensor, and a video and audio surveillance camera with an integrated motion sensitive spotlight, both pointing in the direction of the car park. He had also installed a combined doorbell and video and audio surveillance system by his front door, a security camera in his windowsill which both pointed at the street, and a second spotlight camera attached to another neighbour's wall pointing down the driveway towards the car park.
Dr Fairhurst's case is that Mr Woodard was not honest with her about these devices, unnecessarily and unjustifiably invaded her privacy by their use and intimidated her when challenged about them. She argued that this amounted to a nuisance, a breach of UK data protection law and a course of conduct designed to harass her contrary to the Protection from Harassment Act 1997. She sought damages, and injunctive relief mandating the removal of the devices and forbidding the installation of further surveillance cameras. Mr Woodard denied her claims.
During the hearing, some of the main issues under investigation related to:
The judge found that Mr Woodard caused Dr Fairhurst alarm and distress, by his dishonesty and threatening behaviour, including a threat to set up more concealed cameras and his assertion that two of the cameras were non-operational dummies (when they were in fact active). She found that this behaviour amounted to harassment under the Protection from Harassment Act 1997, entitling Dr Fairhurst to damages for distress.
The Protection from Harassment Act 1997 was brought in primarily to deal with stalkers but has since been applied in a variety of other situations. Although Fairhurst v Woodward involved individuals, the legislation is widely framed and has been applied by the courts to bodies corporate. In particular, there have been a number of cases where banks, utilities and other businesses were found to have engaged in harassment as a result of unwarranted tactics employed in relation to debt collection activities. A business which responded to concerns about CCTV in a manner similar to Mr Woodard would probably be at risk of infringing the 1997 Act.
The nuisance claim failed. Part of that case relied on loss of privacy, the main authority for which is the Court of Appeal decision in Fearn and Ors v Board of Trustees of the Tate Gallery [2020] EWCA Civ 104 in which the court held that mere overlooking from one property to another is not capable of giving rise to a cause of action in private nuisance. The claim for light nuisance failed on the basis that the houses were in the town, where night-time lights are a feature, as opposed to the countryside where it would be less appropriate.
The parties agreed that the images and audio files collected by Mr Woodard were personal data within the meaning of UK data protection law. Their transmission to his phone, computer or other device, and their retention and onward transmission to others (whether neighbours, the police, or the cloud for storage) constituted processing of personal data. This meant that Mr Woodard was a data controller and accordingly must comply with the principles set out in UK data protection law (see textbox below).
There are seven key data protection principles but the ones most relevant to this case were that personal data should be processed:
Importantly, the judge acknowledged that Mr Woodard had a legitimate interest in using the cameras to prevent crime. However, as regards transparency, the judge found that Mr Woodard tried actively to mislead Dr Fairhurst about how and whether the cameras operated and what information they captured.
The fact that he collected data outside the boundaries of his property meant that the onus was on him to satisfy the Court that such processing of data was "necessary" for the purposes of his legitimate interests. He argued that, having been scared by the attempted theft of his cars, his use of security cameras was reasonable. The judge decided that:
The court therefore found that Mr Woodard had breached the provisions of UK data protection law, and that Dr Fairhurst was entitled to compensation and orders preventing him from continuing to breach her rights in the same or a similar manner in the future. However, before making any decision, the judge asked for further submissions from the parties in relation to both the data protection and harassment claims – so it is not yet clear exactly what remedies Dr Fairhurst will be granted.
The ICO has issued a code of practice here for organisations that use CCTV, automatic number plate recognition technology, body-worn video, drones and other systems that capture information of identifiable individuals. All entities using these systems should satisfy themselves that they have complied with its requirements. Here is a summary of its 6 key points:
