ICO tells CCTV website Internet Eyes to makes changes following privacy concerns
Computer/Internet/Software Articles
Add an article Back to Articles
Issued on 14 June 2011 -
ICO
The Information Commissioner’s
Office (ICO) has required CCTV monitoring website Internet Eyes to make
significant changes to the way it operates after CCTV footage of a
shopper was posted on YouTube.
In January, the ICO received a
complaint about a clip posted on video sharing website YouTube that
contained an identifiable image of a person in a shop. The clip
appeared to have been uploaded by a viewer who had used the CCTV
footage streamed to their computer from the Internet Eyes website.
Internet Eyes is a CCTV scheme that
allows retailers to have their live surveillance footage watched online
by individuals. The scheme operates by streaming CCTV images that are
viewed by registered members who can get rewards if they spot and
report crimes that they see taking place.
Deputy Commissioner, David Smith,
said:
“CCTV footage should not end up on
YouTube when it shows someone simply out doing their shopping. A
person’s CCTV image is their personal data. The law says that it should
only be disclosed where necessary, such as for the purposes of crime
detection, and not merely for entertainment.
“Although we have only received one
complaint about Internet Eyes, we have investigated fully and have
required them to make changes to the way their system operates. We are
now satisfied that they have met our requirements. We will though
continue to keep a close watch on them and do not rule out taking more
formal enforcement action if further complaints are received.”
The ICO’s investigation found that
Internet Eyes had failed to make sure that the transfer of CCTV images
it was streaming to its viewers over the internet was encrypted. The
company also did not keep a full record of its viewers’ activities and
so were unable to identify which viewers had monitored specific
footage. This meant Internet Eyes was unable to determine which viewer
posted the clip online.
On 18 May, Internet Eyes agreed to
the terms of the undertaking laid down by the ICO. This committed them
to make immediate changes to their service to address the privacy
concerns raised. This included encrypting the transfer of CCTV images,
putting in place an audit trail for viewer activity as well as ensuring
proper checks are carried out on registered viewers. The ICO also
required Internet Eyes to put a further change in place by 31 July to
ensure that no viewer can access footage from cameras located in the
same postcode, or in any postcode district within a 30 mile radius of
the viewer’s registered location.
The ICO then carried out random
spot checks in several shops registered with the scheme as well as
visiting the company’s office in Devon to see first-hand the changes
that had been put in place. From the evidence seen so far, the ICO is
satisfied that Internet Eyes is complying with the terms of the
undertaking.
A full copy of the undertaking can
be viewed here:
http://www.ico.gov.uk/what_we_cover/promoting_data_privacy/taking_action.aspx#undertakings
Notes
1.
The
Information Commissioner’s Office upholds information rights in the
public interest, promoting openness by public bodies and data privacy
for individuals.
2.
The
ICO has specific responsibilities set out in the Data Protection Act
1998, the Freedom of Information Act 2000, Environmental Information
Regulations 2004 and Privacy and Electronic Communications Regulations
2003.
3.
The ICO is on Twitter, Facebook
and LinkedIn,
and produces a monthly e-newsletter.
Our For the
media page provides
more information for journalists.
4.
Anyone
who processes personal information must comply with eight principles of
the Data Protection Act, which make sure that personal information is:
- Fairly
and lawfully processed
- Processed
for limited purposes
- Adequate,
relevant and not excessive
- Accurate
and up to date
- Not
kept for longer than is necessary
- Processed
in line with your rights
- Secure
•
Not
transferred to other countries without adequate protection
5. The ICO’s CCTV
Code of Practice provides guidance
and advice for CCTV users on how to comply with the Data Protection Act.
About the Author
The Information Commissioner’s Office is the UK’s
independent authority set up to uphold information rights in the public
interest, promoting openness by public bodies and data privacy for
individuals. We do this by promoting good practice, ruling on
complaints, providing information to individuals and organisations and
taking appropriate action when the law is broken.
The ICO enforces and oversees the following
legislation:
- Data Protection Act 1998
- Freedom of Information Act 2000
- Privacy and Electronic Communications
Regulations
2003
- Environmental Information Regulations
2004
