I have just won a minor victory against my local authority (Waltham Forest) which used images captured by a mobile CCTV unit to issue a £110 fixed penalty notice for a parking violation; I managed to get the penalty set aside.
This blog presents the case that the Council’s use of CCTV in instances like mine are in breach of the Data Protection Act (DPA) and possibly the Regulation of Investigatory Powers Act (RIPA), even though there are parking restrictions in force at the time of the surveillance.
I think far too many motorists get caught out by unnecessary surveillance whose purpose has nothing to do with traffic management and everything to do with “revenue collection”. I hope this analysis will help others facing the same position; full references and footage of the offence on the links below.
In late July, I unwittingly stopped for six minutes in a parking bay which, unusually, was subject to parking restrictions. The road signs depicting the parking restrictions are clearly dilapidated and they cannot be seen in the CCTV footage (or by the driver when one approaches the parking bay). My “parking violation” was captured in totality by a mobile CCTV unit parked a good distance up the road. As can be seen in the footage, the mobile CCTV camera puts the parking bay under constant surveillance, can zoom in, and even records when my car is neither in the picture nor in the parking bay. The footage shows that the traffic was light at the time of the “offence”.
Under the Freedom of Information (FOIA)/Data Protection Acts, I obtained the complete footage of “the offence” and background material to Council policy in this area. This showed that from May to July, mobile CCTV camera units were sent to the very location shown in the footage, a total of 44 days; this means that for every other working day, this particular parking bay was under surveillance for up to two hours per day.
According to the FOIA material (see references), the reason for sending the mobile CCTV camera to this location includes the deterrent purpose of identifying “motorists who … cause congestion by ignoring traffic markings” and “high instances of fly parking that cause disruption to other road users”. These purposes, in data protection terms, are the relevant purposes of the processing of personal data via the Council’s mobile CCTV units.
Note that these kinds of purpose for the deployment of mobile CCTV camera units would get support from most motorists as they are qualified by the requirement that the offending parking would “cause congestion” or “cause disruption”. However, it also follows that the policy does not apply when there is neither congestion nor disruption. In such circumstances, the cameras should not be recording at all (and that the mobile CCTV units should be deployed elsewhere where congestion or disruption is likely).
If such CCTV camera units do record personal data when there is no “congestion” or “disruption”, I would argue that this processing is not associated with the Council’s policy nor its stated purposes. In my case, the video footage shows CCTV Unit watching an empty parking bay and waiting to hook an unsuspecting motorist. Once hooked, the Council reels in its £110 prize (the standard Fixed Penalty Notice fee).
The Data Protection breaches
The violations of the First and Third Data Protection Principles are as follows:
(a) The purpose of the surveillance is not a purpose set out in Council policy as there is no "congestion" of, or "disruption" to, traffic. The processing therefore is not necessary for the stated Council’s legitimate purposes and as the processing does not have a Schedule 2 criterion, it is in breach of the First Data Protection Principle.
(b) Even if there is a Schedule 2 grounds for the processing, the processing is excessive (e.g. in terms of the Third Principle etc) for the stated purposes of the Council which relate to “congestion” and “disruption” of traffic (and not purposes when traffic is free flowing).
(c) There is no explicit signage in the parking bay under surveillance or nearby; such signage is a requirement of the First Principle. Indeed, I think parking bays that are under constant surveillance (e.g. those that are subject to surveillance once every two days for three months) need specific signage in the particular parking bay. By contrast, the Council argued that the signage throughout the Borough sufficed.
(d) Westminster Council puts its signage (see references) on their mobile CCTV Camera Cars. This is an error as the car is unlikely to be seen by the motorist (i.e. data subject) whose personal data are collected (e.g. in a parking bay under surveillance). I would argue that it is the locations which are under surveillance that need the signage - not the device delivering the surveillance (i.e. on the CCTV mobile car as per Westminster).
(e) General CCTV signage is normally associated with crime prevention or public safety; it does not include signage for parking violations. Without proper signage displaying the non-obvious purpose of the processing, such processing is likely to be unfair.
(f) The absence of signage makes the surveillance covert; this is arguable I admit but the relevant Home Office Code of Practice suggests that the surveillance is indeed covert. If surveillance is covert, it will be unlawful under RIPA, and it also follows that the processing under the DPA would also be unauthorised, possibly unlawful – another breach of the First Principle.
I should add that I think the ICO’s CCTV Code of Practice is clear on the need for signage in the parking bay. Remembering that the surveillance in my case was undertaken when there was no congestion or disruption to traffic (and once every other day for three months), the Code of Practice states:
“Clear and prominent signs are particularly important where the cameras themselves are very discreet, or in locations where people might not expect to be under surveillance. As a general rule, signs should be more prominent and frequent where it would otherwise be less obvious to people that they are on CCTV” (my emphasis).
Hence my conclusion that the actual parking bay under regular surveillance needs the signage. As an aside, I am wondering how signage could display the “revenue collection” purpose and to be helpful, I have provided a relevant fair processing signage for this purpose (see references).
The rest of the article explains the RIPA context, but before that an anecdote. When I got the Penalty Charge Notice claiming £110, I drove back to the scene of the crime. Whilst looking at the parking bay, I was approached by a well-proportioned gentleman who conversed using an Anglo-Saxon/East-enders dialect of English.
“Has yus been ****ing well done?”, he asked.
“Yes”, I responded.
“Well the ****ers over there (energetically gesticulating to a spot 50 yards up the road where the CCTV unit must have been parked) “did us when I stopped to pick up a ****ing bacon sandwich”. I was only ****ing three minutes and it was a ****ing expensive sarnie”.
The RIPA breach
I begin with a quote from the “Covert Surveillance and Property Interference: Revised Code of Practice” (2010) published by the Home Office. This states that:
“The use of overt CCTV cameras by public authorities does not normally require an authorisation under the 2000 Act. Members of the public will be aware that such systems are in use”. A footnote adds “for example, by virtue of cameras or signage being clearly visible”. See the CCTV Code of Practice 2008 for full guidance on establishing and operating overt CCTV systems”) (my emphasis)
The key question is as follows: if the cameras of the Mobile CCTV Unit are not “clearly visible” (the car is 50 metres away up the road), and because there is no signage in the particular parking bay under surveillance, then does it follow that the mobile CCTV cameras are covert? If so, does the CCTV surveillance falls within the definition of “directed surveillance” under RIPA (intrusive surveillance can be safely be ignored).
The Home Office Code of Practice states that there are three tests if any planned directed surveillance is subject to RIPA. The surveillance has to be: “covert”; “conducted for the purposes of a specific investigation or operation”; and “is likely to result in the obtaining of private information about a person (whether or not one specifically identified for the purposes of the investigation or operation)”.
I would argue that the mobile CCTV unit surveillance is “covert” (because it is not overt as there is no signage and the cameras are not "clearly visible"). I also argue that the regular and routine surveillance of the parking bay constitutes “an operation” as it occurs every other day over a period of months. The only issue is whether private information is “likely” to be obtained. Given that the surveillance is of a public highway parking bay, at first sight this seems unlikely.
However, note that the test is that “private information is likely to be obtained”, not that “private information is actually obtained”. So even if “private information” in my particular case is not obtained, there is no guarantee that private information will not be obtained during the operation as a whole. After all, some people do unusual things in their cars, the period of the surveillance operation extends into months, and the CCTV footage in my case does show that the operator can zoom in, at will, to record details of what individuals are doing by the car. So I conclude that the Council cannot guarantee that it won’t obtain “private” information during its long surveillance operation.
Hence, I would then argue that the Council should therefore anticipate, because the operation is continuous (extending, I suspect, for every month of the year) that it is likely to obtain “private information” at some time (e.g. by zooming in). It follows therefore that RIPA is likely to be engaged and the directed surveillance is unauthorised/unlawful (as it does not meet RIPA’s requirements).
However, I admit the RIPA position is not as clear cut as the data protection one. But my conclusion is that the surveillance breaches the First and Third Data Protection Principles and is arguably in breach of the directed surveillance provisions of RIPA. Of course, the Council will no doubt dispute these claims.
Finally, I should report that the Council did take action in one area; it has repainted all the road markings so its revenue collection purpose can continue unabated. There is no signage in the parking bay.
References
The footage depicting my traffic offence (6 minutes; uneventful; puts children to sleep as they watch: YouTube link http://www.youtube.com/watch?v=vCBCjNiJDrw. (Note: the Post Office delivery van does not get charged a fine)
Westminster Mobile CCTV fair processing notice on mobile CCTV cars that are away from the point of surveillance (50 seconds in): http://www.youtube.com/watch?v=Lc8TTfVVW2w
Home Office 2010 Code of Practice on surveillance: Download Code-of-practice-covert
Possible fair processing notice depicting a Council's "revenue collection" purpose. Download CCTV POSTER_BLOG
The FOI request showing the purpose of surveillance and the frequency of surveillance Download CCTV Mobile FOI 2012- 0389
Advert
(a) Our Update session on October 29th in London covers all the important aspects of data protection in the last six months. Details on http://www.amberhawk.com/bookevents.asp (A snip at £195)
(b) JUSTICE Event at Hunton and Williams: “Defamation, privacy and freedom of expression online”, London 20 November 2012
I can only imagine LB Waltham Forest's alarm at receiving your requests, but what a victory ! As usual there were a few chuckles whilst reading this :)
Posted by: Tracy Phillips | 23/10/2012 at 09:03 AM