As most of us are well aware by now, from 25th May 2018, every EU country will be subject to the new General Data Protection Regulations (GDPR), changing the way personal data is handled by strengthening compliance requirements and introducing strict penalties for failing to adequately protect personal data.

All UK businesses must be conscious of the new rules and make the necessary changes, since non-compliance can result in data breaches and massive fines of up to 20 million Euros, or 4% of turnover - whichever is highest.

The British Security Industry Association (BSIA) holds that there are a staggering six million active CCTV cameras currently being used in the UK. Most businesses of all types and size will be using some type of CCTV, whether it be for security purposes, health and safety or monitoring.

People’s rights and freedoms cannot be overridden, as employees at work still have a right to privacyRight to privacy

What businesses need to be aware of though, is that the images and footage of people captured by their surveillance system is classified as personal data under GDPR, which means that those who operate this type of surveillance must ensure that they are complying with the new regulations.

Under GDPR, those who operate CCTV cameras must be able to demonstrate that there is a strong, transparent, ‘fair’ reason for doing so. People’s rights and freedoms cannot be overridden, even at work – employees still have a right to privacy.

If you haven’t done so already, you should immediately conduct a full data privacy impact assessment, as recommended by the Information Commissioner’s Office (ICO) code of practice. This will help you determine if there is a legitimate reason for processing data through CCTV footage, while ensuring that you are not excessively impacting the privacy rights of the people captured.

Justifying privacy impact assessments

If you are unsure of how to carry out a privacy impact assessment, there are experts out there who can help you

An example of legitimate justification would be a construction site owner introducing wireless CCTV cameras to monitor and secure their site from would-be criminals. In this case, to meet legitimate purpose, the footage must be of sufficient quality and the images captured must be readily available for police examination if such a request is made.

An illegitimate reason, on the other hand, would be the installation of CCTV purely to track the behaviour of employees, which could be viewed as an invasion of privacy. However, if you can say it is there for health and safety purposes, with evidence to back this up, you might then have a justifiable explanation.

If you are unsure of how to carry out a privacy impact assessment, there are experts out there who can help you.

Maintaining transparency

Under GDPR, ‘transparency’ is important when processing data, which means data subjects, i.e. those whose images are captured by CCTV, are entitled to know that they are being filmed, which means you must inform them of the CCTV presence.

To best ensure you are upholding this rule, it is a good idea to display prominent, unambiguous signs within the CCTV area to communicate that you are capturing footage and give people a number to contact for more information.

Not only does this inform people that they could be under surveillance, but by placing prominent signage you are also helping to deter trespassers, who are less likely to enter a premises if they know might be filmed.

Images and footage of people captured by surveillance systems is classified as personal data under GDPR
Those whose images are captured by CCTV are entitled to know that they are being filmed

Data retention

One of the main aspects of GDPR is that personal data cannot be stored forever; it must only be kept for as long as its purpose requires (usually 30 days is recommended). As such, every camera your business operates will have to be assessed in order to ascertain how long footage is to be retained and why.

Each case will be subjective and there are no hard and fast rules as to the ideal retention period. It is up to you to determine an acceptable period, taking into account people’s rights when deciding what is best. The upside is most modern CCTV cameras will allow the operator to set specific data retention limits.

Individuals can request access for free under the new GDPR, making the likelihood of requests higherResponding to data requests

As it falls under personal data, people can request access to CCTV footage which relates to them and the CCTV operator is required to disclose it. However, you must ensure that the person requesting to see the footage is the person who is present in it.

By providing access to the footage, you must be wary not to disclose any personal data of other people, which may mean blurring out sections of the footage (e.g. containing number plates or images of other people) is necessary to avoid data breaches.

Moreover, once a request for data access has been made, this must be provided without delay and within one month at the latest. This can be extended by two months where the request is complex or numerous.

As such, you should ensure that there are appropriate policies in place within your working environment to ensure that employees know how to respond to individual data requests.

Under the old rules, there used to be an admin fee for such requests, but this has been scrapped and now individuals can request access for free under GDPR, making the likelihood of requests higher.

GDPR awareness among security service providers

It’s always important to use a highly reputable security service provider who should be well aware of the GDPR rules Under GDPR, security suppliers are ‘data processors’, which means that the clients of them should have contracts in place outlining what the security supplier can do with the data.

As such, you must ensure that sub-contractors working for your business, such as security suppliers, installers or engineers, are following the rules too.

You will be opening up your business to potential data breaches if you are allowing such third parties to access, remove or distribute personal data captured by the CCTV.

This is why it’s always important to use a highly reputable security service provider who should be well aware of the GDPR rules. If you don’t know, just ask!

Ensuring fair usage

The introduction of GDPR is certainly going to pose some interesting challenges for all businesses and how it unfolds is yet to be seen.

The tighter regulations show that it is no longer acceptable to not be aware of or not understand the rules surrounding personal data and that such breaches will be taken seriously.

However, they should certainly not discourage CCTV use, but instead operators should seek to guarantee fair usage is upheld and take steps to ensure that people know how and why they are being recorded.

Download PDF version

Author profile

In case you missed it

High-speed airport-screening systems will improve soft target security
High-speed airport-screening systems will improve soft target security

Several recent terrorist and mass violence attacks have been directed at soft targets, or relatively unprotected locations where people gather such as outside a music venue or in the unscreened passenger areas at airports. Attacks in public areas have led to the development of new security technologies aimed at protecting soft targets. One company addressing the challenges is Evolv Technology and its Edge automated high-speed personnel screening solution. The system integrates walkthrough firearm and explosive detection for high-throughput protection of events and soft targets.The Edge system has multiple detection sensitivity settings to respond to various threat scenarios Enhanced visitor experience The system seeks to increase security without compromising the ‘customer experience’. People simply walk through single-file – between two 5-foot-tall stanchions. One lane can screen up to 800 people per hour, and the system detects explosives or metallic objects without the need for pat-downs or wands or other invasive procedures. Any personal belongings can remain in visitors’ pockets. A single security guard is needed for each lane to verify any detected threats. “The system combines an improved security posture with a better visitor experience,” says Mike Ellenbogen, CEO of Evolv Technology. “We need to fly and have been trained to be screened at the airport, but we don’t expect to be screened going to see a ball game or a Mozart concert. Evolv recognised a need for a new way to inspect people before they enter these types of facilities. It’s a seamless system that pulls various technologies together. We want to feel safe but without having to sacrifice the quality of the experience.”Screening analytics provide data on the numbers of people screened by time of day and by result The system combines millimetre wave and magnetic field sensors, along with artificial intelligence (AI)/ machine learning and can incorporate additional data such as biometrics. Known bad actors can be identified using facial recognition. The system has multiple detection sensitivity settings to respond to various threat scenarios. Expanding perimeter protection A security guard provides the human touch by verifying any threats detected by the system. The locations of concealed items are displayed on a photo of the individual using a color-coded box overlay. Screening analytics provide data on the numbers of people screened by time of day and by result. Ellenbogen says the company is working to have the system adopted at entertainment venues, performing arts centres, sports centres, for air and rail transportation, and to protect high-profile government buildings. The Edge system can expand the protected perimeter to a wider area that was previously unprotected. The Edge system can expand the protected perimeter to a wider area that was previously unprotected For example, concert-goers exited the arena of an Ariana Grande concert May 22, 2017, in Manchester, U.K., and entered the surrounding area that was unscreened and unsecured. Placing a user-friendly screening system around a wider perimeter outside the concert venue might have prevented the use of an improvised explosive device in the terrorist attack.Placing a user-friendly screening system around a wider perimeter outside the concert venue might have prevented the use of an improvised explosive device in the terrorist attack Threat mitigation with soft target approach Likewise, a 2016 bombing at the Brussels Airport occurred in the departure hall outside the passenger screening areas. Securing a wider perimeter – for example, screening customers discreetly as they enter the airport building from a parking area – could have provided additional security against such an attack. Ellenbogen confirms Evolv has sold a number of systems to major European airports to screen visitors and passengers as they enter the front door. “Addressing the threat to an airport or train system is different than screening passengers; we are looking for different types of objects and different types of materials. The idea is to be able to detect threats to a venue before they get into the venue.” The soft target approach can also be applied to public buildings, such as courthouses, and used in lieu of more invasive metal detectors and x-ray machines. The portability of the Edge system enables a ‘pop-up’ approach to security – i.e., to relocate the system to address specific or changing security threats easily. The self-contained system only requires a wall plug. Labour reduction (because of faster throughput) can help offset the system costs but it’s difficult to quantify the improvement in the visitor experienceImproving security posture at event venues “It’s surprising the level of importance [venue owners] put on the visitor experience,” says Ellenbogen. “They see that their brand starts at the front door. They are eager to find alternative security solutions that come across as more inviting, less imposing, less closed down, less invasive than the solutions they have been using,” he says. “They are driven by a desire to improve the visitor experience as they improve the security posture.” He says current events, including terrorist attacks and mass shootings, drive awareness among venue owners to improve the security of soft targets. “The level of interest is high, and it spikes somewhat when there is a big headline,” Ellenbogen says. He notes that the system is more expensive than a metal detector, but about a third the cost of familiar airport body scanners. Labour reduction (because of faster throughput) can help offset the system costs, but “it’s difficult to quantify the improvement in the visitor experience,” Ellenbogen says.

How to make school security effective and unobtrusive for students
How to make school security effective and unobtrusive for students

Schools today are charged to provide an environment that is both safe and conducive to learning, which can be difficult considering the range of security incidents and challenges they face, including bullying, fights, graffiti, theft and more. In addition to working within often tight budgetary constraints, a main challenge is to provide the highest level of security in an aesthetically pleasing way that doesn’t make students feel as if they are in prison. While these two needs may seem mutually exclusive to some degree, that doesn’t have to be the case. School security can be achieved without building 20-foot walls or putting barbed wire around the perimeter. The key to balancing the security and learning environment can be found in the four pillars of a good school security strategy, namely people, practices, technology and physical environment. A mobile app or text notification system could be used to alert students and staff of potential problems Situational awareness One of the most effective measures to take is to educate staff and even students to learn to be aware about their surroundings and adopt the 'If you see something, say something' mentality. In an emergency, time is of the essence, so the speed of response becomes critical. Educating staff and students to recognise potential problems and report them is a good first step. Augmenting this with mobile apps and/or texting capabilities, for example, that allow someone to send a photo to school security or law enforcement for quick assessment and evaluation, can speed response even more. A mobile app or text notification system could also be used to alert students and staff of potential problems and provide instructions on what steps to take in order to remain safe. By providing real-time situational awareness about potential responses, these types of technologies can reduce the number of armed guards or resource officers needed to patrol a school or campus, which also makes students more comfortable and able to learn in a non-prison-like environment. Security best practices Every school should establish a set of security policies and procedures and ensure that staff and students understand what to do if they suspect a problem or if an incident should unfold at the school. However, too often, schools may not know where to start when seeking out best practices. And once these policies are in place, there may be confusion about how to audit them to ensure people are properly educated. The NFPA has begun work on a school security standard that would address a range of issues schools face on a daily basis A number of organisations are available to aid with this process, such as the Partner Alliance for School Safety a group founded in cooperation with SIA (Security Industry Association), which provides resources and tools to help schools and security professionals evaluate and establish the best security protection for their buildings. These guidelines and best practices are designed to help schools spend their often limited funds on the right security solutions. Safe and Sound Schools provides downloadable school security toolkits, and the National Fire Protection Association (NFPA) has recently released the NFPA 3000 Active shooter response guidelines and has begun work on a school security standard that would address a range of issues schools face on a daily basis. The key takeaway is that the information is out there, and the organisations mentioned above are excellent resources for helping schools create safe, secure and learning-conducive environments. Technology in school security The second thing that needs to be considered is how technology can be brought to bear to contribute to school security. Video surveillance with video analytics can be deployed to monitor areas at certain times of day. For example, once school starts, there shouldn’t be a lot of activity in the parking lot or in particular areas around the school. For these situations, intelligent cameras with video analytics can be used to detect activity in those areas of interest to alert school security that something may need their attention. This might be a vehicle entering a lot or driving against the normal traffic flow, which may simply be a parent arriving to pick their child up early, or it could be something worth following up on. Radar detection is ideal for perimeters, where a device can be set up unobtrusively to alert when someone enters a particular area In any case, this is something that should be brought to the attention of someone who can quickly assess the situation and determine what, if any, response is needed. Because the goal in a potentially dangerous situation is speed response times. The faster you’re able to detect something using technology, the faster you’re able to respond. Therefore, being able to identify something happening in a parking lot and alert school resource officers could provide 30 seconds or a minute head start for response, which can get the school into a lockdown situation and get first responders on site more quickly.Facial recognition systems and providing access through smartphones could help create a more welcoming and secure environment for students, staff and parents After-hour monitoring solutions Monitoring buildings and facilities after hours presents a different set of challenges. For sporting events, the National Center for Spectator Sports and Security (NCS4) at the University of Southern Mississippi provides best practice guidance for sporting facilities and events not only just for universities but even including those at high schools. It’s been shown that using lighting at night can deter crime. However, it can be expensive to keep a building and grounds illuminated all night, every night. To mitigate these concerns and potential costs, there are video cameras available with extreme low-light capability that allows them to see in near-dark or in some cases complete darkness. This allows a school to save money by turning lights off while achieving a level of surveillance performance similar to daytime deployments. Radar detection Another technology for effective school security, both during and after school hours, is radar detection. This is ideal for perimeters, where a device can be set up unobtrusively to alert when someone enters a particular area. Radar can be deployed with a single PTZ camera, which can track whatever has been detected to provide real-time situational awareness for a school resource officer or law enforcement to investigate to determine the potential threat, if any, related to the perimeter breach.Following the four pillars of school security can ease the process while improving the effectiveness and efficiency of securing educational facilities More often than not, schools are faced with issues that are not necessarily the worst-case scenario everyone fears, such as how to identify parents and others who are authorised to pick a child up from school early. In this instance, facial recognition systems and providing access through smartphones could help create a more welcoming and secure environment for students, staff and parents. Lighting and landscaping In addition to technology, one of the things that can contribute to a safer school environment is environmental design. CPTED provides four basic principles, one of which is natural surveillance, which follows a 'see and be seen' philosophy. In other words, when people know they can be seen, they are less likely to commit a crime. The main points in this general principle are lighting and landscaping. For example, a school doesn’t want to block potentially vulnerable areas with landscaping, so the height and thickness of any potential landscaping elements should be carefully considered. In general, openness and visibility should be the guiding factors. Securing physical environment Another aspect of the physical environment is maintenance. If a window gets broken but isn’t fixed right away, that tends to invite vandalism. These are just two of the guidelines CPTED offers for creating a more secure environment that doesn’t feel like a prison. In general, finding the right mix between maintaining security and providing a welcoming, aesthetically pleasing and learning-conducive environment can seem like a difficult – if not impossible – task. Following the four pillars of school security can ease the process while improving the effectiveness and efficiency of securing educational facilities.

Has consolidation shifted to the security integrator/installer market?
Has consolidation shifted to the security integrator/installer market?

Consolidation – a decrease in the number of companies in a market achieved through mergers and acquisitions (M&A) – has been an important trend among manufacturers in the physical security market for many years. More recently, the trend has also appeared to extend to the integrator market. Larger integrators have been buying up other large integrators; in some cases, they have also been buying up smaller, regional integrators to expand their geographic coverage area. We wondered if this week’s Expert Panel Roundtable has noticed the trend. We asked: Has consolidation among security companies shifted to the integrator/installer market? What is the impact?