CCTV Law & Data Protection

Which UK legislation is the primary framework for protecting personal data collected by CCTV systems?

• AHuman Rights Act 1998
• BGeneral Data Protection Regulation (GDPR) and Data Protection Act 2018✓
• CPrivacy Regulation Act
• DCCTV Directive

Answer: GDPR and the Data Protection Act 2018 are the primary UK frameworks governing personal data collection and processing, including CCTV footage.

Under GDPR, what is the primary principle organisations must follow when processing personal data via CCTV?

• ACollect as much data as possible
• BData should be processed fairly, transparently, and lawfully✓
• CData is the organisation's property
• DNo consent is ever needed

Answer: GDPR requires that personal data is processed fairly, transparently, and for lawful purposes - a core GDPR principle.

What is the primary purpose of the Surveillance Camera Code of Practice?

• ATo ban all CCTV systems
• BTo provide guidance on proportionate and effective CCTV use✓
• CTo require all CCTV to record sound
• DTo set equipment manufacturing standards

Answer: The Surveillance Camera Code of Practice provides guidance on using CCTV proportionately and effectively while respecting privacy rights.

Which principle of the Surveillance Camera Code of Practice states that CCTV use must be necessary and not excessive?

• ALegality
• BProportionality✓
• CTransparency
• DAccountability

Answer: Proportionality is the principle ensuring CCTV systems are necessary, not excessive, and proportionate to the identified problem.

Under GDPR, individuals have the right to request information about personal data held about them. What is this called?

• AFreedom of Information request
• BData Access request
• CSubject Access Request (SAR)✓
• DPrivacy Notification

Answer: A Subject Access Request (SAR) is an individual's right under GDPR to access personal data an organisation holds about them.

What is the time limit for responding to a Subject Access Request under GDPR?

• A7 days
• B14 days
• C30 days✓
• D45 days

Answer: Organisations must respond to a Subject Access Request within 30 calendar days from receipt.

Which role within an organisation is responsible for ensuring GDPR compliance with CCTV systems?

• ACCTV Operator alone
• BData Protection Officer (DPO) and/or Senior Management✓
• CExternal contractors
• DOnly the IT department

Answer: The Data Protection Officer (DPO) and senior management share responsibility for ensuring GDPR compliance across the organisation.

Under the Data Protection Act 2018, which legal basis might justify continuous CCTV monitoring in a private business premises?

• APublic interest
• BLegitimate business interests (e.g., security) - if balanced against privacy rights✓
• CGeneral curiosity
• DMarketing purposes

Answer: A legitimate business interest (such as protecting property and employees) can justify CCTV, provided it's balanced against privacy rights.

What must organisations display at CCTV-monitored locations under GDPR transparency requirements?

• ACCTV is optional
• BA CCTV in operation notice with organisation contact details✓
• COnly at main entrances
• DNothing - covert monitoring is allowed

Answer: GDPR requires visible CCTV notices with organisation details to inform individuals that monitoring is taking place.

Which type of CCTV is generally considered intrusive and requires strong justification under GDPR?

• AMonitoring public parking areas
• BMonitoring toilet facilities or private dressing areas✓
• CMonitoring building entrances
• DMonitoring shops

Answer: CCTV in private areas like toilets and dressing rooms is considered highly intrusive and rarely justifiable.

Under the Surveillance Camera Code of Practice, what should organisations do before installing a CCTV system?

• AInstall immediately
• BConduct a Privacy Impact Assessment (PIA)✓
• COnly notify the ICO
• DObtain police permission only

Answer: A Privacy Impact Assessment should be conducted to justify CCTV necessity and assess privacy implications.

What is the Information Commissioner's Office (ICO) role regarding CCTV systems?

• AOperates all CCTV systems
• BEnforces data protection law and provides guidance on CCTV compliance✓
• CApproves all CCTV installations
• DDeletes CCTV footage

Answer: The ICO is the UK's independent authority for data protection and enforces GDPR and DPA 2018 compliance.