A small business owner, pleaded guilty to the offence of failing to register with the Information Commissioner’s Office under section 17 of the Data Protection Act 1998 (DPA) at Coventry Magistrates’ Court on 1 February 2017. She was fined £200, ordered to pay £439.28 prosecution costs and a £20 victim surcharge.
The defendant was operating CCTV cameras as part of her business, but said she didn’t realise this meant she had to register with the ICO. The annual fee for most businesses is £35.
It is not just CCTV and surveillance cameras that trigger compliance requirements with the DPA, but also drones. When drones are used by individuals for their private purposes there is a risk that images of citizens are collected without their consent but more importantly where drones are used in a commercial setting whether it be for the management of landed estates, the delivery of commercial products or the review of commercial buildings, the ICO has identified that without appropriate practices the use of drones will infringe the data protection rights of individuals and render the commercial operator of drones non-compliant with the DPA and the General Data Protection Regulation (as from 25th May 2018).
In particular the use of drones is identified in the CCTV Code of Practice published by the ICO, which describes drones as Unmanned Arial Systems (UAS). The ICO distinguishes between individuals who use drones as “hobbyists” and those individuals or organisations that use drones for professional or commercial purposes.
The CCTV Code of Practice reminds commercial users of drones that they need to comply with all aspects of the DPA particularly as regards registration with the ICO and notifying individuals that their images may be captured and giving individuals information relating to their rights as a data subject.
Commenting on the recent case in the Coventry Magistrate’s Court, Head of ICO Enforcement, Steve Eckersley said: “The message here is simple, if you are a business operating CCTV cameras you must be registered with the ICO.
“Business owners need to be aware of their obligations when dealing with people’s personal data and this includes footage from CCTV cameras.
“Being ignorant of the law and the regulator is no excuse; you could end up spending a day in court and receiving a fine, as well as suffering reputational damage to your business. This could all be avoided with some due care and attention.”