Data and Privacy Considerations of Installing CCTV in Care Homes
As campaigners increase pressure on care homes to install CCTV cameras following reported isolated incidents of abusive behaviour from staff, Heather McKay, Senior Associate at Browne Jacobson (www.brownejacobson.com) specialising in data protection, explains the data and privacy issues that must be considered.
The question of whether care home operators should seek to use surveillance technology such as CCTV cameras to help protect residents’ safety from the risk of unsafe care or treatment is one that won’t go away anytime soon.
There have been a string of reports in the media of abusive behaviour from carers against vulnerable residents, with some families setting up hidden cameras to capture incidents. This type of covert surveillance poses a challenge to managers of care homes, who may be looking to implement a more proactive approach to tackling the problem.
Campaigners continue to call for the implementation of independently monitored camera systems in communal areas and private rooms.
While this may assist care home operators in their ultimate goal of keeping residents safe, it also throws up a number of privacy issues.
Weighing up pros and cons of installing CCTV in care homes
As CCTV becomes increasingly available and accessible (particularly with the use of covert surveillance being popularised in mainstream media, such as the recent Netflix drama, Fool Me Once), it’s crucial for a care home operator to fully consider all the potential pros and cons of installing CCTV systems.
It’s important to understand and clearly define the problem they are trying to solve by installing CCTV. For example, do they suspect a problem with carers’ behaviour, is it to address demand by families of residents or is there another need for round-the-clock monitoring? Whatever the reason, the first step is getting a clear idea of the purpose CCTV would serve.
Surveillance can intrude on people’s privacy, and a care home operator will need to consider the rights (and potential concerns) of staff, residents and visitors who may be captured by the cameras. It must balance its duty to protect the rights of its ‘data subjects’ – the individuals whose data is being collected by the data controller – against its obligation towards the safety of its residents and staff.
There may be other steps that can be taken first to mitigate any challenges faced in these areas. But if they do decide there is a compelling case for installing CCTV – which should be backed up by very clear reasons – then cameras may only be necessary in certain rooms, such as those inhabited by highly vulnerable residents.
Understanding the data protection requirements
Once an operator has made the decision to install CCTV, they must consider their obligations to comply with data protection law.
Video surveillance is covered by the UK General Data Protection Regulation (UK GDPR), which concerns the handling of personal data.
As CCTV footage of individuals can enable an identification of individuals, it will fall under the UK GDPR. The care home management, as surveillance operator, will be collecting personal data and must comply with GDPR as a ‘data controller’.
When starting a project like this, it is important to bake privacy by design into the early stages of the planning process. This means understanding your obligations as set out in the UK GDPR.
A Data Protection Impact Assessment, which can be supported by law firms such as ours, is a good starting point to identify and minimise the data protection risks of a project. This will help ensure compliance with the data processing principles of fairness, accountability, transparency and respect for the rights of individuals, and that you are clear on your lawful basis for processing the CCTV footage.
There are other things that operators must think about. For example, organisations must tell people they may be recorded, usually by displaying clearly visible signs, as well as control who can see the recordings and make sure the system is only used for the purpose it is intended for.
Data subjects can also ask to see the images recorded of them under subject access requests. This is not a comprehensive list, and there are other things to consider.
The Care Quality Commission and Information Commissioner’s Office also provide CCTV guidance and checklists on their websites to help operators in navigating their legal obligations.
New procedures, policies and staff training will be required
Robust governance systems would need to be introduced along with any new surveillance system. This should include policies and procedures for how data is handled, who can access it, how long it is stored for, and what would happen in the event of a data breach.
Staff will need to be trained on their obligations and this training will need to be kept up to date, a challenge given the existing pressures on the care sector.
There may also be employment law implications – for example, whether existing contract terms include allowance for staff to be brought under surveillance, and considering amends to future contracts.
More practically, care homes should consider the impact of this on recruitment and retention, which is already a significant challenge across the sector. It is likely there may be some staff opposition to this type of project, so senior managers must be prepared for how they respond.
Ultimately, this is a balancing act between protecting residents, staff, third parties and indeed the care home operator itself. With much to contemplate, thinking everything through carefully and making adequate preparations to ensure compliance is vital should CCTV be installed.
