Interesting stuff this. I'm am a lawyer so may be in a slightly better position to comment than others but please note this is
way off my normal patch! I have no expertise in this area at all. However, some observations:
1. This has nothing to do with the Human Rights Act. There is a right to privacy under the HRA but the protection it gives is against "interference by a
public authority...". With the best will in the world, Gaz, magnatom et al are not public authorities. The firm whose article has been quoted (a respected national firm) should know better than that!
2. This is to do with the Data Protection Act which is regulated by the Information Commissioner. I cannot possibly do a full analysis of the DPA (all 75 sections and 16 schedules) but, in essence, the DPA regulates the
processing by a
data controller (or a
data processor on behalf of the
data controller) of
data which is
personal data about a
data subject.
3. I could bore you witless with the details but it seems to me (a) likely that headcam vids will be
data within the meaning of the DPA (b) highly unlikely that the data will be
personal data (about a
data subject) (c) all things being equal,
processing is almost certainly involved and (d)
if the video contains personal data, the person taking the video footage will almost certainly be a
data controller.
4. On this last point, the DPA is clear that a private individual can be a data controller (s.5(3)(a)). Various posts seem to suggest that the DPA doesn't apply against private individuals. In my view it clearly does. However, the ICO's website does seem to focus on "organisations". I don't think that can be taken as evidence that the ICO's view is that private individuals aren't covered. It's a matter of focusing its attention where it is most needed i.e. on organisations. They're going to want to spend their resource pursuing truly awful cases of mass corporate misuse of personal data, not small beer like this.
5. As indicated above, it seems to me the key question is whether the footage amounts to
personal data. This is the definition lifted from the DPA itself (my emphasis added):
“personal data” means data which relate to a living individual who can be identified—
(a)
from those data, or
(b)
from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data
controller or any other person in respect of the individual;
6. Let's take some typical situations:
6.1
Magnatom's oil tanker. We have the licence plate number. We have the company name. There is nothing about that vid which enables us to identify the living individual who is the driver. Nor (I assume) did magnatom have other info or was "
likely to come into possession of " other info which would enable the driver to be identified. No
personal data. No problem. The same must surely go for just about any commercial vehicle except - perhaps - for ones which say something like "Basil Brush, Sole Trader : Tel 0121 123 4567"
6.2
The close pass (not obviously a commercial vehicle). Whooosh! We have the licence plate number. From that we can get details of the registered keeper (if we have "reasonable cause" - check this out
http://www.direct.gov.uk/prod_consu...n/@motor/documents/digitalasset/dg_193598.pdf ). But we had no clear view (or even any view) of the driver. We cannot identify the driver. Nor do we have or are likely to get info which will identify the driver. No
personal data. No problem.
6.3
The confrontation. Something has happened. We have the licence plate and the driver stops "for a chat". We get a very good look on vid at the driver. I'm still very doubtful that this makes it
personal data. How can we identify the living individual from the image? You can't - not without other resources / information. If you don't have it or aren't likely to get it then the vid simply is not
personal data. If they're very thick, they may say their name (has this ever happened?). Hmmm - not sure about that...
7. If you don't have
personal data, the
whole of the DPA regime falls away. There's no need to consider any of the rest of the Act. If you do have personal data, I'm sure there will be ways of interpreting the DPA advantageously (15 sections of the Act are dedicated to exemptions) - but you'd need a proper data protection lawyer for that!
If helmet cam users are worried about this stuff and they're not already CTC members, it might be worth joining up to get the legal insurance backup. Hopefully their lawyers would jump to the defence of someone who was being given legal grief of this nature!
mj
