On June 15, 2023, the Office of the Data Protection Authority (ODPA) published guidance for CCTV users to help them ensure compliance with the Data Protection (Bailiwick of Guernsey) Law. The ODPA explained that the guidance is built around the seven data protection principles and provides a step-by-step process for CCTV users to follow.

On data minimization, the guidance highlights that controllers should consider the position of CCTV cameras to ensure they only record areas that are necessary in order to meet the purpose of processing, noting that it is important that staff operating the equipment are made aware of why it is used and that they are well trained, not just about its operation, but also about the implications of collecting data by filming in spaces not covered by the scheme.

With regard to storage limitation, the guidance provides that when deciding how long images should be kept, controllers must consider the purpose of the processing. For example, the guidance notes that where the CCTV is being used in a shop to capture any shoplifting, such incidents are likely to be identified quickly so a short retention period (such as 30 days) may be appropriate; whereas if the CCTV is being used to monitor unauthorized access to a remote building, visited only infrequently, a longer retention period may be appropriate. Importantly, the guidance details that the controller should document the reason for the decision.

Furthermore, the guidance provides a short checklist to help the controller establish if the principles are being followed.

You can read the press release here and the guidance here.