Surveillance and Monitoring

Managers and providers will carefully consider the specific purpose and role of any surveillance and monitoring used in the premises, including whether there are other, less intrusive, ways and means to keep young people safe.

Young people are at the centre of practice within the premises, and they should be informed (as early as possible after admission) about any monitoring and surveillance systems in use and the reasons for having it in the premises, as well as the safeguards in place regarding confidentiality and the retention of images.

The Accommodation Standard requires the registered person to  only use devices for monitoring or surveillance in communal areas and then only if:

• The monitoring and surveillance is for the purpose of safeguarding and promoting the welfare of young people;
• Each young person’s accommodating authority consents in writing to the monitoring or surveillance;
• Young people are informed in advance of the intention to carry out  monitoring or surveillance;
• The monitoring or surveillance is no more intrusive than is necessary, having regard to each young person’s need for privacy.

Surveillance and Monitoring in Residential Childcare Settings (Ofsted) provides that:

• Young people, parents  and social workers should give consent to the use of surveillance and be informed how to make a complaint about its use, if necessary;
• The use of surveillance and monitoring devices should be for the protection and safety of young people  only and not staff;
• The use of surveillance as a 'default approach' to monitoring young people’s  behaviour is not acceptable, neither should groups of young people  be subject to 'indiscriminate monitoring';
• CCTV monitoring screens should only be accessible to those staff who need to see the images at the time, for example, in a staff office where there is appropriate privacy;
• When CCTV or audio monitoring is used, plans must include how enough staff will be available to continually monitor images and to take immediate action to safeguard young people without reducing the quality of care provided in the premises;
• The impact of the surveillance or monitoring devices on individuals and their privacy should be considered. Regular reviews should take place to ensure that its use remains justified;
• Images and information should be stored securely, for their stated purpose, and only for as long as necessary;
• Security arrangements for sharing footage, for example, when used as evidence in court hearings, should be included in the setting's written policy.

These principles are based on the Home Office Surveillance Camera Code of Practice which provides guiding principles which if followed enable an organisation to demonstrate that the operation of its surveillance camera systems is to a lawful and ethical standard. Relevant authorities such as the police and local authorities are required by law to have regard to the code. However, all operators of surveillance camera systems are encouraged to voluntarily adopt its principles.

When considering any use of surveillance and monitoring in the setting, it is important to balance the rights and freedoms of young people, visitors and staff with the need for and purpose of the surveillance.

The Human Rights Act 1998; Data Protection Act 2018; Protection of Freedoms Act 2012 (POFA) (which regulates surveillance systems) and the Freedom of Information Act 2000 (FOIA) provide a framework to enable this balance to be achieved, and it is important that all guidance and regulations are adhered to.

The Surveillance Camera Buyers Toolkit suggests completing the following prior to installation and use of a surveillance system:

Statement of Need

This should consider what is the purpose of the surveillance/monitoring, and could that purpose be achieved by other means? Is a surveillance/monitoring system the most appropriate solution?

Risk Assessment

This should consider what are the risks to data subjects raised by the deployment of surveillance cameras? Is the impact on individuals’ rights and freedoms proportionate to the problem you are addressing? Can the risks be reduced to an acceptable level? 

Data Protection Impact Assessment 

One specific area of risk which arises with any surveillance camera system is the risk of interfering with people’s privacy. Whenever you capture someone’s image on your system you are processing their personal data. The collection and storage of data that can be used to identify an individual must be processed fairly and within the law. Processing such personal data can only be done lawfully by following the requirements of data protection legislation which is regulated by the Information Commissioner (ICO). Under the General Data Protection Regulation and the Data Protection Act 2018 most surveillance cameras will require a Data Protection Impact Assessment (DPIA). This should be started at an early stage before installing a surveillance camera system.

Guidance: Data Protection Impact Assessments for Surveillance Cameras contains DPIA guidance and a DPIA template which can be used by organisations to conduct data protection impact assessments for their surveillance cameras or surveillance camera systems.

This is not a one-off exercise. Privacy impact should be reviewed regularly and whenever fundamental changes are made to the system (such as when cameras are added, removed or their view repositioned). 

If you decide to process personal data through a surveillance camera system you will be a controller under data protection law. As a controller you will be responsible for completing a DPIA. In doing so, these are some of the important factors to consider:

• The effect on individuals;
• Identify the responsibilities of people involved in processing data and the Data Protection Officer who you must consult over your DPIA;
• Review policies are in place;
• Only required information is held;
• Images are not stored longer than necessary;
• Only authorised and trained people can review images and recordings;
• Any associated information such as databases should be adequately protected.

Under the Data Protection Act 2018 and GDPR, if you are unable to mitigate the privacy risks adequately, you have to submit your DPIA to the ICO for review.

The Home Office Surveillance Camera Code of Practice draws on and reinforces data protection obligations in relation to video surveillance.

See also information from the Information Commissioner’s Office on Data Protection Impact Assessments.

Good practice includes consulting with anyone who may be affected by the surveillance before you proceed; this should form part of your Data Protection Impact Assessment.

Once you start to operate your system, you must inform people that they are under surveillance. The Surveillance Camera Buyers Toolkit contains an example of a Privacy Notice to inform people about surveillance.

Right to be Informed (Information Commissioner’s Office) sets out that:

• Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the UK GDPR;
• You must provide individuals with information including: your purposes for processing their personal data, your retention periods for that personal data, and who it will be shared with - ‘privacy information’;
• You must provide privacy information to individuals at the time you collect their personal data from them;
• If you obtain personal data from other sources, you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month;
• There are a few circumstances when you do not need to provide people with privacy information, such as if an individual already has the information or if it would involve a disproportionate effort to provide it to them;
• The information you provide to people must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language;
• It is often most effective to provide privacy information to people using a combination of different techniques including layering, dashboards, and just-in-time notices;
• User testing is a good way to get feedback on how effective the delivery of your privacy information is;
• You must regularly review, and where necessary, update your privacy information. You must bring any new uses of an individual’s personal data to their attention before you start the processing;
• Getting the right to be informed correct can help you to comply with other aspects of the GDPR and build trust with people, but getting it wrong can leave you open to fines and lead to reputational damage.

Surveillance and monitoring devices include CCTV (both with and without voice-recording); listening devices; location trackers on personal electronic equipment; door sensors; noise sensors and movement alarms.

Some equipment, such as listening devices, can be used to monitor individuals, (for example where there are health or emotional well-being concerns). Note that audio-recording is considered as being particularly intrusive and so should be avoided unless there is a clear reason for it. 

Other equipment may capture activity in the environment, for example body-worn cameras, exit alarms, noise sensors and movement-activated mats.

CCTV: is closed-circuit television system on a private network. Footage is monitored mainly for surveillance and security purposes. The system uses strategically placed cameras that send the images to monitors placed elsewhere.

If a setting uses CCTV to monitor places of public access, such as the exterior of a building, there should be clear notices alerting the public to its presence and the reason for its use. The notice should include contact details in order to enable a person to access and review any images of them (this is called a subject access request (SAR)).

Where external monitoring systems are installed, care must be taken to ensure that this does not extend to cover beyond the premises and its grounds. Where the setting has immediate neighbours, guidance recommends that neighbours should be involved and listened to. Surveillance/monitoring systems which covered neighbouring properties, albeit unintentionally, could be found to be infringing the privacy of neighbours.  This could be CCTV cameras and also features such as ‘smart’ doorbell cameras. Care should be taken to check the range of any such devices, and it should be noted that such devices are likely to capture audio footage at a greater range than video footage, therefore care must be exercised if audio capture is enabled on external devices.

For further information see Domestic CCTV systems - Guidance for People Using CCTV (ICO)

CCTV must not be used to replace or supplement staffing.

Monitoring of personal electronic devices: this includes monitoring the use of a young person’s own laptop, desktop, tablet, mobile phone or any other personal electronic device. This must be carried out with their permission.

It is permissible to monitor online activity if it relates to the use of filters and monitoring the effectiveness of those filters to protect young people from exposure to inappropriate online material and contact. This activity must be included in the setting’s  written policy and procedure.

 (Please note: online filters should not be used as substitute for on-going discussions with young people about their online activity and how they can keep safe. See also: Safe Use of the Internet, Social Media and Photographs Procedure).

Covert Surveillance: Important note - only a court can sanction covert surveillance. This is where the monitoring of an individual is carried out in a way they are not aware of. This might include equipment such as hidden cameras and /or listening devices or secretly following the person. The Regulation of Investigatory Powers Act 2000 governs the use of covert surveillance by public bodies.

The young person’s Care Plan should include the reasons and rationale for any surveillance. This should be based on an individual risk assessment and agreed with the accommodating authority’s social worker. Parents, young people and social workers should be involved in regular reviews about whether surveillance remains necessary. 

See also Care and Pathway Planning Procedure and Risk Assessment and Planning Procedure. 

Personal mobile phones and other personal devices should not be used for surveillance activity. 

All staff must be trained in the use and purpose of monitoring and surveillance systems e.g. setting door alarm systems.

All staff must be aware of the purpose and function of such systems and how they positively relate to each individual young person.

Staff should have regular updated training on handling information gathered by monitoring or surveillance. This should include:

• What to do when people ask for access to recordings;
• How and when to share information;
• What to do if there are complaints about surveillance;
• What to do if young people withdraw their consent to surveillance.

• Images and information should be stored securely, for their stated purpose, and only for as long as necessary;
• Recordings should be stored in a secure place at the premises;
• Security arrangements for sharing footage, for example, when used as evidence in court hearings, should be included in the setting's written policy.

The setting must also include local information specific to the individual premises, covering the following:

See local information.

• The legitimate purpose and aim of the surveillance, with each purpose and activity individually addressed;
• How the surveillance will keep young people  safe;
• Why surveillance is the best way of achieving a young person’s safety;
• How any data is processed and stored;
• What security measures are in place to safeguard against unauthorised access and use;
• How often the surveillance activity will be reviewed to ensure that it is still necessary;
• How surveillance and monitoring activities are agreed with the accommodating  authority  and young people;
• How others (for example, health visitors) are notified that they are being recorded.

Legislation, Statutory Guidance and Government Non-Statutory Guidance

Surveillance and Monitoring in Residential Childcare Settings (Ofsted)

Home Office Surveillance Camera Code of Practice and  A Guide to the 12 Principles.

Surveillance Camera Buyers Toolkit - this guide is intended for anyone in any organisation up to and including small and medium sized enterprises buying a surveillance camera system who wants to maximise their chance of success (and minimise risk) by observing the principles of good practice.