Covert CCTV Monitoring in the Workplace?

An Inquiring Mind asks: "A good friend's employer has recently installed a CCTV system in the office she works at. This is not unusual in itself, but there is no notice that CCTV is in use, and no company policy regarding CCTV use in employee monitoring, data retention, or anything else. My understanding is that CCTV use in the UK is covered by the DPA (Data Protection Act) if: it is used to gather information about an individual; is monitored remotely; or is given to people other than law enforcement bodies (this from a CCTV/PDA document [pdf], from the website of the Information Commissioner's Office). If it does fall under the remit of the DPA, then they would need at least signage, and a policy for the retention of the data. Given that this camera would likely fall foul of the DPA, that challenging the employer would be career suicide (due to internal politics), and that she has nothing to hide -- what do other Slashdot readers think should be the next step for my friend: principled but suicidal stand, or quiet annoyance?" Much of what is allowed depends on the law of the land in your area. Depending on what the laws do and do not allow, how would you safely approach your employers to air your concerns on this subject?

I work from home...

[noopy]

... so if they have secret cameras, they, well... ... they keep paying me;-)

Data Protection Registrar

[EvilMagnus]

Just report it anonymously to the DPA. They do follow up on these things, you know. Even for things like keeping names and addresses in Excel spreadsheets, let alone cctv cameras.

Re:Data Protection Registrar

[cmdrbuzz]

Just report it anonymously to the DPA.
Sound advice. Part of my job can involve collecting information for an investigation within the Bank, without the subject being aware that we are looking at what they are doing.

However it is all detailed that the Bank *may* carry out Special Investigations should the need arise, in the employee handbook and with the DPA.
If we run afoul of the DPA we are in BIG trouble and would expect an internal smackdown, not to mention the external repercussions.

You have to ask, if the company are willing to break the law with regard to the DPA, what else are they doing?

IANAL

[HoosierPeschke]

In the US, it is illegal to have CCTV in the workplace without a posted notice. If you have a union you should bring it up with them. I recently went through a Labor Relations course where we when through various cases and I distinctly remembering a company being in trouble for having a CCTV system without notice.

The Act is called the National Labor Relations Act, you should see if you have something similar. More info on different cases can be found here [nlrb.gov].

Re:Safely approach?

[tomhudson]

Just so happens that I build/sell those systems, so I also know their weak points.

You can buy laser pointers for a couple of bucks a piece. I have one handy that I use to tease my dogs with (they love chasing the dot), plus a cctv camera hanging around, so I just tested this to make sure.

Shine the pointer into the camera. You can blind it from 50' away if you have a steady hand.

It may not be that illegal

[Anonymous Coward]

Students' personal stuff was being stolen from their homeroom lab. They put in a couple of covert cameras and caught one of the janitors. They turned the video over to security and the janitor was sacked. The security chief (an ex police inspector) then suggested that maybe the class should have a lecture on the legality of what they had done. There was no hint that their taping was illegal. The lecture was mostly about the conditions they had to meet for the video to be accepted as evidence in a court of law.

Depends on the employer

[Anonymous Coward]

Would your friend say that they're a generally "good" employer? Would she want to keep working there? There's always the risk that her name could be made public, despite her wishes, during any action.

If you want advice, somewhere like the Citizen's Advice Bureau or her Trades Union (taking along any relevant contract of employment) would be a good starting point. Depending on what a workplace CCTV camera is actually doing and (most importantly) what the company has said that it is doing with the data the company may or may not be abiding by the data protection act or not. Even if they aren't now, a simple declaration may be all it takes to abide by the law (with the camera staying, which may not be what your friend wants). The ICO would be a useful organisation to contact but (from experience) not until you've definitely got a case.

If you want someone who's likely to campaign on your behalf, try "Liberty" (http://www.liberty-human-rights.org.uk/ [liberty-hu...hts.org.uk]). People have certainly made interesting use of the 1998 act (see http://www.fnord.demon.co.uk/mt/fifth/cctv.html [demon.co.uk]).. .

Another possibility, although a bit of a long shot, would be the Human Rights Act (http://www.opsi.gov.uk/ACTS/acts1998/19980042.htm [opsi.gov.uk]). It's pretty vague in places, and while it's unlikely that said cameras interfere with e.g. "... the right to respect for his private and family life ..." it might be worth reading.

The usual caveats apply - I'm not a lawyer, but have been involved with the deployment in a camera system at a former employer in the past, and was involved with the discussions as to legal requirements (then under the 1984 act) re data retention policy and security, and later of the effects of the 1998 act (on non-camera data).

Re:Safely approach?

[tomhudson]

Its not that hard - you're aiming at the lens, not the ccd. The lens does the job of focusing it onto the ccd. Hit the lens pretty much anywhere and the results are bad. The further away, the better, since the "dot" gets bigger, so you need LESS steadiness, not more. But the best part is that its a lot easier to aim than you think - just "walk" the dot across the wall with your hand resting on a desk or other stable surface.

The cameras typically have sensitivities well under 1 lux and their backlight/brightness compensation circuitry can't cope with a laser. Like I said, I tested it with a cctv cam I have hanging around for testing purposes when I build these things, so I know a few of their weaknesses.

Re:Quiet annoyance

[tomhudson]

he company must deal with storage and handling of the media (tape or DVD); if any incident occur they must go back in time, search for a while, then hope the picture is clear, and in most case it will have no value in court. It's a lot of annoyance for little ROI. But anyway I don't mind being on camera myself, as long as pictures of me spilling coffee in the fax server don't get on "America's Funniest Videos".

Todays setups are much better. Motion and alarm triggers, a decent-sized (705x480) picture, 25 frames per second, with audio, viewable in real time and searchable over any network or the internet. Infrared cams that will pick you out in the dark when you can't see your hand in front of your face (they're fun to experiment with - they use infrared LEDs to light up stuff up to 30 feet away as bright as day). Easily searchable, and you can store up to a year if you don't mind setting up a JBOD. A couple of terrabyes of storage isn't that expensive any more, and mp4s don't take up nearly as much space as you'd think.

Well..

[rabbitfood]

The quickest start would be to go to the information commissioner's website (http://www.esd.informationcommissioner.gov.uk/ [informatio...ner.gov.uk] and see if your employer is registered to process employee data. Chances are they might be. If they're not, then you've got them. Failing that, they should (though it is not a legal requirement) comply with the codes of practice (http://tinyurl.com/dlwqr [tinyurl.com] [www.ico.gov.uk]). The first paragraph of which points out that guidance on targeted surveillance of employees is 'forthcoming', so you might have to wait a bit if that's what you're worried about. If you're really impatient, you could report them to the Information Commissioner anyway. This is quite simple, and, providing you can prove (a) it is their intention to use captured images illicitly (b) pictures of you in an office constitute significant personal information and (c) that the cameras aren't be used for monitoring the 'security of the premises' or for 'public and employee safety', it would seem you've got a cast-iron case.

Re:Just ran across this, in the bigger context - U

[Bogtha]

This wasn't published by any "London Guardian" paper. You guys that modded this up to +5, Informative got trolled.

The original article, published by The Guardian, is here [guardian.co.uk]. Note the distinct lack of accusations of being "shills for the establishment". Note the distinct lack of any mention whatsoever of blanket smoking bans, ASBOs, or putting cameras in people's homes. That paranoid speculation comes from here [prisonplanet.com]. A website so credible, its main sections are: Occult Elite | Loss Of Freedom | Scams & Cover-ups | Vote Fraud | World Government | Political Murders | Geopolitics. This is kook fodder, guys!

There is no blanket smoking ban in the UK. There will be a ban on smoking in pubs and restaraunts in Scotland very soon. Tobacco is still legal, you just can't smoke in public where people are eating and drinking.

ASBOs are Anti-Social Behaviour Orders. Basically, you can be punished for anti-social behaviour. For instance, kids who repeatedly throw bricks through their neighbours' windows. Not so scary when it's not a meaningless acronym, is it?

The age of the telescreen is upon us as surveillance cameras that festoon our streets, shopping malls and airports are now moving into our private homes as the panopticon prison is erected.

More nonsense. The UK government aren't installing cameras in anybody's homes. Not that this guy would know that - this uninformed nonsense comes not from a British source, as is claimed, but an American worried about the Occult Elite World Government.

Liberty, the group supposedly tasked with defending privacy rights in the UK, revealed itself to be a shill of the establishment in refusing to oppose the measures.

Maybe they can't oppose the measures because they exist solely as paranoid delusions. I'll admit that CCTV is widespread in the UK, but the things that this article claims are happening simply aren't. And the thing that set this guy off on his rant? It's a proposal, as the Guardian article makes clear. It is by no means law yet. I quote:

Tomorrow's transport committee session and a further meeting next week will examine how far this technology can be expanded and what use can be made of the data. Evidence will be presented by bodies representing the police and organisations that campaign on road safety.

Any attempt to widen the application of camera surveillance is likely to be strongly resisted.

Data Protection Act request

[welshie]

If this is the UK (or elsewhere in the EU, which has broadly similar legislation).. Get your friend to serve their employer with a Data Protection Act request (no need to contact a lawyer), asking for all data pertaining to themselves and their movements recorded by the company. The person holding the data can charge a reasonable fee (no more than GBP 10, I seem to recall). This covers CCTV systems, computer records and paperwork. If nothing is forthcoming regarding the CCTV footage, report them to the Information Commissioner (see http://www.data-protection.gov.uk/ [data-protection.gov.uk] , there's plenty of good information there)