Surveillance and CCTV use vs data privacy

Closed-circuit television (CCTV) systems have become ubiquitous in modern society. They serve as silent sentinels in the realm of security and surveillance. In the Philippines, the proliferation of CCTV cameras is evident in public spaces, commercial establishments, and even residential areas.

However, the use of CCTV is not without legal and ethical considerations, governed by a framework of laws, rules, and regulations designed to balance security needs with individual privacy rights.

In Quezon City, there is an ordinance that requires certain business establishments, including pawnshops and money changer shops, to install CCTV.

The Department of Interior and Local Government (DILG) has also urged cities and municipalities to enact their respective ordinances requiring the installation of CCTV systems by establishments.

In Congress, there is House Bill No. 8068, which seeks to require all businesses employing more than 20 workers and with work premises of not less than 50 square meters or those with transactions of at least  P50,000 a day to install CCTV or surveillance cameras.

Our fundamental right to privacy is enshrined in the 1987 Constitution, which provides that the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures of whatever nature and for any purpose shall be inviolable.

READ: The privacy of communication

Moreover, the privacy of communication and correspondence shall be inviolable except upon lawful order of the court, or when public safety or order requires otherwise, as prescribed by law.

The Data Privacy Act of 2012, or Republic Act No. 10173, (DPA) came into effect on Sept 8, 2012, and it outlines the principles, standards, and rights concerning the processing of personal information. Under this law, personal information must be collected only for a specified and legitimate purpose, and the data subjects must be informed of the nature, purpose, and extent of data processing.

The DPA also created the National Privacy Commission (NPC) whose task is to administer, implement, monitor, and ensure compliance with the DPA.

In this respect, the NPC issued NPC Advisory No. 2020-04 dated Nov 16, 2020 providing for guidelines on the use of CCTV systems.

Persons and entities that have installed CCTV systems must identify the legitimate purpose and consider its impact on the rights and freedoms of data subjects. They are reminded that the capture, use, retention, and destruction of video and/or audio footage obtained from CCTVs are forms of personal data processing under the Data Privacy Act.

Legitimate purpose for CCTVs include compliance with the law or regulation, security of properties, protection of interests of individuals, and public order and safety.

Some pertinent provisions of the NPC Advisory No. 2020-04 are as follow:

Private and public spaces

CCTV systems in households are considered purely for personal and family affairs. These are private spaces and are not included in the coverage of the NPC Advisory. Despite this, users of these systems must keep in mind the rights of every individual to privacy.

READ: Restrictions on CCTV use

However, when the camera faces outward and captures images beyond an individual’s property such as public spaces, the system shall not be considered as for purely personal and household purposes, such system will be expected to comply with the DPA and the NPC Advisory.

Public spaces refer to generally open and accessible to the public, such as highways, streets, footbridges, parks, plazas, sidewalks, and other similar areas. Semi-public spaces refer to areas that may be privately owned, but are accessible to the public during operating hours, including banks, educational institutions, hospitals, malls, offices, restaurants, transport stations, offices, shops, and similar establishments.

Recognized specific uses for CCTV systems

Some recognized uses for CCTV systems are:

• For Security Purposes.

• Employment setting where establishments are protecting their assets, reputation and business. CCTV systems monitoring employees’ use of company assets must respect the privacy rights in the workplace and only when surveillance cannot be achieved by other less intrusive means.

The use of CCTV in the workplace must be included in a company policy and employees should be informed of its nature and extent.

Lawful surveillance by law enforcement other government agencies are not subject to the provisions of the NPC Advisory, but are subject to the Constitution and other laws and regulations.

Location

The use of CCTVs in areas where individuals have a heightened expectation of privacy such as in fitting rooms, rest rooms, toilets, lactation or breastfeeding rooms, and other similar places, is prohibited.

Establishments must ensure there are CCTV notices which are visible and prominently displayed in the establishment, and the notice must provide information to the public that there is a CCTV system in operation in a clear, plain and concise language.

Data retention

Establishments operating CCTV systems must store the footage, which must be encrypted, recorded in a secure manner to ensure confidentiality, integrity and availability.

There is no fixed minimum or maximum retention periods for CCTV footage. Retention shall be only for as long as necessary to fulfill of the purposes.

Request for copy or access

Any person whose image is recorded on a CCTV system has a right to reasonable access and to be supplied with a copy of their own personal data from the footage. Requests for copies of the footage may be denied on the following grounds:

• Incomplete information;
• The access request is frivolous or vexatious;
• Purpose for viewing or obtaining a copy of the footage is contrary to law, morals, or public policy;
• The burden or expense of providing access would be unreasonable or involve disproportionate effort;
• The footage has been already been deleted pursuant to the establishment’s documented retention policy; or
• If sharing the footage could put an ongoing criminal investigation at risk.

There are other instances where CCTV footage may be released. These are when there is a court order, release to law enforcement agencies, administrative investigations where there is sufficient proof of the investigation being conducted or the pending complaint before an administrative body, to media if there is a lawful basis but with regard to the rights of the data subjects.

Release to media for entertainment purposes is strictly prohibited, unless with consent.

Where images of parties other than the person sought to be identified as part of the request, for example for identification of malefactors for investigation or law enforcement purposes, appear on the CCTV footage, it is the responsibility of the requesting media personnel or journalist to mask the images of those other parties before making the footage public.

Fees and charges

The establishment or controller of the CCTV footage may charge a reasonable fee for providing a copy to cover costs.

Time to comply with requests

Access to footage must be given within five days from request. For copies of footage, it must be given within 15 days or 30 days from the request if the requests are numerous and complex.

Despite the guidelines provided by the NPC, there remain many challenges for the responsible use of CCTV systems not to mention the potential for misuse or abuse.

While CCTV cameras undoubtedly enhance public safety, their omnipresence raises questions about the erosion of privacy in daily life.

There is a need to strike a delicate balance between security concerns and privacy protections, and we can expect that these guidelines will continue to be adjusted in the future.

The author, Atty. John Philip C. Siao, is a practicing lawyer and founding Partner of Tiongco Siao Bello & Associates Law Offices, an Arbitrator of the Construction Industry Arbitration Commission of the Philippines, and teaches law at the De La Salle University Tañada-Diokno School of Law. He may be contacted at [email protected]. The views expressed in this article belong to the author alone.