For reasons of external and internal security, some private companies install closed-circuit television (CCTV) or camera surveillance systems in their premises to record images of persons or information relating to them, including the area within its coverage.
With an integrated monitoring system, CCTVs are able to assist security personnel in the performance of their duties and responsibilities. Although the costs of their acquisition and operation is on the high side, over time they pay for themselves in terms of reduced security staff.
Although the information gathered by CCTVs is meant to be kept under wraps or used strictly for legitimate purposes, there had been instances in the past when CCTV recordings that involve private persons were posted on social media to the embarrassment of their subjects.
READ: Surveillance and CCTV use vs data privacy
In light of the privacy risks that have emerged with the extensive use of CCTVs in public and semi-public areas, the National Privacy Commission (NPC) issued last week Memorandum Circular 2024-02 that lays down the guidelines in the management of personal data processed through that system by personal information controllers (PICs) and personal information processors who operate in those areas.
Public areas are places where people usually converge for various reasons, while semi-public areas refer to indoor or outdoor spaces that, even if privately owned, are open or accessible to the public during their operating hours
The circular does not cover CCTVs for purely personal, family or household affairs. However, if the system captures images of people beyond the boundaries of private and noncommercial residences or establishments, particularly where it monitors a public space, the exemption will not apply.
Also excluded are law enforcement, intelligence and investigative agencies and other government offices that conduct lawful surveillance. Their operation and the use of gathered information would be governed by existing laws on those activities.
The circular underscored the need for PICs to prominently display notices about the presence of CCTVs in surveillance areas. These notices should indicate, among others, the nature, scope and extent of the surveillance and the capabilities of the system.
Through these notices, those who enter the premises are informed beforehand that their presence is being monitored or recorded from the time they come under surveillance until they leave.
By continuing to stay in the premises, they, in effect, agree to or have no objections to the surveillance. If they think that violates their privacy, they can simply leave and bring their business elsewhere, if any.
Although the installation of CCTVs is addressed to the discretion of a business, the circular does not give free rein on its use. The purpose of the data gathering should not be contrary to law, morals or public policy. The objective behind the surveillance has to be clearly determined, specified and made known to their intended subjects.
And even if those requirements are met, the system should be necessary and proportional to its specified and legitimate purpose. The PIC is obliged to regularly review its use to determine if its data processing could be done through less intrusive means, and if the data processed can be limited to that which is adequate, relevant, suitable and necessary.
The circular spells out, among others, the manner by which the data gathered should be managed, how requests by data subjects should be handled, and what information may be disclosed for purposes of law enforcement or criminal investigations.
Considering the limited resources of the NPC, it cannot be expected to act as an ever present policeman to enforce compliance with its circular.
At the end of the day, it is up to the management of businesses that want to install a surveillance system in their premises to decide whether there is a real need for it and if so, to ensure that it would accomplish its objective and will not infringe on the right to privacy of their staff. INQ
For comments, please send your email to rpalabrica@inquirer.com.ph.