This factsheet sets out how your business can become GDPR compliant.<\/p>\n <\/div>\n \n\nDownload Now<\/a> <\/section>\n <\/div>\n\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n
\n
The UK GDPR is the law which regulates the use of personal data. As recording customers will mean capturing footage that can identify them (i.e. their images), the UK GDPR rules apply.<\/p>\n<\/div>\n\n\n\n
There are a lot of rules to follow when recording customers, but it is vital to comply with them. Breaching the UK GDPR rules can lead to various negative consequences, including:<\/p>\n\n\n\n
- \n
- regulatory action with fines as high as \u00a317.5 million, or 4% of your worldwide annual turnover, whichever is higher;<\/li>\n\n\n\n
- claims from individuals whose rights you have breached; and<\/li>\n\n\n\n
- loss of trust from customers and severe brand damage. <\/li>\n<\/ul>\n\n\n\n
Key Steps to Ensure Your Recording of Customers is Legal<\/h2>\n\n\n\n
The UK ICO<\/a> (the data protection regulator) has issued guidance to help organisations ensure their recording of customers complies with data protection laws. <\/p>\n\n\n\n
The following checklist sets out the key steps to follow to ensure that your recording of customers is legal.<\/p>\n\n\n\n
1. Ask if You Need to Record Customers<\/h3>\n\n\n\n
From the outset, check if you really need to record your customers. Is it necessary, or is there another, less invasive way to address your concerns?<\/p>\n\n\n\n
2. Conduct a Data Protection Impact Assessment<\/h3>\n\n\n\n
If you decide you really need to record your customers and can justify it, carry out a \u2018Data Protection Impact Assessment\u2019. This is a risk assessment whereby you must consider the risks the recording poses to the privacy of customers and how to alleviate those risks. <\/p>\n\n\n\n
3. Implement Policies<\/h3>\n\n\n\n
You should implement a policy to document your procedures for recording customers (e.g. a CCTV policy). Likewise, appoint an individual responsible for your customer recording systems and compliance with your policy. <\/p>\n\n\n\n
4. Consider the Lawful Basis for Processing<\/h3>\n\n\n\n
When recording customers, consider and document a \u2018lawful basis for processing\u2019 (such as \u2018consent\u2019 or \u2018legitimate interests\u2019). The lawful basis for processing means the legal reason you are allowed to process personal data. You must also ensure that you use the recordings only for intended purposes. For example, if you intend to use footage to prevent crime, then ensure you are not using it to spy on staff. <\/p>\n\n\n\n
5. Inform Your Customers<\/h3>\n\n\n\n
Ensure your business can provide customers with information about how and why you will use their personal data. You need to give individuals a lot of information, including the identity of your business, your contact details and their legal rights. Some businesses display signs simply stating \u2018CCTV is in operation\u2019 \u2013 however, this is not enough information.<\/p>\n\n\n\n
In practice, this obligation can be difficult to implement. When customers are browsing your shop, it is hard to give them such detailed information. Practically, many businesses give individuals basic information and direct them to where they can find further information. For example, you could put up a clear sign stating that the customers are being recorded, with your business name and contact details. Also, include a website address where individuals can find more detailed information about how you will use the data. <\/p>\n\n\n\n
6. Register With the UK ICO<\/h3>\n\n\n\n
If you use CCTV for crime prevention on your business premises, you will need to register with and pay the UK ICO a yearly fee.<\/p>\n\n\n\n
7. Implement Procedures for Subject Access Requests<\/h3>\n\n\n\n
Implement procedures to respond to data subject rights relating to recording customers. Customers have various legal rights when you are recording them. For example, they can make a Subject Access Request<\/a> requesting copies of the images you have recorded. <\/p>\n\n\n\n
In practice, providing these images can be very difficult and time-consuming. Therefore, you should ensure you have a clear system in place for handling such requests. <\/p>\n\n\n\n
8. Minimise Recording Footage<\/h3>\n\n\n\n
It is important to minimise the amount of recording footage you collect and only keep it for as long as you need it. Implementing and following a data retention policy can help achieve this. You should document exactly how long you will hold the recording footage and when your business must delete it. <\/p>\n\n\n\n
9. Train Staff<\/h3>\n\n\n\n
If your staff operate recording systems, it is essential to provide appropriate training on handling the recording footage. Likewise, explain key UK GDPR rules surrounding recording customers and how to handle, store and delete data safely.<\/p>\n\n\n\n
10. Double-Check Your Systems<\/h3>\n\n\n\n
Finally, ensure you store the recordings securely, and you have data security measures in place to safeguard them. It is also critical to confirm the equipment (e.g. CCTV cameras, computers, hard drives) is in good working order. You want to ensure all images captured are of clear and high quality. Otherwise, blurry footage would defeat the purpose of recording customers in the first instance to prevent crime.\u00a0<\/p>\n\n\n
\n![\"Front](\"https:\/\/img.legalvision.com.au\/wp-content\/uploads\/sites\/4\/2023\/07\/04001038\/uk-gdpr-factsheet.jpg\")
\n \n GDPR Essentials Factsheet<\/div>\n\n