Visitor access systems incorporating photographs

David Flint
Member - 3 posts

Mark,

Thanks for your enquiry.

A person's image is personal data of that individual by virtue of the Data Protection Act. However, unless your face discloses information about you that can be characterised as sensitive personal data it is offered no more protection than your telephone number or other every day personal data.



It is possible that a person's face could disclose sensitive personal data about that individual. For instance, a person's face may disclose a particular ethnicity or medical condition or religious persuasion. Accordingly, the safest way to proceed is to proceed on the basis that every photograph may involve the processing of sensitive personal data and plan to ensure fairness and lawfulness based on that standard.



This analysis, while unusual, should proceed along well known principles. For instance, if you want to take photographs of all external visitors to a business then you should provide fair notice of who the business is that is taking the photograph, the purposes for which the photograph is being taken and the uses to which it will be put and other information to make the processing fair. In this context, I think that that would involve an explanation as to why taking a photograph is regarded as a proportionate thing to do, details of a person?s right of access to the information that you hold about them and details of the person?s right to serve a notice stopping processing which causes unwarranted prejudice. I would also include details as to how the photograph will be stored and for what length of time and the class or classes of individuals who may have access to that photograph. Accordingly, if that photograph was going to be passed to any third party such as the Police or if it is going to undergo some automated decision making process then I would specify that in any notice.

I am presuming that you want to take individuals? photographs for the purposes of increasing the security of the building? This is a fairly onerous security access procedure and, as good practice, you should ensure that it is a proportionate thing to do.

If it is being done to prevent or detect terrorism then it can be done without consent if you can establish that it is in the substantial public interest for this to happen and it is necessary for the purpose of prevention or detection of any unlawful Act and that seeking the explicit consent of an individual would prejudice those purposes.

You would have some challenges here because it would be difficult to establish that this particular procedure was absolutely necessary for those purposes. Other less intrusive security access checks may accomplish the same thing. Also, if somebody refused their explicit consent could they simply not be denied access to the building, thereby maintaining the security of the building without imposing this process on an individual without consent?

In light of these difficulties, my suggestion in this particular circumstance would be to seek explicit consent in some manner. It need not be in writing but should be signified by some positive indication of consent and should be fully informed.

Human rights influences may also be important here. I am presuming that Nomura International are not a public sector body and so the Human Rights Legislation has no direct impact on you. However, any act which is seen to disproportionately impact on a person?s privacy is, at the very least, likely to increase the chances of negative publicity. To manage this I think that the Fair Collection Notice given to visitors to the building would have to be very clear and very full.

Hope this helps.

Regards

David Flint

Partner

Technology, Media and Communications Group

MacRoberts Solicitors

152 Bath Street, Glasgow G2 4TB

Scotland

(Tel: +44 141 332 9988; Fax: +44 141 332 8886)

URL: http://www.macroberts.com

E-Mail: df@macroberts.com

Anonymous

What is the difference between taking a photo and having cctv cameras in operation that automatically record all visitors to a reception area?