The world of Dash Cameras and Data Protection is split into 2 worlds. The world where you want to have them in a company vehicle where you are an ‘organisation’, and the world of the private citizen where they are there for insurance and hilarious YouTube compilation purposes.

Dashboard Cameras as they are known (Dash Cams for short because we love shortening words), have been revolutionary in the investigation of vehicle related accidents. Rather than relying on testimony of other drivers or the driver themselves, you can in most instances, see video footage of what exactly occurred and indeed who was at fault (if anyone).

A Dash Cam, however, is a mobile camera that is recording all that it sees all of the time. Not just a citizens private property or an organisations vehicle or an employee – it records the world around it, often in HD format and with audio thrown in for good measure.

Domestic uses:

Firstly, the question of Data Protection applying to citizen use of Dash Cams. While this is yet to come up under GDPR related case law, the biggest formal position on it comes from the Irish Data Protection Commissioner (DPC). In their guidance, they outline that in accordance with other caselaw on the domestic purposes exemption, use of a Dash Cam just cannot be justified as ‘domestic’. Therefore the GDPR (and local Data Protection legislation) would apply to that Camera and its ‘operator’.

In the UK, the Information Commissioner’s Office (ICO) have been fairly silent on the issue, as highlighted in Jon Baines recent blog post. And while I disagree with their silence, I can understand why. As Jon points out, it is a ridiculously tricky area to regulate in. The ICO has always steered away from citizen enforcement in favour of ‘larger’ issues and a more organisational focus. Can that continue? Possibly. For the moment the people ‘suffering’ the main issues aren’t the owners themselves (or even the ICO), it is organisations and Data Controllers that get embroiled in some issue that has come up.

It’s also worth noting, that several countries around Europe don’t even allow the use of Dash Cams. Austria, Portugal and Luxembourg all outlaw the use of such devices. Some countries have even gone so far as to provide guidance/laws on its use and when it can and cannot be shared. Germany, as an example, also state that you cannot record faces or number plates. But surely that negates the point of having the dash cam in the first place?

Practical advice:

You are never going to get a private citizen to do a DPIA (Data Protection Impact Assessment) on their Dash Camera. And with respect, anyone advocating that they should do one is deluding themselves – it’s not going to happen. So what about other aspects of Data Protection?

Principle 1: Fair, Lawful and Honest. Drivers should ask themselves what they want to use the camera for? Because the neighbour has one or because they are genuinely interested in protecting them and their vehicle. If the latter, then only record when you need to and make sure it’s just with your car insurance firm (also good for Principle 2, purpose limitation). Anyone else wanting access to it has to go through official channels or even issue a court order to get it from you.

People say the world needs more honest people in it. And I agree. So what possible harm is there in a car with a Dash Cam having a yellow camera sticker in the front and rear windows? No it’s not a full ‘privacy notice’ under Articles 13 or 14 but it’s something. Again, I cannot see a private citizen issuing citizens with flyers or a website link as they drive around. Or having it painted on to the car. Not – going – to – happen.

Principle 2: While YouTube videos are hilarious, you need to think about it. It’s not just Data Protection you have to worry about here. The right to privacy also kicks in. And posting a video of someone’s driving (as terrible as it might seem) would definitely land you in hot water. If you’re going to use them for such media purposes, I think you should definitely have a sticker with your channel name on it so they can find you and the video. I also believe you should blur faces and registration numbers from your videos. A fair compromise don’t you think?

Principle 3: Only record when necessary. Does your camera record everything or only certain instances? Ideally it should be the latter, then you aren’t collecting in hours and hours of video footage but instead just the few minutes of relevant footage that you needed. Find out how your camera records and keep it to a minimum (saves on the cost of storage space too!).

Principle 4: Invest in a decent camera. I’m not advocating in a telescope, but just a decent enough camera that you can clearly capture a registration number should an accident occur. If the images are so bad quality then why on earth do you have the camera to begin with? Bargain most certainly means bust where cameras are concerned.

Principle 5: How long to you retain images? If an accident occurred and you’ve still got the images a year later, why? It’s taking up storage and there is no need to as they should have been handed over to your insurer by then. Save yourself some headaches and only keep what you need.

Principle 6: Look after them. Make sure your camera is secured away and the recordings are too. That’s a good idea on multiple fronts to avoid someone pinching it out your car as well as a Data Protection concern.

Principle 7: Be a grown up about it. Fundamentally you are recording the big wide world, so be a grown up about it and think about it. It isn’t a private weapon to annoy the public or your neighbour nor is it an extension of the ‘big brother state’. Keep it simple, think about what you want it to do and why and be mindful and respectful of those legitimately going about their business that really don’t want to be on a compilation video on YouTube (and I don’t just mean the bad driver!).

While I don’t expect the ICO to produce any useful guidance on this any time soon, keep the above in mind and see this article from Which with some further information on formal programmes available to drivers on how to report accidents etc.

Lighthouse IG is a training and consultancy firm specialising in how to manage data and information effectively. If your organisation deployed cameras of any type we can support you with assessments, advice and training to ensure you can use the cameras, and the information they generate, effectively.