How long should CCTV footage be kept?
In the world of easy recording, looping and generous server access, it is possible to store data and CCTV footage for years. However, should you be keeping CCTV footage for an extended period of time?
There are laws and guidelines to ensure that CCTV operators record footage only for legitimate reasons and store it securely for periods that do not threaten people’s privacy rights.
CCTV footage data storage first principles
The answer to storage duration questions about CCTV footage lies in your reason for collecting data in the first place.
As with any personal data, the ICO says that you should only keep it “as long as you need it.” There are no set time limits in data protection law because retention depends on your circumstances.
If you have a lawful basis for processing personal data, you must be able to justify how long you need to keep data – including CCTV footage – based on your reasons for collecting data in the first place.
Destroy CCTV footage when there is no legitimate reason to keep it
If a company collected personal data in order to provide a quotation for services and the potential customer declined the quotation, or indicated their intention not to proceed with the works, there would be no legitimate reason to hold their data. Personal data might include name, address, email and other information required for the initial quotation.
In the case of security cameras, there would be no justifiable reason to keep CCTV footage containing people’s personal data when no incident or crime had been recorded.
Car park operators may operate CCTV and ANPR for issuing entrance tickets, payment tickets and penalty notices, for tracking occupancy and locating missing vehicles.
Once the CCTV footage and ANPR records, or any collected data, is no longer current or ‘in process’ it must be destroyed or, for business analytics purposes, anonymised.
What is the recommended period for storing CCTV footage?
Storing CCTV footage for 31 days is the ‘rule of thumb’ recommendation.
The police recommend 31 days as the standard amount of time that CCTV footage is stored, on the grounds that footage relating to incidents can be accessed in that time.
The formula is different for low-risk sites and properties, when 14 days is considered sufficient time to access CCTV footage. Therefore, it is recommended that CCTV footage be deleted after 14 days.
When the CCTV footage captures an incident, the footage may be stored for longer than recommended, and as long as necessary.
Should all data be destroyed when it is no longer needed?
According to the law, certain types of data must be kept for extended periods of time.
In the majority of cases, the data that is required to be kept for lengthy periods – i.e., a specific number of years, and sometimes indefinitely – will be held in paper or electronic formats. A sample of data required to be held for three or five years, or indefinitely, includes:
Billing documents
Employee insurance
Annual financial statements
Employee pension information
Bank documents
Audit reports
Land ownership documents (indefinitely)
Customs documents
If any aspect of these or other records, such as HR records, were held in video format, you would need to store the video footage for the mandated period of time. The fact that video was being recorded for any of these purposes would also need to be made clear in your data processing and privacy policies.
Publish the purpose of CCTV use and storage information
Keeping personal data for longer than it is needed could very well be interpreted as an infringement of people’s privacy rights.
It is therefore important to communicate clearly:
Why do you need the recordings
How will the recordings be used
How long you will keep the recordings
How will you keep the recordings secure
How will you limit access to the CCTV and recordings
Failure to be transparent about your data capture reasons and your operational practices will result in breaches of GDPR.
The ICO also specifies that certain types of data require “special protection.” Therefore, transparency failures or wrongful storage will apply especially to data and video recordings concerning:
Racial or ethnic origins
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data
Health
A person’s sex life or sexual orientation
How long should you store private CCTV camera footage?
It is legal for anyone to install CCTV systems on their properties, if they have legitimate security concerns for doing so.
Individuals must abide by privacy laws that protect the rights of people, which includes the permitted length of time for keeping CCTV footage.
As with commercial CCTV use, privately obtained camera footage can provide valuable information on incidents and may help the police to identify and catch criminals.
It is the camera operator’s responsibility to store the recorded footage safely and delete it after a certain time.
The time limit recommended by the police for storing private CCTV footage is 31 days.
Long-term CCTV camera footage storage
When an incident, accident or crime is captured on CCTV and an investigation ensues, it is recommended that the relevant footage is moved to a separate storage device.
In such circumstances, claim proceedings involving the recorded footage may continue for years after the event.
It may be necessary to store ‘event’ footage for longer periods of time to facilitate a legal process, or to use as evidence when allegations are made against you or your business.
