"They have been instrumental in solving crimes or preventing their commission."
"They have been instrumental in solving crimes or preventing their commission."
Every now and then we hear horror stories about CCTVs being installed in places where there is a reasonable expectation of privacy such as in fitting rooms, restrooms, and similar places. Conversely, we also hear of stories wherein defective CCTVs in public areas – where they are expected and assumed to be operational – were not able to capture the commission of a crime, accident, or public disturbance.
There are also instances wherein a homeowner in a subdivision or village would like to know who visited him while he was away, only to be informed by the village security that the CCTV was under repair. It may even be worse than a visit – the unknown visitor may have taken personal property, a pet, or may have facilitated the kasambahay or house helper’s unsanctioned departure.
Undeniably, CCTVs have been instrumental in solving crimes or preventing their commission. We have seen footage of offenders being caught red-handed. Examples include stabbing a victim, selling illegal substances, unauthorized entry into private premises, stealing a motorcycle, or damages or injuries due to reckless driving, among others.
A CCTV is a closed-circuit television which records personal information. Personal information refers to any information, whether recorded in material form or not, from which the identity of an individual is apparent or can be reasonably ascertained by the entity holding the information (Section 3 (f), NPC 04-2020).
The use of CCTV systems for purely personal, family, or household affairs is outside the coverage of the National Privacy Commission (NPC) Advisory but is still subject to the privacy rights of every individual. Where a CCTV faces outward from an individual’s private property and captures images of individuals beyond the boundaries of the property, particularly as it monitors a public space, the CCTV system is therefore not for a purely personal, family, or household purpose (Section 5 (g), NPC 04-2020).
A “public space” refers to a space that is generally open and accessible to the public, such as highways, streets, footbridges, overpasses/underpasses, parks, plazas, sidewalks, and other similar spaces. On the other hand, a “semi-public space” refers to a space that, even if privately owned, is accessible to the public during operating hours, such as banks, educational institutions, hospitals, malls, offices, restaurants, transport stations, shops, and other similar establishments (Section 3 (j)(k), NPC 04-2020).
A person or organization that controls the collection, holding, processing or use of personal information is known as a “personal information controller” (PIC) (Section 3 (g), NPC 04-2020). The collection, holding, processing or use of personal information may be outsourced or processed through any natural or juridical person. The latter is known as the personal information processor (PIP) (Section 3 (h), NPC 04-2020).
Where can a CCTV be installed? The CCTVs shall be installed in places intended to be monitored. The location and angles of the cameras must be carefully determined to attain the purpose of the monitoring. The PICs and PIPs shall provide CCTV notices which are readily visible and prominent within their premises, such as at points of entry, or other conspicuous areas. The CCTV notices shall provide information to the public that there is a CCTV system in operation in clear, plain, and concise language (Section 4C, NPC 04-2020).
The use of CCTVs is allowed in strategic areas frequented by the public in local government units (LGUs). This is to help law enforcement officers prevent, deter, detect, and solve crimes. It is also allowed in the employers’ premises to protect their properties and assets, reputation, and business; however, they should always be mindful of the employees’ right to privacy (Section 5B and C, NPC 04-2020).
The employer should only resort to the use of the CCTV only if there is no other less intrusive means. The scope and terms of the use of CCTV in the workplace must be embodied in the company policy and the nature and extent of the monitoring by CCTV must be made known to the employees (Section 5C, NPC 04-2020).
The recorded CCTV footage must be stored in a secure place wherein its confidentiality and integrity are maintained and protected. Access to the footage is limited only to authorized persons. Access logs and the specific actions taken must be updated on a regular basis. Specific actions include transfers, reproductions, and access requests (Section 6, NPC 04-2020).
The PICs should restrict the monitoring of live CCTV feed and identify responsible persons who can monitor the live feed (Section 6, NPC 04-2020). Usual problems with CCTV monitoring include failures of collection or failures of recording, either because the CCTV was damaged or the CCTV footage had been immediately erased.
The NPC advisory provides that “there is no specific or fixed minimum or maximum retention period for CCTV footage.” It shall be retained only as long as it is necessary to fulfill the purposes for which the CCTV footage was obtained. Retention periods are not to be determined solely on the storage capacity of a system (Section 6, NPC 04-2020).
Who, then, can request access to the CCTV data or footage? A person whose image is recorded on a CCTV system has the right to access and/or be supplied with a copy of their own personal data from the footage (Section 7, NPC 04-2020). A person other than a data subject, may request for access to CCTV footage and shall be treated as a third-party access request (Section 8, NPC 04-2020).
The CCTV footage may be disclosed for the following purposes: (a) law enforcement and criminal investigations subject to standard operating procedures in the conduct of an investigation and law enforcement operation; (b) requests for disclosure of information upon a court order or subpoena; (c) the use of CCTV footage in an administrative investigation; or (d) requests by media subject to the codes of conduct and ethical standards of journalism (Section 8, NPC 04-2020).
The PIC is prohibited from disclosing CCTV images of identifiable individuals to the media for entertainment purposes, unless it is with the consent of the individuals concerned. Law enforcement agencies may release CCTV footage to the media on a case to case basis, considering the requirements of public order and safety, identification purposes, and other relevant factors (Section 8D, NPC 04-2020).
Where images of parties other than the requesting data subject and/or the person/s sought to be identified as part of the request appear on the CCTV footage, it is the responsibility of the requesting media personnel or journalist to mask the images of those other parties before making the footage public (Section 8, NPC 04-2020).
“Masking” refers to concealing parts of the video or still imagery from view, which may include masking certain body parts or inanimate objects that could potentially disclose the identity of an individual. The common types of masking include solid color masked areas, and blurred masking or pixelated masking, where the resulting images enable a partial outline to be seen but with detailed features obscured. This is very common in investigative documentaries or news accounts of pending criminal or administrative cases (Section 3 (e), NPC 04-2020).
The response to a request to allow access to the CCTV footage shall be two-pronged: either by viewing or providing a copy to the data subject him or herself or to a third party, as the case may be. The latter option shall be allowed when consistent with the purpose of the request (Section 10, NPC 04-2020). The PIC may charge the data subject or third party a reasonable fee for providing a copy of the footage (Section 11, NPC 04-2020).
PICs may refuse to give access or provide a copy of the CCTV footage in the following instances: (a) there is incomplete information regarding the requested CCTV footage; (b) the access request is frivolous or vexatious; (c) the purpose for viewing or obtaining a copy of the footage is contrary to law, morals, or public policy; (d) the burden or expense of providing access would be unreasonable; (e) the footage has been deleted by the time the PIC receives the request, pursuant to its documented retention policy; or (f) the sharing of the footage will put an ongoing criminal investigation at risk (Section 13, NPC 04-2020).
If the PIC denies a request for CCTV access, it shall state a justification for its denial. The determination of the reasonableness of the denial shall be made by the NPC upon the filing of a complaint by the data subject pursuant to the NPC’s rules of procedure. Any doubt in the reasonableness of denying, limiting or granting access to CCTV footage shall be liberally interpreted to uphold the rights and interests of the data subject (Sections 13,14 and 15, NPC 04-2020).
In the digital world we live in today, the collection and processing of our private data or information using various means is certain. We are subjected to biometrics when we apply for passports and visas to travel to other countries, or when we register to vote. We have to submit to QR code registrations when we visit restaurants, coffee shops, shopping malls and public buildings. We are even open to CCTV monitoring in the public places we visit. Hence, we must be prudent in our actions when in these places.
