CCTV & Protecting Pupil Privacy

As schools are increasingly installing CCTV technology in an effort to keep pupils and staff safe, there is in debate as to how to strike a balance between safety and privacy. The facts are plain, CCTV cameras can enhance security and play a role in improving safeguarding measures, but what are the ramifications on pupils’ privacy, and what are the legal requirements?

The Role of CCTV in Schools

There are a variety of positive purposes that a CCTV system in a school can serve, from deterring vandalism to creating a safer feeling for pupils and staff. There are reports of schools that have installed cameras in the communal areas of toilets, which has led to less loitering and improved time in lessons, made pupils feel safer in these areas and even been requested by students themselves.

Legal Considerations and Privacy Concerns for CCTV Use in Schools

Despite the potential benefits, the use of CCTV in schools, especially in sensitive areas like toilets and changing rooms, can raise serious privacy concerns. There is currently no specific legislation concerning installing CCTV in sensitive areas, but schools must be mindful that according to the Data Protection Act (2018) and the UK General Data Protection Regulation (UK GDPR, any use must be ‘proportionate and justified’. Therefore, the risk of misuse highlights the need for careful management of the system and clear guidance around maintaining privacy.

The UK GDPR is guided by six key principles, which includes 'purpose limitation' and 'data minimisation'. Therefore, schools must adhere to these principles and determine the necessity of CCTV, ensuring that any data collected, such as images of pupils, are kept to a minimum. They should also be able to clearly define why they think CCTV is necessary and also consider less intrusive alternatives to address the same issues; one that impinges less on pupils' privacy.

Transparency and Parental Involvement

Having a clear rationale for the purpose and scope of CCTV surveillance is a starting point and this should be shared with parents and pupils prior to installation, minimising any potential backlash. This ensures a proactive and transparent approach, helping to set clear expectations, detailing how the data will be used and managed and addressing any potential concerns.

Schools must ensure that clear signage is posted wherever CCTV is in operation, providing contact details for further information on how individuals can exercise their rights under data protection law.

Additionally, prior to installation, schools should complete a data protection impact assessment (DPIA) to demonstrate compliance with UK GDPR principles.

Best Practices for CCTV Implementation

Schools should follow best practice when implementing CCTV to ensure the system is used appropriately and legally. This includes:

• Site Evaluation: By conducting a >risk assessment, give careful thought to camera positioning so that the objectives of the recordings are achieved without unreasonably violating privacy. Particular caution should be exercised in areas that enjoy a high expectation of privacy, such as toilets, these should only be monitored under exceptional circumstances.
• Data Security: The CCTV provider should be thoroughly checked to ensure that data will be securely stored and processed, including verifying that all data is processed to comply with UK GDPR as well as the school’s data protection policy.
• Processing of Data: The first principle of UK GDPR is ‘lawfulness, fairness and transparency’, so it is important to ensure that all data processing activities related to CCTV are conducted in a manner that respects the rights of individuals.
• Parental and Student Engagement: Involve parents and pupils throughout the decision-making process, ensuring that the introduction of CCTV is understood and supported by the school community.

There is no doubt that the introduction of CCTV can be a valuable tool for enhancing safety and security in schools. However, its use must be carefully managed to protect pupils' privacy. This can be achieved by adhering to the principles of the Data Protection Act and UK GDPR, by maintaining open communication with parents and students and having clear, thorough policies and procedures in place for its use.

Sara Spinks

SSS Author & Former Headteacher