Using CCTV, Cameras or Microphones in Care Homes

 1. Introduction

This chapter outlines the procedures and guidelines for the use of Closed-Circuit Television (CCTV) and other monitoring equipment within care homes. The use of these may be necessary to:

• keep premises and property secure;
• help people stay safe without restricting their activities;
• protect people’s safety, for example, from the risk of unsafe care or treatment;

The Care Quality Commission (CQC) recommends that care providers seek legal advice about the installation of surveillance equipment.

There are two types of surveillance: overt and covert.

Care homes are more likely to use overt surveillance, in the form of CCTV cameras, in which case people should be informed – either verbally or by putting up clear notices – that CCTV is in operation. This ensures that residents, staff, visitors and contractors are all notified. In some circumstances, people may also need to give their consent (see Section 3.1, Consent).

Covert surveillance is when hidden cameras or audio recording devices are used, so people are not aware of their existence. These are only used in rare circumstances and should only be used for a short time, for example, in response to a specific incident or allegation.

If surveillance is used to help keep people safe or monitor their wellbeing, it forms part of their care and must, therefore, meet the regulations under the Health and Social Care Act 2012. The Act, aims to promote the involvement of patients and their carers in making decisions and choices in respect of the provision of health and social care services.

As people can be identified from CCTV images, the use, sharing and storage of these are regulated by the Information Commissioner’s Office (ICO).

 2. Principles for Using CCTV, Cameras and Microphones

When using CCTV, it is essential that:

• the privacy, dignity, safety and security of the adult is central to the process;
• the rights and privacy of residents, visitors and staff are protected;
• all legislation is followed relevant to the decision to use CCTV;
• care providers can demonstrate clear reasoning for their decision to use CCTV and can evidence its use as proportionate and justified, and its function and purpose. For example, to keep people safe, prevent and deter incidents of abuse, neglect, theft, or any other suspected criminal activities;
• there is a plan for data collection, processing, storage, disposal and sharing.

 3. Legal and Ethical Considerations

See Appendix 1: Regulatory Compliance

Care providers must be clear about the main purpose for wanting to use surveillance; there may be more than one reason. The purpose must be legitimate under data protection legislation, meaning it must be reasonable, lawful and appropriate.

If surveillance is being used for one purpose, any information collected cannot later be used for a different reason. An assessment should be carried out to check that surveillance is the best way to achieve the required aim. This should consider:

• if there’s something else you could do that would intrude less on people’s privacy;
• if surveillance is the best way to use your resources;
• whether the use of surveillance will help to ensure safety and quality of care and support the needs and interests of residents.

This means, for example, that CCTV cannot be justified as way of reducing staff numbers or just to give family members peace of mind.

Before deciding whether to install surveillance equipment, care providers must also explore whether there are any less restrictive or intrusive methods of ensuring safety within the care setting.

It is also important to consult with people who use services, their families and visitors when making decisions about surveillance.

Information to tell people about installing CCTV includes:

• why it is being considered (the purpose);
• what type of surveillance is being considered;
• where it may be used;
• what information will be collected;
• where and how the information will be stored; and
• who will have access to the information and how it will be kept.

All assessments and consultations with residents and families should be recorded and may be required by the CQC as part of an inspection. When CCTV and other surveillance is used in a care home, people need to understand why it is being used and agreed to this. If people lack the mental capacity to consent to this, their relatives should be consulted, and best interest decisions made. See Section 3.2, Consent and mental capacity.

Under the UK General Data Protection Regulations (UK GDPR), care providers and homes are classified as ‘data controllers’ and therefore must make sure that all data collated through surveillance is for ‘specified, explicit and legitimate purposes’. If sensitive personal data is likely to be collected, extra conditions under UK GDPR will need to be met (see Special Category Data, ICO).

To use CCTV in a care home setting, a designated member of staff must be registered with, and pay a fee to, the ICO (see Data Protection Fee, ICO).

If the rights and freedoms of residents may be compromised with the installation of CCTV, a Data Protection Impact Assessment must be completed and updated at regular intervals.

Both the Biometrics and Surveillance Camera Commissioner and the Information Commissioner’s Office have guidance for completing Data Protection Impact Assessments in relation to CCTV cameras:

• Data Protection Impact Assessments (ICO);
• Data Protection Impact Assessments for Surveillance Cameras (BSCC).

GDPR Article 6 states that data processing is only lawful if an organisation can evidence one of the following:

1. if the data subject gives their explicit consent or if the processing is necessary;
2. to meet contractual obligations entered into by the data subject;
3. to comply with the data controller’s legal obligations;
4. to protect the data subject’s vital interests or that of another person;
5. for tasks conducted in the public interest or exercise of authority vested in the data controller;
6. for legitimate interests pursued by the data controller.

Within a care home setting 1), 4) and 6) could be considered as the lawful basis. If the lawful basis is 6), the care home must weigh up the impact on the people’s interests, freedoms or rights in balance with the necessity of installing CCTV or other surveillance equipment.

3.1 Consent

See also Find out if You need Consent to use Technology as Part of Someone’s Care (Care Quality Commission)

Consent to the use of CCTV and other surveillance must be provided by people freely, specifically, positively (that someone chooses to) and unambiguously. Consent can be withdrawn at any time. People involved will be adults who use the service, their family and friends, staff, trade unions / contractors and other visitors.

The decision must be confirmed in a clear verbal or written statement, specific about the nature of the data and be separate from any other consent about other matters that a person may have given.

If staff are unable to get clear consent from care home residents, they must evidence that one or more of the exemptions in GDPR Article 9 (2) – special category data exemption – applies. An Article 9(2)(c) exemption is most commonly used ‘Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.’

The care provider should make sure that people are not discriminated against if they refuse consent and a plan should be in place as to how the use of CCTV can still be achieved, if needed and under the grounds as outlined in the relevant legislation.

Consent of members of staff are not needed if managers have a legitimate reason for installing CCTV; this outweighs their right to privacy but they should be notified that CCTV is being used.

3.2 Consent and mental capacity

To obtain a person’s consent to install CCTV, managers must provide written evidence of the ways they have tried to obtain consent. If a person lacks the mental capacity to make such a decision (because of dementia or another condition, for example), a mental capacity assessment must be completed to evidence this. If the assessment decides the person does not have the capacity to consent, then a decision must be made using the best interests decision framework that will involve the person’s next of kin, if appropriate, and other relevant professionals (see Mental Capacity and Best Interests chapters).

In certain situations, for example in private spaces like bedrooms, installing CCTV can be defined as a restriction within the Deprivation of Liberty Safeguards (DoLS), therefore the care provider must review the deprivation of the person and ensure that the supervisory body is informed with a ‘Form 1‘ if the person meets the ‘Acid Test’ (see Deprivation of Liberty Safeguards chapter).

If the person is subject to a DoLS, the supervisory body should be notified of this additional restriction within the home and the accompanying mental capacity and best interests assessments paperwork should be sent to evidence this fact. If the person is undergoing a Section 21 A challenge, their solicitor will also have to be notified and accompanying information will have to be shared with them.

 4. Privacy and Dignity

If the rights and freedoms of residents may be compromised, a Data Protection Impact Assessment (DPIA) must be completed. As part of the DPIA, the care provider must provide evidence how residents’ privacy and dignity will be maintained, as far as possible, at every point in the process. It must also demonstrate that less intrusive methods have been explored.

If the decision has been made to install CCTV in people’s private spaces, extra considerations should be given to personal care practices, such as ensuring that towels are used to ensure the person’s dignity. Details should be recorded in the person’s record / care plan.

Procedures for addressing any concerns, complaints, or requests related to CCTV should be established. It is important to remember that the data belongs to the person and as such, they may ask to view, correct, or delete it.

 5. Installation Monitoring and Access

If the care provider decides to use a third-party organisation to process data, it must ensure there is a clear contract and that all documentation relating to the CCTV is clear that a third party is involved.

Placing the camera must be specifically mapped, with clear reasons given as to why those areas are of legitimate and / or vital interest. Cameras must be strategically placed within communal areas and corridors, with minimum impact on people’s privacy and dignity.

Private spaces should not be monitored unless senior managers have identified a specific need in response to incidents or safety concerns, and this, therefore, would be in the adult’s best interests. Monitoring should be carried out in a proportionate and least restrictive way possible. Additional written justification must be completed including additional consents, mental capacity assessments, and best interests meeting records, if appropriate. The CQC must be notified when a decision has been made to use such equipment within private spaces. If CCTV is covert, it is recommended that the care provider gets legal advice on the matter. The Regulation of Investigatory Powers Act (RIPA) 2000 sets out specific considerations concerning such a decision.

Audio recording is considered highly intrusive and additional justification is needed to warrant a decision to keep the sound on during CCTV filming. It should only be used in very exceptional circumstances and only when:

• there is a clear need or issue that can only be addressed by audio recording;
• consideration has been given to lesser restrictive alternatives;
• the situation has been reviewed and it has been decided that any lesser restrictive alternatives will not address the identified need or issue, therefore the only way to do so is through audio recording.

5.1 Monitoring CCTV

There must be a named person responsible for the operation of the CCTV system and a register of people who can access the CCTV and for what purpose and in what circumstances. To comply with data protection legislation, access to the information collected should be limited to a small number of authorised staff.

5.2 Transparency

Transparency is vital to meet legal requirements and maintain the trust of the people who live in, and visit, the care environment. However, there may be times when the legitimate use of covert surveillance may prevent transparency for a short period. In such situations, documentation must evidence all decisions made and legal advice should be sought.

Discussions with people who use the service and their families, about the use of CCTV and the potential impact, must be documented.

Signs indicating the presence of CCTV cameras should be prominently displayed in areas where they are overtly used. Information leaflets and privacy notices must be given to anyone who could be recorded, including adults living in the care environment, visitors and staff. A privacy notice should also be placed on the care provider’s website including: stating the use of CCTV, its purpose and with whom it will be shared.

People who are being filmed should be made aware:

• of the people who hold their data;
• how it may be shared;
• for what purpose; and
• how permissions / consent to share this data would be sought in such circumstances.

5.2 Data processing, recording and storage

Details of the period the data will be kept for must be shared with everyone for whom the carer provider will hold footage. The retention period should be based on the purpose of the collection and comply with the storage limitation. People should be aware of under what circumstances and to whom their data could potentially be shared and the reasons why it may be shared. The data that is captured and retained should be the minimum time period for the stated purpose. Access to the footage should be kept in a restricted area or have a security system if it is stored in a cloud-type platform. All footage taken should have a backup data function and the recordings should be encrypted, if possible.

 6. Staff training

All staff should undergo information governance training and yearly UK GDPR training. Staff, who are listed as being able to access the CCTV system, should have specific and documented training on the use of the system and any additional and relevant ongoing training. The care provider’s disciplinary policy should clarify actions that will be taken for the misuse of CCTV equipment, data processing and storage. The use of CCTV equipment within the setting must also be part of the staff induction process.

 7. Legal Comment

Central to the justification of the usage of CCTV is how it will support the needs and interests of the residents of the care home. For example, in a case in relation to the protection of a resident in a suspected case of ill-treatment by a member of the care home staff, the test to be applied is whether reliance can be placed on the ‘legitimate interest’ ground in Article 6 GDPR.

The care home should consider whether (i) there is a legitimate interest (ii) the processing of the data is necessary for that purpose (iii) the legitimate interest is overridden by the individual’s interests, rights, or freedoms.

The use of CCTV create risks and appropriate modification should always be considered. Care providers should address whether the use of cameras is proportionate to specific concerns that may have arisen in the home or whether a less private intrusive solution could achieve the same objective.

On account of the legal complexities arising from CCTV in care homes, care providers should always undertake a thorough review of their policies to ensure they comply with the GDPR and seek legal input as to their use. Care providers should also have regard to the Code of Practice issued by the Surveillance Camera Code of Practice

 Appendix 1: Regulatory Compliance

The CQC inspect and monitor the use of CCTV using a framework of seven principles, under specified legislation. These are:

1. Safeguarded: Care providers must evidence that the recording equipment has appropriate safeguards (Regulations 12 and 13 of the Health and Social Care Act 2008, regulations 2014)
2. Secured: Care providers must ensure that the recording equipment is housed securely and be appropriate to the purpose for which it is used (Regulation 15 of the Health and Social Care Act 2008, regulations 2014)
3. Privacy: The privacy and dignity of the adult is central to all considerations when deciding and using recording equipment (Regulation 10 of the Health and Social Care Act 2008, regulations 2014)
4. Involved: The adult must be involved in decisions when using recording equipment both within the home and in private rooms (Regulations 9 and 11 of the Health and Social Care Act 2008, regulations 2014)
5. Lawful: Care providers can evidence that they have identified the specific legal basis for CCTV use and there is compliance with all relevant legislation and codes of practice (Regulation 17 of the Health and Social Care Act 2008, regulations 2014, GDPR, Human Rights Act 1998, the Information Commissioners Office, the Mental Capacity Act 2005)
6. Trained: Staff are trained on the use of the recording equipment and information governance (Regulation 18 of the Health and Social Care Act 2008, regulations 2014)
7. Transparent: The recording equipment is used openly and transparently (GDPR Article 5 principles).

Appendix 2: CCTV / Cameras / Microphones Home Implementation Checklist

Action needed	Person responsible	Date completed	Date reviewed
Evidence of considerations into lesser restrictive options.
Documented consultation process of the decision to install CCTV, including residents, relative and one to one meeting.
Identified person in charge of CCTV and all aspects surrounding it .
Documented consideration into storage, access and  time retention period including a register of personnel who have access,  for what reason and when.
Completion of the Data Protection Impact Assessment.
Privacy statement and Outline of CCTV proposal and information of impact of CCTV within the home and notification of third parties and people who their data may be shared with, including a map of placement of cameras. This statement should also be published on the home’s website.
Documented individual consent
Documented regular visitor consent.
Mental Capacity Assessment and Best Interests decision paperwork.
Review of the additional restriction of CCTV across the home and if this equates to a Deprivation of Liberty within some aspects.
Deprivation of Liberty paperwork to be submitted for new and ongoing standard authorisations
Notifications to the CQC for DOLS and CCTV decision.
Home signage about the use of CCTV to be placed in every area that there is a camera ( except for covert decisions )
Standard Contractual Clause (SSC, GDPR ) in place if using a third party provider for CCTV equipment.
Legal advice sought if you consider that some cameras will be placed covertly.
Written evidence of justification of audio if needed.
Continuous review checklist with consideration into whether the CCTV system is the least restrictive option for the homes identified legitimate purpose and interests.
Data request procedures for CCTV footage to be put in place.
All information relating to CCTV that is shared with people in the home meets the accessible information standard.
A specific robust complaints procedure to be put in place
For CCTV to be an agenda item at all residents and relatives meeting
Annual GDPR and information governance training for all staff.
Specific system training for all staff that have access to the system.
For the use of CCTV within the home embedded within the induction programme for new staff.
Updated HR disciplinary policy that includes the actions that will be taken for the misuse of the CCTV and data processing and storage.
ICO annual update regarding CCTV use.