Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Sentry Mode and GDPR

This site may earn commission on affiliate links.
I think your son is misinterpreting the regulations.

I was a data regulator, and a RIPA authorising officer and worked very closely with the very first Information officer - or IOCCO as it was known then.

The regulations apply to public bodies and organisations that gather and process this data - so people like the police, Security services, MOD, Prisons and local authorities, private individuals are exempt.

There has been talk for many years about semi bringing private individuals under some aspects of data collection from Cameras regarding home CCTV and there is advice published to those who may use data collected for bearing no regard for collateral collection - but it is just advice and the law has never been specifically examined in order to make home CCTV or in this case Dash Cams in cars under the IOCCO rules. This includes CCTV operating in shops - only proviso there is there should be signage to tell people their Overt cameras are recording people within the shop - so their choice to go in or not - and if they enter they are deemed to have granted permission to film them.

Its all a bit of a grey area because by bringing dash cams, Home CCTV under those regulations it would open up issues regarding ANPR, I indicate ANPR because its a lot different to home CCTV and Dash cams in that Home and Car cams are not "targeting" individuals - and its the word "targeting" that becomes most relevant in CCTV data collection. Overt CCTV - the equipment can be seen and maybe some signage is completely different to Covert data collection - where cameras are hidden or targeted at an individual without their knowledge with the intention of processing that data.

ANPR is in a unique field in that it "Targets" every vehicle in any lane - its specifically reading number plates and then actively looking for the plate again to monitor its speed/direction etc. Targeted data collection requires an Authorisation process from a RIPA qualified authoriser - but so far the law makes cant agree on this aspect.

scanning an area isn't regarded as Surveillance of an individual and requires no authorisation.

This topic has been discussed by many people over very many years - indeed I have been retired 10 years now and I dealt with IOCCO for over 8 years - the guidance and rules were always under review and I have tried to keep up to date with regulation changes - and to my knowledge Home CCTV and Dash Cams remain exempt from the regulations.

Most MOD sites restrict CCTV recordings, all prisons restrict cameras too but In all my days as head of Security within a prison I had to give specific instructions to gate staff to look for and ask drivers that were entering If they had dash cams as many are not obvious, in fact vehicles entering most sites are restricted to suppliers who have agreed not to have or to disable any Dash Cams on entering a site - breaching this rule would have consequences for that supplier in that they would loose their contract.
I'm afraid you have got this round your neck. Your interpretation may have been correct 10 years ago but it is far off the mark now. Surveillance cameras which go beyond domestic boundaries are captured under GDPR. If they don't then it will be domestic processing, and not subject to GDPR. RIPA for this scenario is irrelevant.

Surveillance systems are legitimised, in the main, because they are necessary for the prevention and detection of crime.

ANPR is lawful under Part 3 (Law enforcement processing) of the Data Protection Act 2018 (note not GDPR, as GDPR does not cover law enforcement processing.)

Anyway, my own view is don't worry about it - the regulator has much bigger fish to fry. Like some one said previously, just avoid splashing it over social media and use it with care.
 
  • Like
Reactions: NewbieT
I Agree, personal data processed in the course of a purely personal or household activity, with no connection to a professional or commercial activity, is outside the UK GDPR’s scope. This means that if you only use personal data for such things as writing to friends and family or taking pictures for your own enjoyment, you are not subject to the UK GDPR. Any area you can drive to you can take pics.

What triggered my first thought is that talking to insurers most want to know if a dash cam is fitted and I was told that they expect to have access to the data in connection of any claim. It's a grey area though as if the data is shared with an insurer they are using it as a business.
 
I Agree, personal data processed in the course of a purely personal or household activity, with no connection to a professional or commercial activity, is outside the UK GDPR’s scope. This means that if you only use personal data for such things as writing to friends and family or taking pictures for your own enjoyment, you are not subject to the UK GDPR. Any area you can drive to you can take pics.

What triggered my first thought is that talking to insurers most want to know if a dash cam is fitted and I was told that they expect to have access to the data in connection of any claim. It's a grey area though as if the data is shared with an insurer they are using it as a business.
Sharing with an insurer is not a grey area though. It's about purpose. When sharing personal data with an insurer they take on the responsibilities under GDPR because they are processing it for their own purpose (they become a controller for it). They have to legitimise why they are using it etc - very straightforward for an insurer and I would not worry about sharing it with them.
 
  • Informative
Reactions: HenryT
Don't share content publicly on the internet and I can't see any risk. People do have a right to privacy, so however amusing you think a clip might be there's a chance that someone will take offense. I've seen clips shared on this forum that could be considered a breach of the act.

It's a murky grey area at best, in the UK people have a right to privacy in places where it could "reasonably be expected" - in their homes for example - so a CCTV system that overlooks your neighbour's property would fall into that category, but one that covers the street outside your house would not.

There is no right to privacy in public spaces - on the street, public car parks, shopping malls, etc. - but some public spaces are privately owned and the owners are allowed to assert restrictions such as banning photography or videography without permission. It gets even more complicated in central London where some building owners assert copyright over images of their buildings and some public areas have specific bylaws for security reasons (and will earn you an immediate visit from armed police to find out what you are doing).

There are a lot of opinion pieces - particularly from people who stand to make money from making you think you have to be registered - but I would refer to the ICO guidance.

They say that GDPR only applies where the camera is being used for work purposes: "This is because the use of the dashcam in or on your vehicle for work purposes will not be considered as ‘domestic’ and therefore not exempt from data protection laws."

Ergo, private vehicles are considered domestic use and therefore exempt.

 
It's a murky grey area at best, in the UK people have a right to privacy in places where it could "reasonably be expected" - in their homes for example - so a CCTV system that overlooks your neighbour's property would fall into that category, but one that covers the street outside your house would not.

There is no right to privacy in public spaces - on the street, public car parks, shopping malls, etc. - but some public spaces are privately owned and the owners are allowed to assert restrictions such as banning photography or videography without permission. It gets even more complicated in central London where some building owners assert copyright over images of their buildings and some public areas have specific bylaws for security reasons (and will earn you an immediate visit from armed police to find out what you are doing).

There are a lot of opinion pieces - particularly from people who stand to make money from making you think you have to be registered - but I would refer to the ICO guidance.

They say that GDPR only applies where the camera is being used for work purposes: "This is because the use of the dashcam in or on your vehicle for work purposes will not be considered as ‘domestic’ and therefore not exempt from data protection laws."

Ergo, private vehicles are considered domestic use and therefore exempt.

That is a FAQ about whether you need to pay a 'Data Protection Fee' to register yourself with the ICO, which is not required if you are 'domestic'. Its not relevant to your obligations if cctv is recording outside your private property. No one is suggesting you need to be registered, only whether signage is required and if you can use your recordings for any purposes other than securing your car. It is incorrect to say GDPR and the DPA do not apply other than for work purposes, as clearly explained here by the regulator


For me, given I would only be sharing sentry mode footage with my insurers or the police the likelihood of anyone complaining that I don't have signage seems incredibly low.
 
I did clarify in my original post that Domestic CCTV and Dash Cams are grey areas of the law - different people have different interpretations of what "processing" is, and "Collateral intrusion" and I did state there is "Guidance" published but it isn't enforceable in law.

People do have a right to privacy - but the law allows individuals to film anyone in a public place - including filming restricted areas as long as that is filmed from a public place. (This includes the press filming the royals from miles away using massive lenses - and the royals couldn't bring charges against those reporters)
If its targeted surveillance then rules exist prohibiting data capture when the target is within their home or car - but a dash Cam is simply recording everything in front of its lens - its not targeting any individual.
Domestic CCTV - again it films all in front of it - not targeting - and still the law makers are struggling with those cameras that zoom in on movement and then track the individuals after they have triggered a recording.

Of course some common sense needs to be applied to home CCTV as its virtually impossible to set up a CCTV system that captures every part of the home owners property without capturing other homes in the street or pathways, CCTV systems do allow "masking" to automatically block out neighbours windows if Pan, Tilt Zoom cameras are used - but the owner needs to set that up - so all we have is advice - not regulation, GDPR has not changed that aspect though its easy to put a logical argument forward to make a case. My experience of many that work with GDPR is that they don't understand the complex legal issues and use the regulations to simply try to make things "secret" or apply blocking techniques.

I accept there may be gaps in my current knowledge but I am not aware of any case that has been brought against an individual for either Domestic CCTV, Dash Cams or people using mobile phones to film in any public place - or for any individual to require registration with the Information commissioners office.
 
It's currently very much not one to worry about, the authorities don't have enough resource to work it out nor deal with all the bigger fish - let alone this very very small fish. Most domestic CCTV captures images off-premise and that's way up the list from sentry mode, yet a blind eye is turned to that one.

I expect many people involved in the legislation have CCTV of their own that records down the street. They'll hardly prosecute themselves.
 
  • Like
Reactions: Adopado
For those saying there is no right to privacy in public places, that's not correct. There are some circumstances where there is still an expectation, and this is supported by case law. And CCTV for "work purposes" means nothing, its the scope of the surveillance that determines whether GDPR applies.

Bottom line, data protection legislation is often based on "it depends", there is rarely a black and white answer that covers every scenario. Just be sensible.
 
@dreye , Right to privacy in a public place? - Not being argumentative but can you provide a specific example?

There is of course the definition of a "public" place. If an area is open to the public 24 hours per day then of course its Public and you can film anything you can see - no rights to privacy.

Some areas have public access for defined time periods and outside of those time the area becomes "private" so filming may become an issue and privacy laws may have an impact. The MOD for example - they may allow a road for public access but have specific days or time periods when public access is withdrawn and signage is usually erected at those times or personnel are deployed to ensure the general public are prevented from access - filming whilst in public access mode wouldn't contravene the law but would do so if a member of the public were filming during restricted times.

Data protection or the more up to date GDPR - this is primarily about personal date being protected and applies to living individuals, but this is usually enforced or applied by people that have little understanding of the legal position or the complexities of the legislation, an example of this is call centre staff - You can call them and ask a question, and this question could simply be about a process rather than any details of a person and immediately they refuse to speak on the subject quoting GDPR.
 
@GlynG Don't worry about being argumentative, it's all part of a good debate.

Murray v Big Pictures (UK) Ltd is a well known case. Or an even more famous example under the ECHR is the Von Hannover case about Princess Caroline of Monaco. Both demonstrate that there is a problem with the blanket statement of "no expectation of privacy in a public place".
 
Thanks for the specific cases. Clearly these and other cases had some significant technicalities in law which were held in breach.

Murray case - It involved a child and the ruling did conclude - If the pictures were taken simply as a street scene then there would have been no breach of the law, however, they were taken covertly and the individual was targeted with the sole intention to publish and for profit, So if these pics were taken by Domestic CCTV or a Dash Cam, Pic on a phone then there wouldn't have been any case to answer - And this topic is simply about the law and the use of a Dash Cam.

The Princess Caroline case had been through at least 5 courts - all of which ruled no case - but German Law applied (and i have no idea if that would change if it was a UK court) and there were 37 pictures taken - the ECHR ruled against just two of the pictures on specific grounds - again If those same pictures could have been and were taken by a Dash Cam or domestic CCTV there would have been no case.
 
Thanks for the specific cases. Clearly these and other cases had some significant technicalities in law which were held in breach.

Murray case - It involved a child and the ruling did conclude - If the pictures were taken simply as a street scene then there would have been no breach of the law, however, they were taken covertly and the individual was targeted with the sole intention to publish and for profit, So if these pics were taken by Domestic CCTV or a Dash Cam, Pic on a phone then there wouldn't have been any case to answer - And this topic is simply about the law and the use of a Dash Cam.

The Princess Caroline case had been through at least 5 courts - all of which ruled no case - but German Law applied (and i have no idea if that would change if it was a UK court) and there were 37 pictures taken - the ECHR ruled against just two of the pictures on specific grounds - again If those same pictures could have been and were taken by a Dash Cam or domestic CCTV there would have been no case.
If you collected video with a dashcam and there was not obvious signage then it would be just as covert. It's the nature of how that content is then used that would make it fall foul of Article 8 of the 1988 Human Rights Act.

If you keep it for a reasonable period as part of protecting your car then you really aren't impacts anyone else's right to a Private and Family life. If you then decided that you were amused by something someone did, and decided to share it to become viral on Facebook then you could have infringed their right to a Private and Family Life.

If you were not filming covertly it's generally accepted that no expectation of privacy existed, and you were happy with whatever you were doing being filmed.
 
Thanks for the specific cases. Clearly these and other cases had some significant technicalities in law which were held in breach.

Murray case - It involved a child and the ruling did conclude - If the pictures were taken simply as a street scene then there would have been no breach of the law, however, they were taken covertly and the individual was targeted with the sole intention to publish and for profit, So if these pics were taken by Domestic CCTV or a Dash Cam, Pic on a phone then there wouldn't have been any case to answer - And this topic is simply about the law and the use of a Dash Cam.

The Princess Caroline case had been through at least 5 courts - all of which ruled no case - but German Law applied (and i have no idea if that would change if it was a UK court) and there were 37 pictures taken - the ECHR ruled against just two of the pictures on specific grounds - again If those same pictures could have been and were taken by a Dash Cam or domestic CCTV there would have been no case.
I was responding to the statement "no expectations of privacy in a public place". I have provided two very high profile cases which prove this is not the case and it is not as clear cut as the statement makes out. There are many, many others and the subject of "public privacy" has been, and continues to be, well debated and documented. It is a fact that the statement "no expectations of privacy in a public place" is not true. A photo of a street scene taken by person A can be exactly that until it is then used by person B to identify an individual so it is not beyond the realms of possibility that the notion of public privacy is invoked (different purpose of processing.)

You referred to RIPA, ANPR, Restricted sites and much more for goodness sake so the path of the conversation has gone further than the original OP. It's a little naughty to say this subject is simply about the law and the use of a dashcam.

Anyway I'm boring myself here, so apologies to all for showing you how uninteresting data protection law is.
 
If you keep it for a reasonable period as part of protecting your car then you really aren't impacts anyone else's right to a Private and Family life. If you then decided that you were amused by something someone did, and decided to share it to become viral on Facebook then you could have infringed their right to a Private and Family Life.

I suspect that this is the crux of the matter.


As you said earlier, the chances of anyone coming after you is pretty low - particularly if you're not publishing the footage.
 
  • Like
Reactions: dreye