Dilemma: Caught on camera

I WORK as a practice manager and was contacted by a police officer this morning who requested that I show him our practice CCTV footage for the past week in order to investigate a crime that has been reported. He would like to attend the practice to do this. I don’t know whether I am able to assist with this.

This is a relatively common scenario and MDDUS regularly receives calls from practices seeking advice on this topic. Practices will often have internal and external CCTV cameras for safety and security purposes, and any crime reported in or around the premises may prompt such a police request.

Although the practice may be keen to co-operate with police officers investigating such matters, this situation is more complicated than it first appears. CCTV footage which may identify individuals is considered personal data and must be handled under the provisions of the Data Protection Act 2018 in a similar way to written information. In 2014 the Information Commissioner’s Office (ICO) produced a Code of Conduct specifically for camera surveillance information and this is helpful when considering the request. It predates implementation of the new GDPR (General Data Protection Regulation) and DPA 2018 but nonetheless contains useful guidance.

The Code states that care should be taken about how information is recorded and held, and that access should be restricted. Footage should also be deleted when no longer required. It also states that disclosure of surveillance information to a law enforcement agency can be appropriate when the purpose is to prevent and detect crime. Even when this is not the primary purpose of the surveillance, it would still be acceptable to disclose the information to police if failure to do so would be likely to prejudice the prevention and detection of crime.

However, the ICO emphasises that judgments about disclosure should be made by the organisation operating the system, and they have discretion to refuse any request for information unless there is an overriding legal obligation, such as a court order. Once information has been disclosed to police, they become the data controller for the copy they hold.

Such guidance would appear to allow disclosure to the police of the CCTV footage in the above scenario but the practice must be mindful of separate GMC guidance on Confidentiality. This highlights that disclosure of a patient’s personal information is appropriate when they consent either implicitly in relation to their clinical care or audit, or explicitly for other purposes, or where the disclosure can be justified in the public interest.

The GMC makes additional comment on public interest disclosures: "If it is not practicable or appropriate to seek consent, and in exceptional cases where a patient has refused consent, disclosing personal information may be justified in the public interest if failure to do so may expose others to a risk of death or serious harm. The benefits to an individual or to society of the disclosure must outweigh both the patient’s and the public interest in keeping the information confidential.

"Such a situation might arise, for example, if a disclosure would be likely to be necessary for the prevention, detection or prosecution of serious crime, especially crimes against the person.

"If you consider that failure to disclose the information would leave individuals or society exposed to a risk so serious that it outweighs the patient’s and the public interest in maintaining confidentiality, you should disclose relevant information promptly to an appropriate person or authority."

In the above scenario, the practice manager has insufficient information at present for the doctors to reach a decision on disclosure. She requires more information on the nature of the crime being investigated, and also whether the whole week’s footage is necessary or whether a much more defined period would suffice. She should also establish whether it is footage from internal or external cameras that is requested.

Once she has sufficient information, the doctors must decide whether there is a public interest reason to disclose the footage, and what footage should be disclosed for the purposes. The practice must also consider whether consent for disclosure can reasonably be sought from the individual or individuals concerned, or whether this in itself may be impractical or prejudice the investigation.

If the practice declines to disclose the information, it should still be possible for the police officer to obtain a court order to compel disclosure of the data if there are sufficient grounds to do so. The practice would then be obliged to comply with any valid court order received.

Dr Barry Parker is medical adviser at MDDUS and editor of Insight

REFERENCES

• ICO. In the picture: A data protection code of practice for surveillance cameras and personal information
• October 2014 GMC. Confidentiality: good practice in handling patient information. April 2017