Close Circuit Television (CCTV) has made it easy for businesses and individuals to keep their residences secure and monitor in real-time all activities around their premises.
However, there are stipulated laws by the government in the 2019 Data Protection Act that guard the use of CCTVs, which can land one in jail or even incur fines of millions.
Under the 2019 Act, individuals who install CCTVs are classified as data controllers, who are defined as “a person or organisation that collects and determines how your data will be used.”
Moreover, the Office of the Data Protection Commissioner (ODPC) subjects the stated individuals to the same laws and penalties as other data controllers and processors including the requirement to register with the commissioner or get a fine of Ksh5 million.
“Where the CCTV system is used to monitor a publicly accessible area, you will be required to carry out a Data Protection Impact Assessment,” ODPC stated in its February 2023, notice.
Individuals who install CCTV should be wary of these laws on disclosure of data from CCTV footage that could land them in jail and earn them a fine of up to ksh3 million.
Disclosing personal data without a lawful excuse in any manner that is different from the purpose for which the footage had been collected.
This, according to constitutional lawyer Ambrose Weda, who spoke to Kenyans.co.ke, if the footage was collected for security purposes only, it cannot be commercialised otherwise it invades privacy.
“People’s images are protected by the constitution and that is why the Act exists. It protects people’s information and includes their images.
“That is why it is important to register with the commissioner so that the government is aware of the purpose and reasons you have installed the CCTV,” Weda explained.
The second case outline is when the data collected by the controller, without lawful excuse, is disclosed by a data processor.
A data processor according to ODPC is “an entity that carries out the processing of data on behalf of the data controller.”
The law also states that data an individual who installs CCTV and without lawful excuse discloses personal data to a third party commits an offence and can be subjected to a Ksh3 million fine.
However, the laws do not apply to a person who is an employee or agent of the data controller or data processor acting within the scope of the mandate given.
Further explaining the scope of the law, Weda noted that violations of the laws could lead to civil suits and the award of damages of any amount by the court.
“This depends on how the CCTV user registered because if it is meant for capturing private data, commercialising or sharing them is against the law,” Weda stated.
Note that the ODPC outlines that the collection of images through CCTV is not a violation of the Data Protection Act. However, the commissioner requires compliance with the law where one collects personal data through a CCTV system.
“The processing of personal data by an individual in the course of a purely personal or household activity is exempted from the application of the Data Protection Act, including having a CCTV camera at your home.
“A CCTV camera at your place of work falls within the scope of the Data Protection Act, thus one is required to register either as a data controller or processor or both and notify data subject that the premises are under CCTV surveillance,” ODPC stated in a notice on February 2023.
