Companies: Surveillance

(asked on 28th February 2022) - View Source

Question to the Department for Digital, Culture, Media & Sport:

To ask Her Majesty's Government what steps they are taking to regulate companies' use of technological systems to monitor people.


Answered by
Lord Parkinson of Whitley Bay Portrait
Lord Parkinson of Whitley Bay
Parliamentary Under Secretary of State (Department for Culture, Media and Sport)
This question was answered on 14th March 2022

Organisations that process personal data for the purposes of monitoring their activities or surveillance must comply with the requirements of the UK General Data Protection Regulation and the Data Protection Act 2018. This means that the data processing must be fair, lawful and transparent. Any adverse impact of monitoring on individuals must be necessary, proportionate and justified by the benefits to the organisation and others. A Data Protection Impact Assessment (DPIA) would usually be required, particularly where the processing involves the use of new technologies, or the novel application of existing technologies.

Where people’s biometric data are processed, such as through fingerprint, voice or facial recognition technology, companies would generally need to conduct a DPIA. Companies conducting live facial recognition would generally need to show that processing was necessary for one of a limited number of specified reasons of substantial public interest - for instance, preventing or detecting unlawful acts. They would also need to show that specific conditions and safeguards were met.

The Information Commissioner’s Office is the UK’s independent regulator for data protection and has published extensive guidance to help organisations comply with their data protection obligations. This includes guidance for employers on the rules in relation to monitoring of employees, as well as guidance on monitoring employees in connection with Covid-19 related measures.

The Information Commissioner has also published an opinion on the non-law enforcement use of live facial recognition technology in public spaces which explain the requirements of the legislation and stress that data protection and people’s privacy must be at the heart of any decisions to deploy live facial recognition technology in public spaces.

Reticulating Splines