dpa in Constant 2009
and all CCTV images of my person held
within your system. I was present at [place] from
approximately [time] onwards on [date].” 8
For several years, ambientTV.NET conducted a series of exercises
to visualise the data traces that we leave behind, to render them
into experience and to dramatise them, to watch those who watch
us. These experiments, scrutinising the boundary between public
and private in post-9/11 daily life, were run under the title ‘the Spy
School'. In 2002, the Spy School carried out an exercise to test the
reach of the UK Data Protection Act as it applies to CCTV image
data.
The Data Protection Act 1998 seeks to strike a balance between
the rights of individuals and the sometimes competing interests
of those with legitimate reasons for using personal information.
The DPA gives individuals certain rights regarding information
held about them. It places obligations on those who process information (data controllers) while giving rights to those who are
the subject of that data (data subjects). Personal information
covers both facts and opinions about the individual. 9
7
9
The full text of the DPA (1998) is at http://www.opsi.gov.uk/ACTS/acts1998
/19980029.htm
Data Protection Act Fact Sheet available from the UK Information Commissioners
Offce, http://www.ico.gov.uk
107
107
107
108
108
The original DPA (1984) was devised to ‘permit and regulate'
access to computerised personal data such as health and financial
records. A later EU directive broadened the scope of data protection
and the remit of the DPA (1998) extended to cover, amongst other
data, CCTV recordings. In addition to the DPA, CCTV operators
‘must' comply with other laws related to human rights, privacy, and
procedures for criminal investigations, as specified in the CCTV Code
of Practice (http://www.ico.gov.uk).
As the first subject access request letters were successful in delivering CCTV recordings for the Spy School, it then became pertinent
to investigate how robust the legal framework was. The Manifesto for
CCTV filmmakers was drawn up, permitting the use only of recordings obtained under the DPA. Art would be used to probe the law.
figure 92
Still from
Faceless,
2007
figure 94
Multiple,
conflicting
timecode
stamps
A legal readymade
Vague spectres of menace caught on time-coded surveillance
cameras justify an entire network of peeping vulture lenses. A
web of indifferent watching devices, sweeping every street, every
building, to eliminate the possibility of a past tense, the freedom
to forget. There can be no highlights, no special moments: a
discreet tyranny of now has been established. Real time in its
most pedantic form. 10
Faceless is a CCTV science fiction fairy tale set in London, the city
with the greatest density of surveillance cameras on earth. The film
is made under the constraints of the Manifesto – images are obtained
from existing CCTV systems by the director/protagonist exercising
her/his rights as a surveilled person under the DPA. Obviously the
protagonist has to be present in every frame. To comply with privacy
legislation, CCTV operators are obliged to render other people in
the recordings unidentifiable – typically by erasing their faces, hence
the faceless world depicted in the film. The scenario of Faceless thus
derives from the legal properties of CCTV images.
10
(Ian Sinclair: Lights out for the territory, Granta, London, 1998, p. 91)
108
108
108
109
109
“RealTime orients the life of every citizen. Eating, resting, going
to work, getting married – every act is tied to RealTime. And every
act leaves a trace of data – a footprint in the snow of noise...” 11
The film plays in an eerily familiar city, where the reformed RealTime calendar has dispensed with the past and the future, freeing
citiz
planned
in particular locations, but the CCTV recordings were not always
obtainable, so the story had to be continually rewritten.
Faceless treats the CCTV image as an example of a legal readymade (‘objet trouvé'). The medium, in the sense of raw materials
that are transformed into artwork, is not adequately described as
simply video or even captured light. More accurately, the medium
comprises images that exist contingent on particular social and legal
circumstances – essentially, images with a legal superstructure. Faceless interrogates the laws that govern the video surveillance of society
and the codes of communication that articulate their operation, and
in both its mode of coming into being and its plot, develops a specific
critique.
Reclaiming the data body
Through putting the DPA into practice and observing the consequences over a long exposure, close-up, subtle developments of the
law were made visible and its strengths and lacunae revealed.
“I can confirm there are no such recordings of
yourself from that date, our recording system was
not working at that time.” (11/2003)
11
Faceless, 2007
109
109
109
110
110
Many data requests had negative outcomes because either the surveillance camera, or the recorder, or the entire CCTV system in question
was not operational. Such a situation constitutes an illegal use of
CCTV: the law demands that operators: “comply with the DPA by
making sure [...] equipment works properly.” 12
In some instances, the non-functionality of the system was only
revealed to its operators when a subject access request was made. In
the case below, the CCTV system had been installed two years prior
to the request.
“Upon receipt of your letter [...] enclosing the
required 10£ fee, I have been sourcing a company
who would edit these tapes to preserve the privacy of other individuals who had not consented
to disclosure. [...] I was informed [...] that all
tapes on site were blank. [.. W]hen the engineer
was called he confirmed that the machine had not
been working since its installation.
Unfortunately there is nothing further that can be
done regarding the tapes, and I can only apologise
for all the inconvenience you have been caused.
yed. Unhappily this request was not
carried out and the tape was wiped according with
the standard tape retention policy employed by
[deleted]. Please accept my apologies for this and
assurance that steps have been taken to ensure a
similar mistake does not happen again.” (10/2003)
figure 98
The Rotain
Test, devised
by the
UK Home
Offce Police
Scientific
Development
Branch,
measures
surveillance
camera
performance.
Some responses, such as the following, were just mysterious (data
request made after spending an hour below several cameras installed
in a train carriage).
“We have carried out a careful review of all relevant tapes and we confirm that we have no images of
you in our control.” (06/2005)
Could such a denial simply be an excuse not to comply with the costly
demands of the DPA?
“Many older cameras deliver image quality so poor
that faces are unrecognisable. In such cases the
operator fails in the obligation to run CCTV for
the declared purposes.
You will note that yourself and a colleague's faces
look quite indistinct in the tape, but the picture you sent to us shows you wearing a similar
fur coat, and our main identification had been made
through this and your description of the location.”
(07/2002)
111
111
111
112
112
To release data on the basis of such weak identification compounds
the failure.
Much confusion is caused by the obligation to protect the privacy
of third parties in the images. Several data controllers claimed that
this relieved them of their duty to release images:
“[... W]e are not able to supply you with the images you requested
n of the tape should be borne by the person
making the enquiry, of course we will now be checking into that for clarification. Meanwhile please
accept the enclosed video tape with compliments of
[deleted], with no charge to yourself.” (07/2002)
figure 90
Off with
their heads!
Visually provocative and symbolically charged as the occluded heads
are, they do not necessarily guarantee anonymity. The erasure of a
face may be insuffcient if the third party is known to the person requesting images. Only one data controller undeniably (and elegantly)
met the demands of third party privacy, by masking everything but
the data subject, who was framed in a keyhole. (This was an uncommented second offering; the first tape sent was unprocessed.) One
CCTV operator discovered a useful loophole in the DPA:
“I should point out that we reserve the right, in
accordance with Section 8(2) of the Data Protection
Act, not to provide you with copies of the information requested if to do so would take disproportionate effort.” (12/2004)
What counts as ‘disproportionate effort'? The gold standard was set
by an institution whose approach was almost baroque – they delivered
hard copies of each of the several hundred relevant frames from the
time-lapse camera, with third parties heads cut out, apparently with
nail scissors.
Two documents had (accidentally?) slipped in between the printouts – one a letter from a junior employee tendering her resignation
(was it connected with the beheading job?), and the other an ironic
memo:
113
113
113
114
114
“And the good news -- I enclose the 10
ar, we would remark that the video
is not biographical of you in any significant way.”
(11/2004)
Further, with the introduction of cameras that pan and zoom, being
filmed as part of a crowd by a static camera is no longer grounds for
a data request.
“[T]he Information Commissioners office has indicated that this would not constitute your personal
data as the system has been set up to monitor the
area and not one individual.” (09/2005)
As awareness of the importance of data rights grows, so the actual
provision of those rights diminishes:
115
115
115
116
116
figure 89
Still from
Faceless,
2007
"I draw your attention to CCTV systems and the Data
Protection Act 1998 (DPA) Guidance Note on when the
Act applies. Under the guidance notes our CCTV system is no longer covered by the DPA [because] we:
• only have a couple of cameras
• cannot move them remotely
• just record on video whatever the cameras pick
up
• only give the recorded images to the police to
investigate an incident on our premises"
(05/2004)
Data retention periods (which data controllers define themselves)
also constitute a hazard to the CCTV filmmaker:
“Thank you for your letter dated 9 November addressed to our Newcastle store, who have passed
it to me for reply. Unfortunately, your letter was
delayed in the post to me and only received this
week. [...] There was nothing on the tapes that you
requested that caused the store to retain the tape
beyond the normal retention period and therefore
CCTV footage from 28 October and 2 November is no
longer available.” (12/2004)
Amidst this sorry litan
Display 200 300 400 500 600 700 800 900 1000 ALL characters around the word.