Thread by @rossamcmahon

One of the issues I raised repeatedly was the use of Garda authorisations for community CCTV (the legislation being very limited). Reading the DPC decision this was a clear issue.

https://twitter.com/rossamcmahon/status/1195376879643049986

DPC found that Garda authorisations were a good legal basis for 44 (LCC operates 401 cameras!).

The Council relied on local Goverment legislation to justify cameras in housing estates, but the DPC found that the law does not “empower the Council to carry out surveillance in public places”.

This paragraph is partially redacted but note 🚨: some CCTV cameras were “monitoring private dwellings”.

Residents of some housing estates were effectively under constant surveillance.

Worth remembering that private use of CCTV is similarly restricted (but in the opposite way - you can record your own property but not public property).

"The Council has an onus of accountability to ensure [constant] surveillance is proportionate. On the spectrum of surveillance that could have been considered, continuous real time monitoring falls into a category which is particularly oppressive."

🚨 The DPC "established that operators in ... monitoring centres were able to manually control the CCTV cameras and sometimes used this facility to monitor private dwellings."

The centres are redacted; fair to assume that these are the ones operated by community volunteers.

Remarkable: "At the time of writing on the inquiry report, the DPIA remained in 'Draft' form."

I asked the Council in July 2017 if a DPIA had been carried out. I was told:

Over four years later it was still in draft.

(One of my points was that there was little sense to carrying out a DPIA *after* finalising locations and use.)

DPC: "There was also no analysis of the necessity for operating particular CCTV cameras at each location."

Notable specific finding that the Council infringed the law by deploying "at least" 9 CCTV cameras a traveller accommodation sites.

Astounding.

DPC made a specific finding that the Council failed to properly involve their Data Protection Officers in a decision to proceed with one specific CCTV system. This was at a time when the investigation was ongoing. #DPOS

Holy moly.

Another surprising finding - amazing in light of a specific case a number of years ago involving the death of a vulnerable adult.

Similar to the Garda access ‘log’, one monitoring centre recorded all access under a single username; “it is impossible to identify the particular staff member who accessed”.

Ok here we go - a big one: State surveillance of specific individuals on the basis of informal requests and in the absence of any warrant, authorisation, record keeping or regulation.

CCTV footage was not deleted by policy, but automatically when a hard drive was full - "in essence a random data retention period", even though the official retention policy said 30 days.

Baffling in this day and age.

🚨 (this report continues to amaze). For context, the right of access to personal data was introduced in 1988.

Wow.

Note the above finding that LCCC breached GDPR in not involving their DPO properly. Three years ago I asked what resourcing was being allocated to the role. Worse than that, the DPO was sidelined.

https://twitter.com/rossamcmahon/status/1072609622970781696

This was one of my early comments on CCTV in Limerick. The consultation, such as it was, took in local councillors, joint policing and one or two community groups. DPC decision specially says better community consultation needed.

https://twitter.com/rossamcmahon/status/902496530271260672

And here’s the tweet that started it all.

https://twitter.com/rossamcmahon/status/887984500692668416