Surveillance technologies in vehicles – Part 1: Why is a dashcam like a doorbell?

A few weeks ago the ICO brought out new guidance on the use of video surveillance technologies. The guidance explores the use of in-vehicle surveillance technologies in its non-CCTV technologies section. This got me thinking about modern vehicles and their features that employ video and audio surveillance, and the impact that data protection law has on their use. Since there are both commercial and personal uses of in-vehicle surveillance technologies, I will cover both uses separately in a series of two articles.

In this first article, I explain what impact (if any) data protection law has on personal use of video/audio surveillance in vehicles, focusing on ‘dashcams’. Dashcams are traditionally dashboard- or helmet-mounted cameras bought separately from the vehicle, but they can be in-built in rare cases. The main use for the footage is for evidential purposes in the event of an incident on the road, but some of the videos end up on YouTube too (most commonly in ‘fail’ compilations).

What does data protection law and guidance say about using a dashcam for personal reasons?

Dashcams inevitably capture images of people and, depending on the configuration, possibly audio recordings of them too. Images or recordings that identify a person (including within a small group), are usually the personal data of that person. Processing this personal data could engage the UK GDPR and bring with it ‘controller’ responsibilities, except where the use of this surveillance tool is for a ‘“purely personal or purely household activity” (I’ll call this the “domestic use” exemption).

The Court of Justice of the European Union has held that personal surveillance that records footage of public spaces cannot claim the domestic use exemption (see the Ryneš case). Although the UK higher courts could depart from this position in the future, the ICO currently supports this position in its domestic CCTV guidance. More recently, the position was adopted in the Oxford county court in Fairhurst v Woodard, where it was an agreed fact that the defendant’s home CCTV system, including smart doorbell, was not for domestic use because it monitored public spaces. Since dashcams also record public spaces outside of the boundaries of one’s own home, one might expect the domestic use exemption not to apply.

However, there are some factual differences between dashcams and home CCTV cameras/smart doorbells. For one, dashcams are not fixed in a location so do not monitor one particular public space. How you use the footage taken from the dashcam may also influence the debate. Publishing the recording, for example on YouTube or as evidence for insurance purposes, might tip the scales away from a domestic use scenario.

For this reason perhaps, the ICO has so far avoided taking a position on dashcams. Looking to the ICO’s guidance leaves us with a handful of inferences only. One example is found in the ICO’s data protection fee registration guidance. The first question says that dashcam footage used for work purposes is not domestic use, from which you could infer that the ICO sees personal dashcam use as a domestic use activity.

How to approach dashcam use in practice

Whether the domestic use exemption applies or not, it is sensible (and decent) to consider how your use of a dashcam may impact the privacy of others. Therefore, it makes sense to follow the ICO’s domestic CCTV guidance recommendations, even if some aren’t practical due to the mobile nature of dashcams. It is unreasonable to expect motorists to place ‘CCTV’ signs on their cars and motorbikes, or hand out laminated privacy policies as they go. However, dashcam users can implement the following recommendations:

• Minimise the footage captured and stored, possibly by way of an ‘event based’ activation of the camera.
• Store recordings securely, because there is evidence of some dashcams being easily hacked.
• Determine appropriate retention periods for the recordings. In most cases, recordings are only needed if they actually show an incident that has evidential value, so the default position should be to erase after every trip.
• Do not make an audio recording with the video where possible.
• If uploading the video to the internet for any reason (e.g. YouTube), make sure to obscure any identifiable images of people, licence plates, and other identifiers.

From a legal risk point of view, it is safe to assume that the ICO is not currently interested in dashcams used for personal reasons and this is unlikely to make its way swiftly up the ICO’s to-do list. Further, the Fairhurst case mentioned above was a claim brought by the claimant after a pattern of harassing behaviour by the defendant. It is hard to see these facts reflected in the world of personal dashcam use, although it is possible that a member of the public who is aware of and often filmed by the same dashcam might become irked enough to launch a similar claim. Similarly where the footage is used as evidence, the subject of the footage may have an axe to grind with being filmed in the first place.

Looking to the future, innovation in connected vehicles is leading to new personal use surveillance technologies. Here are two interesting examples of this I have seen recently:

• The first is a ‘deliver to my vehicle’ delivery service. The owner of a vehicle is able to remotely unlock their vehicle for a short period of time to allow for the drop. It is likely that this would also involve remote video and audio surveillance, similar to a smart doorbell.
• The second is the use of automated recording drones (I’m being serious!). See for example the new concept Polestar vehicle, which has an in-built deployable drone that can track and record the vehicle driving from a distance and then upload the clip to the vehicle’s infotainment service. The only conceivable use for this wonderfully twenty-first century tool is to upload clips to the internet to show off your sports car…and everyone else you capture in the background!