The extensive private security camera network in Johannesburg may be in contravention of privacy regulations, as data subjects must be informed whether the information being collected is on a voluntary or compulsory basis, says the Information Regulator.
Reacting to the on-going debate on unprecedented high levels of camera surveillance in Johannesburg, the Information Regulator says section 18(1) of the Protection of Personal Information Act (POPIA) creates mandatory compliance requirements for operators.
“As such, a responsible party (operators) must make a data subject aware that his or her personal information is being collected, [the] purpose of the collection, whether the personal information is provided on a voluntary or mandatory basis, what are the consequences, if any, for failure to provide the requested information, and if the collection is required under a specific law,” says advocate Johannes Weapond, a full-time member at the Information Regulator.
The City of Johannesburg (COJ) has thousands of private camera networks and the city is expected to have over 15 000 Vumacam cameras in the next year. This is in addition to thousands of other privately controlled camera networks.
The city itself has more than 400 CCTV surveillance cameras that it uses to curb crime.
The cameras watch every person and car that moves near them. Critics have questioned the legality of some these cameras in relation to individual privacy rights.
Weapond has cautioned there are strict circumstances when exemptions are applied.
“Section 18(4) of POPIA provides grounds for exception to comply with section 18(1) if consent was obtained from the data subject, non-compliance would not prejudice the legitimate interest of a data subject, non-compliance is necessary to avoid prejudice to the maintenance of the law by a public body, and compliance under the circumstances is not reasonably practicable,” he explains.
There have been varied opinions regarding the private camera networks in the city, pitting operators on one side and critics on the other.
Vumacam CEO Ricky Croock recently told ITWeb there is a need to balance public interest and privacy with the purpose of public safety.
“Smart safety and security is vital to all of us – and not just because of our high crime levels but also the advantages it can offer, with improved quality of life and safe zones made possible, for example, for tourism and other business sectors.”
Croock, however, conceded COJ should have developed a CCTV surveillance policy, especially “considering they and many other companies (including other private companies) have hundreds, if not thousands, of cameras up around Johannesburg”.
Further, Croock said his company has been engaging with the city since October 2017.
The COJ hadn’t responded to a request for comment by the time of publishing.
Professor Jane Duncan from the journalism department at the University of Johannesburg says ethical and legal standards are necessary and POPIA should apply when installing a surveillance network in the city.
She argues that besides the legal issues: “Before embarking on privacy-invasive projects, the City of Johannesburg really should have developed a policy and consulted the public on it, so that residents could have an opportunity to shape what happens to their data.
“They [the COJ] should have also undertaken privacy impact assessments for each project and released them publicly, together with statements on how they planned to mitigate any risks. The Vumacam project, for instance, should have been preceded by such a process.”
Weapond agrees: “In order to comply with the compliance requirement stipulated in section 18(1) of POPIA, with specific reference to ‘reasonable practicable steps’ that a responsible party is required to take, consideration should be given to create a policy on the installation and monitoring of surveillance cameras.
“The ‘reasonable practicable steps’ that a responsible party must take to make a data subject aware that his or her personal information is being collected should also include, what is termed, a processing notice.”
He says the processing notice should be placed next to the CCTV surveillance camera and should contain the following information: the source of collection, name and address of the responsible party, the purpose for which the personal information is being collected, whether the supply of the personal information is voluntary or mandatory, consequence if information is not provided, and if the collection is required under a specific law.
Share