The National Privacy Commission (NPC) has issued a new directive today, Aug. 12, to update the policy framework for the use of Closed-Circuit Television (CCTV) systems by personal information controllers (PICs) and personal information processors (PIPs).
This is part of an ongoing effort to ensure that the use of CCTV technology aligns with the provisions of the Data Privacy Act of 2012 (DPA).
The newly issued circular details the responsibilities and obligations of entities utilizing CCTV systems in their operations, emphasizing the need for compliance with the DPA. It specifically targets CCTV systems employed by PICs and PIPs that handle personal data. However, the circular excludes CCTV systems used for personal, family, or household purposes, as well as those used in lawful surveillance activities.
“As technology advances, so too must our policies,” said Privacy Commissioner Atty. John Henry Naga. “This circular ensures that the use of CCTV systems is responsible and respectful of data subject rights. PICs and PIPs using CCTV systems must understand their obligations under the DPA and implement appropriate safeguards to protect personal data.”
Right to reasonable access
One of the key provisions of the circular is the requirement for PICs to prominently display CCTV notices in areas under surveillance. These notices must clearly outline the nature, scope, and extent of the surveillance, the purpose of the CCTV system, and other important details.
Individuals whose personal data are captured by CCTV systems have the right to reasonable access to footage in which they appear. This access is subject to the DPA, its Implementing Rules and Regulations (IRR), relevant issuances of the NPC, and other applicable laws and regulations. The circular mandates that PICs and PIPs establish procedures to efficiently respond to such access requests. Moreover, CCTV footage may be disclosed for purposes such as law enforcement, criminal investigations, court orders, and administrative inquiries, as outlined in the directive.