UK Ruling Shows Legal Risks of Video Doorbells and Home Security Cameras

The dispute began after Woodard invited his neighbour, Dr Mary Fairhurst, to tour his newly renovated home and showed her his security setup. It escalated when Fairhurst discovered that the camera mounted on Woodard’s shed pointed directly at her property. The court heard that she was “alarmed and appalled” by the camera’s position, and she objected to live video footage being streamed directly to Woodard’s smartphone. She found the audio data captured by the devices, which recorded her private conversations, “even more problematic and detrimental than video data,” according to the report.

At Oxford County Court, Judge Melissa Clarke upheld claims that the devices “unjustifiably invaded” Fairhurst’s privacy and that their use breached the Data Protection Act 2018 and UK General Data Protection Regulation legislation. The court singled out audio data as especially problematic because it captured conversations from people who were entirely unaware that a device was listening or that audio was being processed. Woodard was ordered to pay damages and a fine believed to total up to £100,000.

Speaking at the time of the case in October 2021, digital privacy expert Hannah Hart of Pro Privacy told the BBC that while the case did not set a legal precedent, it continued an ongoing conversation about changing attitudes toward domestic surveillance and how normalised it had become in communities.

Five years after the case, the report said, the risk of falling foul of the law with home security equipment has grown as technologies such as facial recognition have become commonplace and users post footage from security cameras and video doorbells on social media. Rules vary between regions, but in most countries legislation protects the privacy of individuals whose images, and potentially voices, are captured by such devices.

Lisa Sweetman, a partner in the commercial team specialising in data protection at legal firm Knights, told TechRadar that users of this kind of surveillance technology must have a lawful basis for doing so and should or must, in certain cases, conduct a data protection impact assessment or risk assessment to ensure they are aware of and can mitigate risks to other people’s privacy. She said users must tell people the technology is in use through clear signage supported by a more detailed privacy notice on their property, and must be prepared to respond to questions and requests about the use of their data.

Sweetman added that data protection regulations include an exception for purely personal household use, known as the domestic purposes exemption, but said its application is limited.

Will Richmond-Coggan, partner and head of data and privacy disputes at legal firm Freeths, told TechRadar that users who wish to rely on the domestic exemption should ensure the camera’s field of view does not extend beyond the perimeter of their property. Where that is not possible, or where a homeowner specifically wants to keep an eye on a car parked on the road, he said they should proceed on the basis that they are operating CCTV in a public space and may be regarded as a controller of any personal data collected.

That means doing the same things a business would do, including making clear decisions about what the data is used for, how long it is retained and the circumstances in which it might be shared, according to Richmond-Coggan. For sharing footage with neighbours to guard against scammers, car thieves and burglars, he advised creating a written data sharing agreement that commits each party to common standards of safeguarding and use.

The Information Commissioner’s Office, which enforces data protection regulations in the UK, offers guidance on home CCTV systems, including accidental spillage where footage beyond a property’s boundary is captured, the report said.