Webcams and data protection requirements

Webcams have been in use for many years on the internet. The question has often been asked as to whether they are operated in accordance with data protection requirements. Basically, there are two legitimate ways to use them: either the cameras are positioned or configured in such a way that no individual can actually be recognized; or the persons concerned consent to their pictures being taken.

Webcam pictures can be called up over the web from anywhere in the world and they can be further processed, stored, printed, forwarded etc. without any form of control. Depending on the system, their quality can vary considerably. Some cameras are in a fixed position and the viewer is not free to select a particular angle. Other cameras allow the user to choose a particular position or to zoom in on a particular detail. Depending on the technology and positioning of the camera system it is possible to identify individuals on the pictures. Often, the persons whose pictures are being taken do not know that they are on camera. In other words, they do not know that their pictures can be called up on the internet nor the purpose for which they may be used.

No objections from a data protection perspective can be raised if the searchable pictures are not accompanied by data that allow the individuals concerned to be identified or their identity to be deduced. On the other hand, if identification is possible, then the DPA considers this to be a case of personal data processing. Even if the data available not does not permit the unambiguous identification of an individual, their identity may nevertheless be deduced based on the information context (e.g. objects, clothing, vehicles, etc.).

All those involved in the processing of personal data must bear in mind the following principles which are set out in the Data Protection Act. Personal data must only be collected by lawful means. The processing of such data must be done in good faith and satisfy the proportionality principle. Personal data may only be processed for the purpose indicated when collected, or rendered obvious by the circumstances or because of legal requirements. Personal data may not be transmitted abroad if to do so might seriously harm the individual's personality rights, and in particular if there is no equivalent level of data protection as in Switzerland.

Private persons who process personal data may not unlawfully infringe the privacy rights of data subjects. An unlawful infringement of such rights by private persons carrying out the processing shall be deemed to have taken place if the data subject's consent has not been obtained, there is no overriding private or public interest, or if it is not justified by a legal requirement. The operators of webcams cannot invoke any overriding private interest. There is also no public interest or legal justification to justify the operation of a webcam. Thus, the disclosure of personal data obtained via a webcam may only be authorized after the consent of the data subject has been obtained. That consent must be given freely and in full knowledge of all the relevant circumstances. If the person concerned has any reason to believe that he/she may suffer any disadvantage from not allowing their image to be recorded by the camera, the consent shall be considered null and void. Obtaining a person's consent is often not feasible, for example when webcams are pointed at public streets. In such circumstances appropriate technical and organisational measures must be taken to ensure that the persons who are filmed cannot be identified.

In view of the above, the use of webcams in public places shall be subject to the following data protection requirements: 1. Webcams shall be configured in such a way that no person may be recognized either directly, or because of any objects that might allow them to be identified. 2. If identification is possible, the consent of the person whose image has been recorded by the camera must be obtained. The desire not to be filmed must be respected at all times. Furthermore, consent may not be subject to any conditions and is not valid until comprehensible information has been provided before the person steps into the area covered by the camera. We have asked several webcam operators in Switzerland to verify that they are respecting data protection requirements and to modify their systems where appropriate. Capacity limitations prevent us from systematically checking all webcams. Persons who feel that their personality rights have been infringed may take court action.

[July 2004]