"Not all data controllers are required to notify under the Data Protection Act 1998 for the purpose of CCTV. We have produced guidance that helps data controllers to determine whether they are required to notify for the purpose of CCTV which is available on the ICO website under the heading 'For organisations', then click on CCTV. We are not required, and do not to keep a list of data controllers that are not registered under the Data Protection Act 1998. Notification is a self-assessment process whereby each organisation determines if notification is required. The total number of data controllers whose notification include the purpose of CCTV P113 - Crime Prevention and Prosecution of Offenders is 49,486. We are unable to break this number down on a more local level unless you have a specific postcode/s that we could narrow the search criteria down to. If you would like the search to be narrowed to specific postcodes, please advise accordingly. Alternatively, you carry out searches on the public register of data controllers available on our website."

Requirement to Register:

 http://www.ico.gov.uk/Home/for_organisations/topic_specific_guides/cctv.aspx
"The UK has more public and private CCTV systems per person than anywhere else in the world. Because of this, it's an area in which we're taking a great deal of interest. If you have a very basic CCTV system, its use may not be covered by the Data Protection Act. For example, if you're a small shopkeeper with a couple of cameras you can't move remotely which record whatever the system picks up and only give the recorded images to the police as a result of an incident in your shop, then you're not covered by the Act. However, if your system is more advanced and allows you to zoom in on an individual member of staff whose behaviour is causing you concern, or you use cameras to monitor the movements and activities of your workforce, you'll need to inform us. You'll also need to let us know if you give the recorded images to anyone other than the police or a similar law enforcement agency. The highly sophisticated CCTV systems used in large shops, railway stations, town centres and other places where large numbers of people gather are designed to focus on particular people or identify criminal activity. These types of images are covered by the Act, but if a general scene is recorded without an incident occurring, the pictures are not covered.
In summary, if the image recorded is aimed at learning about a particular person's activities, then it's covered by the act."

The search page is here:
 http://www.esd.informationcommissioner.gov.uk/esd/search.asp

I've just been playing around with their database. This database contains ALL DP records so you have to look out for mention of CCTV. The first thing I notice is it isn't very well programmed. You have to put the postcode in with a space between the two parts of the postcode so SW11AA doesn't work, but SW1 1AA does. [As an aside, this is the postcode for Fuckingham Palace, which returns THE PRIVATE SECRETARY FOR THE HOUSEHOLD OF HRH THE PRINCESS ROYAL, and one of the dataclasses Princess Ann records is 'Sexual Life' - I would love to see the subcategories she records for her employees sexual life ]. You can search on the first part of a postcode ie SW1 but if more than 100 records are found then none are returned and you are asked to refine your search. Again, sloppy, sloppy programming - I doubt any private or activist database would be this hard to search so it almost seems half-hearted, 'security through obscurity'.

So I started searching on CCTV systems I know about. I searched on the postcode of an industrial estate that is ringed with a sophisticated CCTV system, The individual companies CCTV within that estate were returned, but no mention was made of the estates CCTV. I don't know why and will submit a further question to the ICO about this, but at best it takes them weeks to respond. The cameras are obviously sophisticated not to be exempt from the various acts. It may be a police system and perhaps these are exempt, or it may be one of the 90% illegal systems. I'll ask the ICO, and if I get no intelligible response, I'll test it by breaking one of the cameras and waiting for the police to respond. Here is a sample record for a legal CCTV system - I wonder what would happen if someone committed a criminal act on the 22nd of October at that location ? There must be a lot of registered systems whose registrations are about to expire...



Registration Number: Z5785977

Date Registered: 22 October 2001 Registration Expires: 21 October 2007

Data Controller: WOODS GARAGE LIMITED

Address:

EAST END
WEST CALDER
WEST LOTHIAN
EH55 8AD

This register entry describes, in very general terms, the personal data being processed by:
WOODS GARAGE LIMITED

This register entry contains personal data held for 1 purpose(s)
Purpose 1

Crime Prevention and Prosecution of Offenders

Purpose Description:

Crime prevention and detection and the apprehension and prosecution of offenders.

Data Controllers further description of Purpose:

INCLUDES THE USE OF CLOSED-CIRCUIT TELEVISION FOR THE MONITORING AND COLLECTION
OF SOUND AND/OR VISUAL IMAGES FOR THE PURPOSE OF MAINTAINING THE SECURITY OF
PREMISES, FOR PREVENTING CRIME AND FOR INVESTIGATING CRIME.

Data subjects are:

Customers and clients
Offenders and suspected offenders

MEMBERS OF THE PUBLIC
THOSE INSIDE, ENTERING OR IN THE IMMEDIATE VICINITY OF THE AREA UNDER
SURVEILLANCE

Data classes are:

Personal Details
Goods or Services Provided
Offences (Including Alleged Offences)
Criminal Proceedings, Outcomes And Sentences.

SOUND AND/OR VISUAL IMAGES
PERSONAL APPEARANCE AND BEHAVIOUR

Sources (S) and Disclosures (D)(1984 Act). Recipients (1998 Act):

SECURITY ORGANISATIONS

Data subjects themselves
Business associates and other professional advisers
Employees and agents of the data controller
Suppliers, providers of goods or services
Persons making an enquiry or complaint
Police forces

Transfers:

None outside the European Economic Area


Statement of exempt processing:

This data controller also processes personal data which is exempt from notification