Surveillance and Monitoring

The Home aims to provide a positive home environment in which children can live and learn and where relationship-based practice is promoted.

All staff should:

• Strive to build relationships of trust and understanding with children;
• Be able to identify triggers and find solutions; and
• Where incidents occur, seek to defuse the situation as quickly as possible.

In line with Ofsted guidance, the Home’s providers and managers will ensure that the Home provides a positive environment where children can flourish, with staff who work positively and confidently with children, and who find the least intrusive way to support and empower children and keep them safe.

See: Positive Environments Where Children Can Flourish.

It is important therefore that managers and providers carefully consider the specific purpose and role of any surveillance and monitoring used in the Home, including whether there are other, less intrusive, ways and means to keep children safe.

Children and young people are at the centre of practice within the Home, and they should be informed (as early as possible after admission) about any monitoring and surveillance systems in use and the reasons for having it in the Home, as well as the safeguards in place regarding confidentiality and the retention of images.

The Children's Homes (England) Regulations (2015) regulation 24 states:

• The registered person may only use devices for the monitoring or surveillance of children if:
  • The monitoring and surveillance is for the purpose of safeguarding and promoting the welfare of the child concerned, or other children;
  • The placing authority consents in writing to the monitoring or surveillance;
  • So far as is reasonably practicable, and in the light of the child's age and understanding, the child is informed in advance of the intention to do the monitoring or surveillance;
  • The monitoring or surveillance is no more intrusive than is necessary, having regard to the child's need for privacy.
• This regulation is subject to any monitoring or surveillance requirements by a court.

Surveillance and Monitoring in Residential Childcare Settings (Ofsted, October 2019) provides that:

• The use of monitoring and surveillance in children's homes is only permissible when necessary to safeguard and promote the welfare of a child or other children or at the direction of a court;
• Details of any monitoring and surveillance systems should be outlined in the Home's Statement of Purpose and Children's Guide;
• Parents, children (if possible) and social workers should give consent to the use of surveillance and be informed how to make a complaint about its use, if necessary;
• Any kind of surveillance and monitoring must meet the needs of the individual child and be justified at the time of its use;
• The use of surveillance and monitoring devices should be for the protection and safety of children only and not staff (although this will be different for Secure Children's Homes);
• The use of surveillance as a 'default approach' to monitoring children's behaviour is not acceptable, neither should groups of children be subject to 'indiscriminate monitoring';
• CCTV monitoring screens should only be accessible to those staff who need to see the images at the time, for example, in a staff office where there is appropriate privacy;
• When CCTV or audio monitoring is used for the protection of children, plans must include how enough staff will be available to continually monitor images and to take immediate action to safeguard children without reducing the quality of care provided in the Home. This may differ for secure children’s homes and school;
• The impact of the surveillance or monitoring devices on individuals and their privacy should be considered. Regular reviews should take place to ensure that its use remains justified;
• Images and information should be stored securely, for their stated purpose, and only for as long as necessary;
• Security arrangements for sharing footage, for example, when used as evidence in court hearings, should be included in the setting's written policy.

Work mobile phones and other work devices used for surveillance activity must only be used for monitoring purposes inside the Home. They should not be used to store data recorded for surveillance if taken outside the Home.

Staff should have regular updated training on handling information gathered by surveillance. This should include:

• What to do when people ask for access to recordings;
• How and when to share information;
• What to do if there are complaints about surveillance;
• What to do if children or parents withdraw their consent to surveillance.

These principles are based on the Home Office Surveillance Camera Code of Practice which provides guiding principles which if followed enable an organisation to demonstrate that the operation of its surveillance camera systems is to a lawful and ethical standard. Relevant authorities such as the police and local authorities are required by law to have regard to the code. However, all operators of surveillance camera systems are encouraged to voluntarily adopt its principles.

When considering any use of surveillance and monitoring in the Home, it is important to balance the rights and freedoms of children, visitors and staff with the need for and purpose of the surveillance.

The Human Rights Act 1998; Data Protection Act 2018; Protection of Freedoms Act 2012 (POFA) (which regulates surveillance systems) and the Freedom of Information Act 2000 (FOIA) provide a framework to enable this balance to be achieved, and it is important that all guidance and regulations are adhered to.

The Surveillance Camera Buyers Toolkit suggests completing the following prior to installation and use of a surveillance system:

Statement of Need

This should consider what is the purpose of the surveillance/monitoring, and could that purpose be achieved by other means? Is a surveillance/monitoring system the most appropriate solution?

Risk Assessment

This should consider what are the risks to data subjects raised by the deployment of surveillance cameras? Is the impact on individuals’ rights and freedoms proportionate to the problem you are addressing? Can the risks be reduced to an acceptable level?

Data Protection Impact Assessment

One specific area of risk which arises with any surveillance camera system is the risk of interfering with people’s privacy. Whenever you capture someone’s image on your system you are processing their personal data. The collection and storage of data that can be used to identify an individual must be processed fairly and within the law. Processing such personal data can only be done lawfully by following the requirements of data protection legislation which is regulated by the Information Commissioner (ICO). Under the General Data Protection Regulation and the Data Protection Act 2018 most surveillance cameras will require a Data Protection Impact Assessment (DPIA). This should be started at an early stage before installing a surveillance camera system.

Guidance: Data Protection Impact Assessments for Surveillance Cameras contains DPIA guidance and a DPIA template which can be used by organisations to conduct data protection impact assessments for their surveillance cameras or surveillance camera systems.

This is not a one-off exercise. Privacy impact should be reviewed regularly and whenever fundamental changes are made to the system; such as when cameras are added, removed or their view repositioned.

If you decide to process personal data through a surveillance camera system you will be a controller under data protection law. As a controller you will be responsible for completing a DPIA. In doing so, these are some of the important factors to consider:

• The effect on individuals;
• Identify the responsibilities of people involved in processing data and the Data Protection Officer who you must consult over your DPIA;
• Review policies are in place;
• Only required information is held;
• Images are not stored longer than necessary;
• Only authorised and trained people can review images and recordings;
• Any associated information such as databases should be adequately protected.

Under the Data Protection Act 2018 and GDPR, if you are unable to mitigate the privacy risks adequately you have to submit your DPIA to the ICO for review.

The Home Office Surveillance Camera Code of Practice draws on and reinforces data protection obligations in relation to video surveillance.

See also information from the Information Commissioner’s Office on Data Protection Impact Assessments.

Good practice includes consulting with anyone who may be affected by the surveillance before you proceed; this should form part of your Data Protection Impact Assessment.

Once you start to operate your system, you must inform people that they are under surveillance. The Surveillance Camera Buyers Toolkit contains an example of a Privacy Notice to inform people about surveillance.

Right to be Informed (Information Commissioner’s Office) sets out that:

• Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the UK GDPR;
• You must provide individuals with information including: your purposes for processing their personal data, your retention periods for that personal data, and who it will be shared with - ‘privacy information’;
• You must provide privacy information to individuals at the time you collect their personal data from them;
• If you obtain personal data from other sources, you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month;
• There are a few circumstances when you do not need to provide people with privacy information, such as if an individual already has the information or if it would involve a disproportionate effort to provide it to them;
• The information you provide to people must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language;
• It is often most effective to provide privacy information to people using a combination of different techniques including layering, dashboards, and just-in-time notices;
• User testing is a good way to get feedback on how effective the delivery of your privacy information is;
• You must regularly review, and where necessary, update your privacy information. You must bring any new uses of an individual’s personal data to their attention before you start the processing;
• Getting the right to be informed correct can help you to comply with other aspects of the GDPR and build trust with people, but getting it wrong can leave you open to fines and lead to reputational damage.

Surveillance and monitoring devices include CCTV (both with and without voice-recording); listening devices; location trackers on personal electronic equipment; door sensors; noise sensors and movement alarms.

Some equipment, such as listening devices, can be used to monitor individuals, (for example where there are health or emotional well-being concerns). Note that audio-recording is considered as being particularly intrusive and so should be avoided unless there is a clear reason for it. 

Other equipment may capture activity in the environment, for example body-worn cameras, exit alarms, noise sensors and movement-activated mats.

Note: baby monitors are included within the Ofsted guidance as a listening device unless they are being used to monitor the welfare of a baby when adults are not present, e.g. when a baby is sleeping during the day. A parent may choose to use their personal mobile phone as a baby monitor when the baby is sleeping, and this is acceptable. Nevertheless, it should not be used to monitor another person's activity.

CCTV: is closed-circuit television system on a private network. Footage is monitored mainly for surveillance and security purposes. The system uses strategically placed cameras that send the images to monitors placed elsewhere.

If a setting uses CCTV to monitor places of public access, such as the exterior of a building, there should be clear notices alerting the public to its presence and the reason for its use. The notice should include contact details in order to enable a person to access and review any images of them (this is called a subject access request (SAR)).

Where external monitoring systems are installed, care must be taken to ensure that this does not extend to cover beyond the Home and its grounds. Where the Home has immediate neighbours, guidance recommends that neighbours should be involved and listened to. Surveillance/monitoring systems which covered neighbouring properties, albeit unintentionally, could be found to be infringing the privacy of neighbours.  This could be CCTV cameras and also features such as ‘smart’ doorbell cameras.  Care should be taken to check the range of any such devices, and it should be noted that such devices are likely to capture audio footage at a greater range than video footage, therefore care must be exercised if audio capture is enabled on external devices.

For further information see Domestic CCTV systems - Guidance for People Using CCTV (ICO)

CCTV must not be used to replace or supplement staffing.

Monitoring of personal electronic devices: this includes monitoring the use of a child's own laptop, desktop, tablet, mobile phone or any other personal electronic device. This must be carried out with their permission.

It is permissible to monitor online activity if it relates to the use of filters and monitoring the effectiveness of those filters to protect children from exposure to inappropriate online material and contact. This activity must be included in the Home's written policy and procedure.

Please note: online filters should not be used as substitute for on-going discussions with children in the Home about their online activity and how they can keep safe. See also: Safe Use of the Internet, Social Media and Photographs Procedure.

Covert Surveillance: Important note - only a court can sanction covert surveillance. This is where the monitoring of an individual is carried out in a way they are not aware of. This might include equipment such as hidden cameras and /or listening devices or secretly following the person. The Regulation of Investigatory Powers Act 2000 governs the use of covert surveillance by public bodies.

All Looked After Children will have Care Plans and Placement Plans. Children living in the  Home will also have a risk assessment. These plans:

• Must reflect the child's individual needs, levels of understanding and risks,(both for the child and in relation to other children);
• Must reflect the child's age, understanding and personal development and, as far as possible, their wishes and feelings;
• Clearly establish the ways in which the child is to be safeguarded both inside and outside the Home;
• Be multi-agency in nature;
• Specifically identify any monitoring or surveillance systems that are used or to be deployed – particularly CCTV and alarm systems;
• Confirm that the child has been made fully aware of the monitoring systems the Home uses and how this applies to them (depending on their age and understanding);
• Ensure the child, the parent/person with parental responsibility and placing authority have agreed to the use of the monitoring or surveillance;
• Ensure the child has access to an advocate to support them in their understanding of the Home's monitoring processes and enable the child to fully express their views about them;
• Should have the agreement of the parent or person with parental responsibility;
• Have agreement of the placing authority. The Home must gain consent to any monitoring or surveillance by the placing authority in writing at the time of placement;
• The monitoring and surveillance aspect of the Care and Placement Plan and Risk Assessment must be regularly reviewed and adjusted to reflect the changing needs and requirements of the child.

When CCTV or audio monitoring is used for the protection of children, staffing levels must be sufficient so that the images or alarms can be continually monitored and immediate action taken to safeguard children without reducing the quality of care provided in the Home.

All staff must be trained in the use and purpose of monitoring and surveillance systems e.g. setting door alarm systems.

All staff must be aware of the purpose and function of such systems and how they positively relate to each individual child.

Staff should have regular updated training on handling information gathered by monitoring or surveillance. This should include:

• What to do when people ask for access to recordings;
• How and when to share information;
• What to do if there are complaints about surveillance;
• What to do if children or parents withdraw their consent to surveillance.

• Images, and information should be stored securely, for their stated purpose, and only for as long as necessary;
• Security arrangements for sharing footage, for example, when used as evidence in court hearings, should be included in the setting's written policy.

The Home must also include local information specific to the individual Home, identified in the individual homes Statement of Purpose and covering the following:

• The legitimate purpose and aim of the surveillance, with each purpose and activity individually addressed;
• How the surveillance will keep children safe;
• Why surveillance is the best way of achieving a child’s safety;
• How any data is processed and stored;
• What security measures are in place to safeguard against unauthorised access and use;
• How often the surveillance activity will be reviewed to ensure that it is still necessary;
• How surveillance and monitoring activities are agreed with the placing authority, parents, carers and children (if appropriate);
• How others (for example, health visitors) are notified that they are being recorded.

Surveillance and Monitoring in Residential Childcare Settings (Ofsted)

Home Office Surveillance Camera Code of Practice and A Guide to the 12 Principles.

Surveillance Camera Buyers Toolkit - this guide is intended for anyone in any organisation up to and including small and medium sized enterprises buying a surveillance camera system who wants to maximise their chance of success (and minimise risk) by observing the principles of good practice.