The Information Commissioner’s Office (ICO) has published guidance on how organisations can lawfully process personal information to protect their businesses from crime.

According to the ICO, the guidance has been prompted by organisations – particularly retail businesses – expressing concern about how to take effective steps to protect themselves from crime whilst ensuring that they comply with data protection law. Those concerns are only heightened by the British Retail Consortium’s estimate that there are 5.5 million incidents of theft across the retail sector each year.

The guidance makes clear that organisations can collect personal information through the use of measures such as CCTV, dashcams, and video doorbells. However, personal information about suspected criminal activity is criminal offence data, the lawful processing of which requires certain additional steps to be followed. This includes carrying out a data protection impact assessment, as well as preparing an ‘appropriate policy document’ (APD) which explains how the organisation meets its data protection duties and how long criminal offence data is kept. The guidance also sets out that organisations should only collect what they need and delete it thereafter, put in effective security controls, and provide clear signage in public areas about the use of CCTV or facial recognition technology.

The ICO also offers advice on the steps that organisations should follow to ensure that any information is lawfully shared with the police, as well as within the business. It stresses that notices of suspected offenders should not be put up in areas where the public can see them, and that businesses should not publicly post images of suspected offenders on social media.

Finally, the guidance touches on the use of facial recognition technology (FRT), confirming that it can be used, but that its lawful use in public places has a high bar because it scans everyone in the environment. To overcome that bar, the ICO refers organisations to its more detailed guidance on FRT in public places (here), and makes clear that organisations wishing to use FRT must be able to demonstrate that its use is necessary to prevent crime, that less intrusive alternatives have been considered, and that the associated risks have been identified and minimised.

To read the guidance in full, click here.