Data Privacy Day 2025
13 January 2025
Data Privacy Day takes place on 28 January 2025 and aims to help raise awareness of how organisations and individuals can manage and protect personal data.
This year has seen a focus on safeguarding privacy by balancing legitimate aims against individual rights, particularly in the context of surveillance. Surveillance is the close observation or monitoring of individuals or spaces, usually for the purpose of influencing behaviour or protecting people. It carries a risk of being intrusive, so requires extra care to minimise risk and ensure compliance.
To reflect this, we wanted to provide some guidance on the legal requirements and what to consider when carrying out activities that fall under the umbrella of surveillance.
The surveillance landscape
As data protection professionals, we have seen a trend towards the normalisation of surveillance in both public and private spheres, often justified under the banner of convenience. From facial recognition systems in public spaces to digital footprints online, surveillance has become virtually unavoidable.
While this undoubtedly raises privacy concerns, we also appreciate that organisations often have a genuine need to deploy these types of technologies to fulfil a specific purpose, such as security. We work with clients who regularly need to use surveillance technologies, including CCTV cameras, call recording, vehicle location tracking, and web monitoring.
By considering proportionality and putting mitigating measures in place, we believe that a balance can be struck which respects the rights and freedoms of individuals.
The principle of proportionality
At the heart of privacy protection lies the principle of proportionality. Therefore, you need to be confident that any surveillance measure you intend to adopt is:
- Necessary and suitable for achieving a legitimate aim. One common aim is detecting or preventing a crime.
- The best option available, having considered less intrusive alternatives.
- Proportionate to the benefit. Surveillance should not be taken lightly or used excessively to achieve minor objectives.
Organisations should carefully assess whether their surveillance practices meet these criteria. If you are comfortable the activity is proportionate, we recommend the practical steps below to ensure that privacy risks to individuals have been properly mitigated.
Practical steps
To ensure responsible surveillance practices, you should always:
- Implement privacy by design
Build privacy considerations into surveillance systems from the ground up. This includes features like automatic data deletion, access controls and encryption.
- Conduct a data protection impact assessment (DPIA)
Before implementing any surveillance system, thoroughly evaluate its necessity and the potential impacts on individual privacy. Document your reasoning and explore less intrusive alternatives.
- Maintain transparency
Clearly communicate what data is being collected and how it will be used in an easily accessible privacy notice. Adopt signage to let people know when they are entering areas covered by CCTV. Provide clear contact details for individuals to raise concerns or questions.
- Adopt a policy document
We would suggest adopting a Surveillance Policy that sets out the organisation’s arrangements for the use of surveillance technology and related processing of personal data. It should cover issues such as security, access, retention, and disclosures.
Remember to periodically review your surveillance practices to ensure they remain necessary and proportionate. Update or remove systems that no longer serve their intended purpose, or where less intrusive alternatives become available.
Looking forward
As we mark Data Privacy Day 2025, we at Veritau are mindful that privacy protection is ultimately about respecting human dignity and fostering trust. The future of surveillance must be balanced with robust privacy safeguards and a commitment to proportionality.
By taking a thoughtful, measured approach to surveillance, our clients can achieve their legitimate security objectives while preserving individual rights. This balance isn’t just good practice—it’s essential for maintaining public trust and protecting fundamental human rights.
Data protection support
Veritau can help guide your organisation through the complex world of data protection, including ensuring your surveillance activities are compliant.
We provide Data Protection Officer (DPO) and consultancy support to over 700 clients, including schools, multi-academy trusts, local authorities, charities, and national sporting bodies.
To discuss your organisation’s data protection requirements, please get in touch.
