Login

HCS74-Use of CCTV, Audio Recording and Monitoring Technology Policy

{{org_field_logo}}

{{org_field_name}}

Registration Number: {{org_field_registration_no}}

Use of CCTV, Audio Recording and Monitoring Technology Policy

1. Introduction

This policy sets out how the service will respond to the use of closed-circuit television, doorbell cameras, webcams, baby monitors, smart-home devices, audio-recording equipment, live-streaming systems, body-worn devices and any other technology capable of observing, listening to, monitoring or recording people while care and support is being provided in a person’s home. For the purpose of this policy, these devices are collectively referred to as “monitoring technology”.

The policy is intended to protect the rights, dignity, privacy, safety and wellbeing of people receiving care, household members, visitors and workers. It also explains the circumstances in which the service may become responsible for personal data captured by monitoring technology and the actions that must be taken to comply with Scottish care legislation, human-rights law, data-protection law, employment law, safeguarding duties and Care Inspectorate expectations.

The service recognises that a person, household member, attorney, guardian or other authorised person may consider using monitoring technology for security, communication, reassurance, health monitoring, safeguarding or another legitimate purpose. Monitoring technology must not be treated as a substitute for safe staffing, effective supervision, good care planning, appropriate risk assessment, meaningful human contact or prompt safeguarding action.

The use of monitoring technology must be lawful, necessary, proportionate and as non-intrusive as possible. Decisions must be person-centred and must take account of the person’s wishes, feelings, communication needs, capacity, legal rights, personal outcomes and the rights of everyone likely to be recorded.

2. Scope

This policy applies to:

This policy applies whether monitoring takes place openly or without the knowledge of staff. However, covert monitoring raises particularly serious legal, ethical and employment concerns and must be managed in accordance with section 8 of this policy.

3. Legal, Regulatory and Professional Framework

This policy will be applied in accordance with the following legislation, standards and guidance, as amended or replaced:

The service will maintain a separate legislation and guidance register showing the current version, publication date, review date and responsible person for each source.

4. Policy Statement

The service respects the right of people to exercise control within their own homes. The service also has responsibilities to protect the rights, safety, dignity, confidentiality and wellbeing of the person receiving care, workers, household members and visitors.

The service will not automatically object to monitoring technology in a person’s home. Each situation will be considered individually, openly and proportionately. The service will seek to reach an agreed arrangement that enables safe care to continue while protecting the rights of everyone affected.

Any monitoring arrangement connected with the delivery of care must:

5. Consent, Capacity, Legal Authority and Supported Decision-Making

5.1 The Person’s Agreement and Participation

Wherever the person is capable of making the relevant decision, monitoring must not be introduced as part of their care arrangements without their free and informed agreement.

Staff must support the person to understand:

Information must be provided in a form, language and communication method that is appropriate for the person. The person must be given sufficient time and support to consider the decision and may involve an independent advocate or another person of their choice.

Agreement must be specific to the proposed arrangement. Agreement to one camera, room, purpose or period must not be treated as agreement to wider monitoring.

5.2 Decision-Specific Assessment of Capacity

Capacity must not be assumed or rejected solely because of a diagnosis, disability, communication difficulty, age, appearance or previous decision.

Where there is reason to doubt whether the person can make the particular decision about monitoring, the service must:

A person must not be treated as incapable merely because they make a decision that others consider unwise.

5.3 Where the Person Cannot Make the Relevant Decision

Where the person is unable to make the relevant decision, the service must apply the principles of the Adults with Incapacity (Scotland) Act 2000 where the proposed action amounts to an intervention under that Act.

Before agreeing to or participating in monitoring, the service must be satisfied that:

The service must not assume that a spouse, partner, relative, carer or “next of kin” has legal authority to consent on behalf of the person.

A continuing or welfare power of attorney, guardianship order, intervention order or other legal document must be examined to confirm:

A copy of the relevant part of the legal document, or a verified record of the authority checked, must be retained in accordance with the service’s records-management arrangements.

Where legal authority is absent, unclear, disputed or insufficient, the service must seek appropriate legal or professional advice before actively participating in the monitoring arrangement.

5.4 Objection, Distress or Withdrawal

If the person objects to the monitoring, repeatedly attempts to avoid it, appears distressed by it or withdraws their agreement, staff must:

A representative’s preference must not automatically override the person’s objection.

6. Ownership, Control and Data-Protection Responsibility

6.1 Monitoring Controlled Solely by the Household

Where monitoring technology is installed and used solely by an individual in the course of a purely personal or household activity, and it captures only the person’s private home or garden, the household exemption from data-protection law may apply.

The service must not state categorically that the household exemption applies. The individual or household remains responsible for obtaining appropriate advice about their own legal responsibilities.

Data-protection law may apply where equipment captures areas outside the private household boundary, such as a neighbour’s property, a shared corridor, communal space, public footpath or road. ICO guidance confirms that images and voices of people are personal information and that domestic CCTV extending beyond the property boundary may fall within data-protection law.

6.2 When the Service May Become a Controller

The service must obtain advice from its Data Protection Officer or designated data-protection lead before it:

In these circumstances, the service may be a controller, joint controller or separate controller and must document its role and responsibilities.

6.3 Lawful Basis

Where the service is a controller, it must identify and document an appropriate lawful basis under Article 6 of the UK GDPR before processing begins.

Where footage reveals health information, disability, ethnicity, religion, biometric information or other special-category data, the service must also identify and document an applicable condition under Article 9 of the UK GDPR and Schedule 1 to the Data Protection Act 2018.

Consent must not be used as the service’s lawful basis unless it is genuinely voluntary, specific, informed, unambiguous and capable of being withdrawn without detriment. Consent is unlikely to be appropriate where the person or worker has no realistic choice.

Where criminal allegations or criminal-offence information are processed, the service must identify an appropriate legal condition and apply additional safeguards.

6.4 Data Protection Impact Assessment

Before the service introduces, directs or systematically accesses monitoring technology, it must complete a data protection impact assessment where the processing is likely to create a high risk to individuals’ rights and freedoms.

The assessment must consider:

The assessment must be approved by the Data Protection Officer or data-protection lead and reviewed whenever the system or purpose changes.

7. Operational Procedures

7.1 Location, Field of View and Times of Operation

Before care is delivered in an area covered by monitoring technology, the manager must establish:

Monitoring must not normally take place in:

Any proposed monitoring of intimate care must be treated as an exceptional arrangement. It requires:

Convenience, general reassurance or routine family preference will not normally justify recording intimate care.

7.2 Audio Recording

Audio recording is generally more intrusive than video-only monitoring because it may capture confidential conversations, health information, telephone calls and discussions unrelated to the person’s care.

Audio must be disabled unless there is a specific, documented and proportionate reason for using it.

Where audio recording is proposed, the assessment must explain:

Staff must not discuss another person’s confidential information within range of a recording device.

7.3 Security, Confidentiality and Access

Monitoring recordings must be treated as confidential and potentially highly sensitive information.

Where the service controls or retains recordings, it must ensure:

Staff must not copy, download, retain, edit, publish, forward or share footage unless this has been specifically authorised in accordance with this policy.

Where the recording system is controlled by the household, staff should not attempt to access the equipment, alter settings or delete footage unless this is necessary to prevent immediate harm and has been authorised by a manager or emergency authority.

7.4 Retention and Secure Deletion

Recordings must not be retained for longer than is necessary for the stated purpose.

The retention period must be based on a documented assessment and not selected merely because it is the equipment’s default setting. The assessment must consider:

Where the service controls the recording, the retention period must be documented in the service’s retention schedule and privacy information.

Relevant footage may be preserved for longer where it is reasonably required for:

Any preservation decision must be documented, access must remain restricted and the footage must be deleted securely when it is no longer required.

Staff must not advise a household that a particular retention period is legally approved unless advice has been provided by the service’s Data Protection Officer or a suitably qualified adviser.

7.5 Requests to View, Obtain or Preserve Recordings

Staff must not make informal requests to view footage.

Any request by the service to view, obtain or preserve footage must be referred to the manager and must record:

Where the household controls the footage, disclosure will normally require the agreement of the person controlling the system. However, disclosure may also be required or permitted by law, including in response to:

Where the service controls footage, requests from individuals to access their personal data must be managed under the service’s data-subject-rights procedure. The service must consider the rights of other people visible or audible in the recording before disclosure.

No footage may be edited, clipped or removed from its original context in a misleading manner.

8. Covert Monitoring

Covert monitoring means monitoring carried out without the knowledge of one or more people who are being recorded.

The service does not encourage covert monitoring as a routine means of checking the quality of care. Covert monitoring may significantly interfere with privacy, dignity, trust, employment rights and the rights of other people in the home.

Where the service becomes aware that covert monitoring is taking place or is being considered, the matter must be referred immediately to the registered manager.

The manager must consider:

Staff must not search for, cover, disconnect, damage, remove or interfere with suspected covert equipment unless necessary to prevent immediate and serious harm.

A worker who discovers or suspects covert recording must:

The service must not discipline a worker solely because covert footage exists. Any concern identified from footage must be considered fairly, in context and in accordance with the service’s safeguarding, disciplinary, whistleblowing and evidence-handling procedures.

The service reserves the right to suspend or alter care in a particular room or setting where covert monitoring creates a serious and unresolved risk to privacy, safety, dignity or lawful service delivery. Any decision to change or suspend care must be proportionate, authorised by senior management and accompanied by action to protect the person from interruption of essential care.

9. Safeguarding and Incident Reporting

If CCTV footage reveals a safeguarding concern or incident that requires further investigation or reporting:

  1. Immediate safeguarding action: Where footage, live monitoring or information about a monitoring system indicates abuse, neglect, exploitation, discriminatory treatment, unlawful restraint, theft, wilful neglect or another risk of harm, staff must take immediate action to protect the person and follow the Adult Support and Protection Policy. Urgent concerns must be reported without delay to the manager, the relevant local-authority social work service and, where a crime or immediate danger is suspected, Police Scotland or the emergency services.
  2. Preservation of potential evidence: Staff must not edit, delete, rename, enhance, circulate or repeatedly replay potential evidence. The manager must ask the lawful controller of the system to preserve the relevant original footage and associated information, including date, time, device details and access logs. The service must maintain a clear record of who received, viewed, copied or transferred the footage.
  3. Notifications and referrals: The registered manager must determine without delay whether the incident requires notification to the Care Inspectorate under its current notification guidance, referral under adult-support-and-protection procedures, notification to Police Scotland, reporting to the commissioning authority, referral to the SSSC or another professional regulator, or reporting to the Information Commissioner’s Office.

The Care Inspectorate must not be notified automatically merely because CCTV exists or footage has been viewed. Notification must be based on the nature and seriousness of the incident and the current Care Inspectorate notification categories and timescales.

Where the service experiences a personal-data breach, the Data Protection Officer or data-protection lead must assess whether the breach must be reported to the Information Commissioner’s Office within 72 hours of the service becoming aware of it and whether affected individuals must be informed.

10. Personal Planning and Risk Assessment

Where monitoring technology affects the delivery of care, the following information must be recorded in the person’s personal plan or clearly linked records:

A specific risk assessment must address:

Monitoring arrangements must be reviewed:

Reviews must determine whether monitoring remains necessary, proportionate, lawful and the least restrictive available approach.

11. Staff Responsibilities and Training

11.1 Staff Responsibilities

Workers must:

11.2 Staff Concerns, Consultation and Support

Workers must be informed before they are routinely assigned to a home where visible monitoring affects care delivery.

The service will provide workers with:

A worker’s objection will not automatically prevent care being provided, but it must be considered reasonably and proportionately. The service must assess whether adjustments, an alternative allocation or changes to the monitoring arrangement are appropriate.

Monitoring must not be used to subject workers to constant or excessive surveillance, humiliation, harassment or discriminatory treatment.

11.3 Training and Competence

Relevant workers and managers will receive training appropriate to their responsibilities. Training will cover:

Training must be included in induction and refreshed at intervals determined by the service’s training-needs analysis. Additional training must be provided following material changes in legislation, regulatory guidance, technology or service practice.

Managers responsible for making decisions under this policy must be competent to recognise when legal, human-resources, safeguarding or data-protection advice is required.

12. Recording by Staff

Workers must not use a personal mobile telephone, tablet, camera, smart watch, audio recorder or other personal device to photograph, film, listen to or record a person receiving care, their home, care records, medication, family members or colleagues.

Recording may take place only where:

Staff must not activate body-worn recording equipment in a person’s home unless its use has been specifically authorised by the service and is covered by a separate procedure, risk assessment, data protection impact assessment and personal-plan agreement.

13. Monitoring and Compliance

13.1 Review and Quality Assurance

The service will review the effect of monitoring technology on the delivery and quality of care. The service will not inspect a privately controlled system or demand access to recordings without a defined reason and lawful authority.

Quality assurance will consider:

13.2 Required Records

The service must maintain:

Records must be clear, accurate, contemporaneous and proportionate. They must distinguish fact, professional judgement, reported information and unverified allegation.

14. Complaints, Concerns and Disputes

A person receiving care, representative, household member, visitor or worker may raise a concern about monitoring technology without fear of retaliation.

Concerns may include:

Complaints about the service will be managed under the service’s Complaints Policy. The complainant will be informed that they may also contact the Care Inspectorate directly.

Where the concern relates to data protection, the matter must be referred to the Data Protection Officer or data-protection lead. Individuals must be informed of their right to complain to the Information Commissioner’s Office.

Where disagreement cannot be resolved and essential care may be affected, the manager must consider:

Essential care must not be withdrawn abruptly because of a dispute about monitoring unless there is an immediate and serious risk that cannot be managed safely. Any change must follow the service agreement, commissioning arrangements, risk-management procedures and continuity-of-care responsibilities.

15. Requests from External Authorities

Any request for footage or information from Police Scotland, the Care Inspectorate, a local authority, court, solicitor, insurer or other external body must be referred to the registered manager and, where appropriate, the Data Protection Officer.

The service must:

Staff must not promise confidentiality where information may need to be disclosed to protect a person from harm or comply with a legal obligation.

16. Policy Review and Governance

This policy will be formally reviewed at least annually and earlier where:

The registered manager is responsible for operational implementation. The provider is responsible for ensuring that appropriate legal, data-protection, safeguarding, human-resources and information-security advice is available.

The service will consult people receiving care, representatives and workers when reviewing the practical operation of this policy.

Changes will be communicated to workers and incorporated into training, supervision, personal planning, risk assessment and quality-assurance systems.

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.

Leave a Reply

Your email address will not be published. Required fields are marked *