CCTV and Privacy: Recording an Incident Is Not Permission to Publish It

A camera captures an incident at a shop. The owner wants to upload the clip to warn other businesses. Before posting, ask a separate question: is public disclosure lawful and proportionate?

Permission to operate a camera does not automatically authorize every later use of its recordings. Footage identifying people may involve personal-data processing and other legal issues.

I. Start with purpose and lawful basis

The Data Privacy Act requires transparency, legitimate purpose, and proportionality. The National Privacy Commission’s Circular No. 2024-02 specifically addresses CCTV systems.

Identify why the system is used and the appropriate legal basis. Consent is not the only possible basis under the Act, but a camera owner should not assume that a general security purpose makes all collection and disclosure permissible. Sensitive personal information raises additional requirements.

II. Make the system understandable and controlled

A practical review should cover:

• Placement: whether the camera records more space or activity than necessary.
• Notice: whether people receive appropriate information about the monitoring.
• Access: who can view, retrieve, export, or delete recordings.
• Security: controls over accounts, storage devices, remote access, and backups.
• Retention: how long footage is needed for the stated purpose and how it is disposed of.
• Requests: a procedure for handling access, disclosure, and incident-related preservation.

The appropriate retention period is not a universal number for every camera. Define it from the purpose, relevant obligations, risks, and legitimate preservation needs.

III. Separate disclosure from public posting

Providing relevant footage through a lawful process to competent authorities is different from placing it on social media for unrestricted viewing. Review the requester’s authority, purpose, scope, and the legal basis for disclosure.

Public posting can expose employees, customers, bystanders, and children. It may also create an accusation from a short clip whose context is incomplete. A blurred face alone may not anonymize someone if clothing, location, names, or accompanying text identify them.

IV. Preserve an incident without spreading it

1. Secure the original recording. Keep the relevant time range and available contextual footage.

2. Document retrieval. Record who exported the file, when, and from which system.

3. Limit access. Share only with people who have a legitimate role in handling the incident.

4. Review requests individually. Confirm the basis and disclose only what is appropriate.

5. Retain the necessary record securely. Follow the preservation need and applicable obligations rather than keeping every recording indefinitely.

These steps support responsible handling; they do not replace the requirements for admissibility if the recording is later offered as evidence.

V. Does a home camera fall outside the rules?

The Act recognizes an exception concerning an individual’s processing in connection with personal, family, or household affairs. Its application depends on the circumstances. A camera monitoring beyond that setting, or a later use that changes the character of the processing, needs closer review under the NPC guidance.

A business should not assume a household exception applies to commercial monitoring merely because its camera was purchased for personal use.

VI. The practical takeaway

Use CCTV with a clear security purpose and disciplined data handling. Before releasing a clip, review disclosure separately from the original recording decision.

Sources and further reading

• Data Privacy Act of 2012: https://lexiquire.com/laws/RA%2010173
• NPC Circular No. 2024-02 on CCTV Systems: https://privacy.gov.ph/wp-content/uploads/2024/08/NPC-Circular-No.-2024-02-CCTV-Systems.pdf

This article provides general information on Philippine law. The appropriate advice and remedy depend on the facts, documents, and applicable rules.

For assistance reviewing your documents and legal options, contact MJM Law & Partners: https://www.mjmlawpartners.com/contact.

Clarity. Strategy. Results.

#DataPrivacy #CCTV #PrivacyCompliance #PhilippineLaw #MJMLawPartners