Is this a breach of GDPR?

[560934P]

I work in a school and the local shop showed me CCTV footage of a pupil stealing. Was he wrong to show this to me. The Safeguarding Lead is saying he should not have done so.

No. The CCTV is presumably there to help them catch thieves so they are using the "data" i.e. the images for the intended purpose.

I'd say no, for the reason above. And even if it was, I couldn't give a shiny shit about protecting the identity of the little sod who stole from him.

Yesterday a bike was pinched round our way and the young lad took a battering from the thieves. Within half an hour the culprits faces were on the Facebook community forum and the public had them identified before the police could send an officer out.

No.

One of the pupils from the school you work in has been caught shoplifting.

Rather than complain about GDPDR ‘rights’ - I hope the child caught is punished.

Yes it is. If there is anyone who is identifiable in the CCTV then it can only be viewed by the owner or the police.
Exception would be if it was you in the CCTV and there was no one else who was at all identifiable.

However I do have a lot of sympathy for the shopowner.

You're more concerned about the shop showing you cctv footage of one of your own school's pupils stealing than you are about the little shit stealing stuff?

Words fail me.

Half of the posts on local facebooks will have to be deleted if everyone follows that rule. CCTV of low life criminals are a staple

Also my local police appeal for CCTV of incidents to help with enquiries, are they getting the law wrong?

Before you share CCTV images , you need a good reason. The law says there are a few valid reasons, such as:

• Consent: If the people in the footage agree to it being shared, you can post it. However, if the footage shows someone committing a crime on your property, getting their consent might not be possible.
• Legitimate Interests: You can share the footage if you have a good reason that doesn’t harm the people in the video. For example, if sharing the video helps protect others in your neighbourhood.
• Legal Obligation: Sometimes, you might need to share footage because the law requires it, like helping the police.

id probably say the cctv owner has a legitimate interest in protecting his business if he is trying to put a face to a name. Its easier to go to the police with a name than a picture off CCTV.. they’re more likely to follow it up with more details. That’s why everyone feels the need to do their own investigations for the police now days.

GDPR rules would probably apply to you if you were to hand over the name, address etc If the child is a pupil at your school as that’s a breach of Data protection

Yes, if you are recording CCTV then you should:

1. make sure everyone knows that they are being recorded.
2. Only use the recording for the intended purpose

Both of those I'd assume the shopkeeper was complying with.

However under GDPR the footage should only be shown to someone with "legitimate interest". And a random teacher to identify them would not count. If you do show footage to anyone else then any identifiable person should be blurred out.
And you are right, FB CCTV/Ring doorbell posts would strictly speaking fall foul of GDPR in exactly the same way.

But you can see how it could be problematic.
Shopkeeper shows it to OP. OP says she has identified little Jonny in 8A. She tells the safeguarding person that Jonny has been shoplifting, and maybe she mentions it to the form teacher too.
Teacher pulls Jonny aside to ask a few questions... The door is open (as it should be for safeguarding if they're alone) and the rumours start that Jonny was shoplifting.

Only thing it wasn't Jonny. It was Milo in 7F who has a similar coat, but the Op doesn't teach them so isn't on their radar.

Yes, I have every sympathy with the shopkeeper, but he could fall foul of GDPR in this case.
I have limited sympathy with a lot of the FB recordings, as a fair number I've seen are either making assumptions ("This person walked up our drive and down again, and up the next one too. Watch out he's clearly trying to break in." <person three doors down> "sorry, mate, that's my brother. He was looking for my house and got lost"> or have missed out part of the recording to show what they want to see (such as the one I saw a couple of days ago which didn't show the person leaving the parcel on the doorstep - neighbours pointed that out)

I think I seen the post you’re referring to.

The young girl is question needs to face the consequences of her actions

@blacksax I have got into trouble as a staff member because apparently I shouldn't have got involved and seen the video.

Can I just clarify- the video has not been shared on Facebook or any social media. The shopkeeper showed me as a member of staff. The Safeguarding lead is not happy and I hope I don't face disciplinary charges....

It might have been wiser to refer the incident to your DSL rather than agree to watch the footage yourself, or tell the shopkeeper report to police and offer it.

@560934Pjust tell them you had your eyes closed 😂 I’m not sure how you can be in trouble for viewing it.. you didn’t know what you were viewing until you had viewed it. I assume you told the safeguarding lead what you’d been shown.

@flutterbye99 yes I emailed the DSL straight away.

LIZS- I wish I did that...

Did you reveal the girls details such as name etc? If so, then that was probably a breach. If you had just watched it, then you’re probably okay.

It would be if he say called you over to the cctv and showed you when in his shop just because you work in the school.
sounds to me like correct processes weren’t followed.
He should have taken it to the Police who then should have taken it to the school.
Did you identify the pupil from the cctv, did you give shop keeper any names. Turn if so this would be a GDPR breach. Then if so you could face some form of investigation.

What utter tosh!

No one reads the Data Protection Act properly - it only applies to 'sensitive' data - that's things like medical, bank and personal information.

Viewing a video doesn't even come under GDPR - what is your manager on about?

Is their nose out of joint because you knew something they didn't?

@Newyorklady did you give shop keeper any names

Giving a name is NOT a breach of GDPR! Where did you get that from?

No names were revealed by me. I don't even know the students...I recognise their faces.

I assume that you shouldn't have confirmed it was a pupil from your school and if you did that's the error. Also depending on your role at school it probably wasn't appropriate for you to check the footage as it should be safeguarding or SLT. I think it's more safeguarding than gdpr. But sometimes we make mistakes and can't always think quick enough on our feet.

I just want to enjoy my Easter break now...thank you everyone for your kind reassurance.

If the kids were in school uniform, then the shopkeeper would know which school.,

Yes pupils wearing the distinctive uniform. The corner shop is often frequented by our pupils and there is a rule: Only 2 students in the shop at a time.

I’m a Governor at a high school .. we have a number of Supermarket ms nearby. Our staff are called in sometimes to identify misbehaving or shoplifting kids, so we can deal with them.

@madroid you’re wrong.

GDPR doesn’t only apply to sensitive data. It applies to all personal information. A greater protection needs to be applied to sensitive data but all data needs personal data needs to be treated in accordance with GDPR.

OP in terms of you viewing that video you haven’t broken any privacy laws