You can ring my be-ee-ll, ring my bell

There’s been debate in the legal community and in the social work community for a long time about the desire of some parents to make recordings of their interactions with social workers.

There’s a feeling among some professionals that it feels like it should be illegal, but when you drill down into it, it’s hard to find an actual law that prohibits it. (The Human Rights Act, which would protect interference with private and family life works for individuals who are owed duties by the State, and not vice versa)

There’s very good guidance from the Transparency Project here

https://www.transparencyproject.org.uk/guidance-on-parents-recording-meetings-with-social-workers-2/

The grey area has been whether there might be arguments about whether the making and keeping of audio or video recordings might constitute data processing for the purposes of data protection legislation – and if it does, then all sorts of duties arise, including very strict restrictions on the purpose and transparency on the person processing that data. But data protection legislation makes an exemption where the information is being handled for ‘household use’ (understandably , if you are keeping a diary, your friends / neighbours don’t have the right to see any entries you’ve made about them in the same way they would if say an Electricity Company was keeping records about them)

s21 (3) Data Protection Act 2018 This Chapter does not apply to the processing of personal data by an individual in the course of a purely personal or household activity.

So, what’s household use and what’s not?

This case throws up some interesting new questions – and it t like the national press are quite interested in it, so I’ll share my early thoughts.

The national press for example, the Daily Mail doing their usual Betteridge’s Law headline

https://www.dailymail.co.uk/news/article-10087671/EVERY-Ring-doorbell-customer-face-100-000-fine-landmark-ruling.html

NO.

Spoiler – this case does not provide a definitive answer to our issue.

Two important things to note

1. This is a decision by a Circuit Judge so it is not an authority that would bind any other Courts – they might be referred to it as a matter of interest in how another Judge decided the issue but they are not obliged to follow it.
2. The behaviour complained of here is pretty exceptional, and it may be hard to draw parallels with cases that aren’t so extreme.

That being said, let’s dive into it.

Fairhurst -v- Woodard

In this case, Dr Fairhurst sued a neighbour, Mr Woodward, for harassment nuisance and breach of data protection legislation about security cameras that Mr Woodward had installed. One of which was one of those high-tech doorbell security cameras , the particular model being “Ring” (which is the angle that the National Press are super interested in, and hence the title of this post)

In tests done for the purposes of the litigation, the Ring doorbell camera would routinely trigger when a person passed within 17 feet of the front door, and begin recording. It would record video footage and also make audio recordings of anyone having conversations within that distance, which is longer than the boundaries of the property and covers the street outside. (I think from later entries, the audio recording operates at a higher distance – i.e you wouldn’t get video footage of someone standing 17 feet away but you would get audio recording)

131.The Claimant’s pleaded case is that: images and audio files of the Claimant
are personal data within the meaning of Article 4(1) of the General Data
Protection Regulation 2016/679 (“the Regulations”); that the Cameras
collected such personal data, that the transmission to the Defendant’s phone
or computer or other device, the retention of any such images or sound on
such a device and their onward transmission to others (whether neighbours,
the police, or the cloud for storage) are processing of personal data within
the meaning of Article 4(2) of the Regulations; that the Defendant as the
person determining the purpose and means of that personal data is, and was
at all material times a data controller within the meaning of Article 4(3) of
the Regulations, and accordingly must comply with the principles set out in
Article 5(1) of the Regulations.

132. I don’t think any of that analysis is disputed, and I so find. The question is
     whether the Defendant has processed such personal data lawfully and in
     accordance with the principles

133. I note that the Information Commissioner has provided Guidance on the
     meaning of ‘transparently’ in which she says that “Transparent processing
     is about being clear, open and honest with people from the start about who
     you are, and how and why you use their personal data”. Given the extensive
     findings that I have made relating to the manner in which the Defendant
     sought to actively mislead the Claimant about how and whether the
     Cameras operated and what they captured I am satisfied that the Defendant
     has breached: the first principle as he cannot be said to have processed data
     fairly or in a transparent manner

That would seem, subject to the caveats I started with, to be quite significant in terms of covert recording. The action of making and keeping the recordings was considered by the Court to be data processing, and doing so covertly would be in breach of the duty under the General Data Protection Regulations that the processing must be transparent.

What about the ‘household use’ element?

Annoyingly for my purposes, the judgment doesn’t really get stuck into s21 (3) and if it applies – although given that the Court found that there were breaches under the DPA 2018, it must be implicit that the Court did not consider that it did (although i always prefer it to be explicit)

Here’s as close as we get, which is more an argument about whether the processing was legitimate rather than s21(3). (Growls to himself – I really would have liked the s21(3) issue to be properly ventilated and ruled on, even though this isn’t a binding authority. I’ve looked carefully and done a couple of searches and I can’t find s21 (3) mentioned – it isn’t in the summary of the relevant DPA law or as a defence. Could it really have been overlooked by everyone???)

134…..I consider that the balance
between the legitimate interests of the Defendant and the right of the
Claimant to privacy and a home life are met in relation to the processing of
video personal data from the Ring Doorbell, and I am so satisfied. That is
because any video personal data of the Claimant is likely to be collected
only incidentally as she walks past, unless the Claimant stands on the
Defendant’s door and rings his doorbell, and I consider that his legitimate
interest in protecting his home whether he is there or not are not overridden
by her right to avoid such incidental collection on a public street, albeit in
the vicinity of her home. However I consider the processing of audio
personal data from the Ring Doorbell to be problematic and I will return to
that

So the video data from the doorbell was okay, because unless the Claimant was actively on his property ringing his doorbell or walking past his home, you wouldn’t get video footage, and the Defendant’s interest in protecting his home outweighs that of the Claimant’s wish not to be filmed.

The driveway camera footage to protect his car from damage or theft was not.

I135. I consider that such interests are overridden by the Claimant’s right to
privacy in her own home, to leave from and return to her house and
entertain visitors without her video personal data being captured. Again, the
audio personal data collected and processed by means of this Driveway
Camera is even more problematic and detrimental than video data in my
opinion. For those reasons I am satisfied that the Defendant’s processing of
the Claimant’s personal data by means of the Driveway Camera is not
lawful

On the Ring doorbell audio footage

138…I am satisfied that the processing of such audio
data by the Defendant as data controller is not lawful. The extent of the
range means that personal data may be captured from people who are not
even aware that the device is there, or that it records and processes audio
personal data, or that it can do so from such a distance away, in breach of
the first principle. The Claimant has fallen into each of these categories
during the relevant time. The living individuals whose conversation it
captures may well be identifiable from the data itself or from other
information which can be obtained from the data controller particularly in a
case such as this where the Defendant knows and is familiar with his
neighbours and can probably identify many of them by voice alone, and
certainly identify them with both the audio and video data that these
devices capture.

The Court made orders for the removal of the cameras and ring doorbell, though asked for enquiries to be made as to whether the Ring doorbell could be installed in such a way to prevent audio recording. Damages are yet to be determined.

So no definitive answer I’m afraid, but I am aware that more specialist GDPR lawyers are looking at this case and talking about it and if I learn more, I’ll let you know.

There are some other gems in this judgment

26.

I found the Defendant Mr Woodard to be a very poor witness. He admitted
that some of his evidence was incorrect. Different accounts given at
different times contradicted each other. Some of it he changed in oral
evidence as he went along, as difficulties with his evidence were revealed
by Mr Phipps’ questioning. Much of his evidence was exaggerated. Some
of it is contradicted by contemporaneous documentation or correspondence.
Some of it was simply unbelievable. In several ways, I found him to be
untruthful. I can believe almost nothing that he tells the Court unless it is
supported by other evidence which is both credible and reliable, or the
inherent probabilities. Where his evidence is in direct conflict with that of
the Claimant and Dr Franich, I prefer their evidence

and a beautiful typo

34…He eventually accepted in cross-examination that the Driveway
Camera was in wife range, which makes the story he told about draping a
wire from one house to the other for the purposes only of set up, in my
judgment, entirely concocted to attempt to support his position that it was
never a functioning camera

VERY GRATEFUL TO JOHN GOSS on Twitter, who explained to me very nicely that s21(3) has been repealed and the appropriate law on household usage is now Article 2(2) GDPR (UK)

2.
This Regulation does not apply to—
(a)
the processing of personal data by an individual in the course of a purely personal or household activity;

So the substance is the same, the reference I gave was wrong.