CCTV camera in external areas of block of flats (carpark/bin area etc) - GDPR rules and regulations

leafy211

Ive searched high and low for explicit guidelines on the GDPR rules for CCTV cameras in external areas of a block of flats which is owned by the RMC of which the leaseholders are shareholders (so private property?).  No cameras would point to the public areas outside the gated development, but would cover carpark/bin area/accessible doors and windows etc.  I guess a couple of signs advising of CCTV cameras would need to be dotted around the complex.
Im wondering if visitors, for example, would have a right to request CCTV footage of themselves... that sort of thing. 
Any guidance or pointers to webpages with precise information would be hugely appreciated.

CoastingHatbox

https://ico.org.uk/for-organisations/guide-to-data-protection-1998/encryption/scenarios/cctv/

leafy211

Thanks so much for your response CoastingHatbox.  In fact the CCTV would be managed by one or more of the leaseholders .. so not really a business/corporate situation.  Id envisage one flat having the equipment and maybe one or all leaseholders being able to access the footage on their computer/phone - depending on the rules for that scenary.

Sandtree

It doesn't matter, even personal CCTV is subject to GDPR, so if your neighbour has a smart doorbell you can submit a SAR request to them for all footage that has captured you.

https://ico.org.uk/your-data-matters/domestic-cctv-systems-guidance-for-people-using-cctv/ 

CoastingHatbox

You would probably need the permission of the RMC/leasholders; presumably they have a means to authorise it, just like they do maintenance contracts and repairs. Then the operator would need to comply with GDPR in respect of communal areas that are monitored. So that means CCTV stickers with contact information for data protection; agreed retention period; taking reasonable technical and procedural measures to protect access to the system and its recordings and finally complying with subject access requests.

If leasholders are able to access the footage directly, then you need reasonable measures in place to ensure they are authenticated when they connect.

leafy211

Thanks both - that's all extremely helpful.  The RMC and other leaseholders are indeed fully onboard as far as Im aware..  other than the potential overhead of visitors/delivery vans asking to see clips of footage etc. 
I was hoping it would be classed as a private domestic property for which ICO states
   'If you set up your system so it captures only images within the boundary of your private domestic property (including your garden), then the data protection laws will not apply to you'
And i believe that might have been the case if the perimeter of the block was completely gated/enclosed.  Sadly it isnt, so even though there is a sign stating 'private property' on the side of the premises with open access to the street, it is possible for someone to freely walk onto the carpark etc if they really wanted to. 
darn it! :-:smile:
Thank you both again for your input, its been very helpful.

CoastingHatbox

Apologies as this is an aside to your original question:

Assuming you are using IP cameras, are you aware of some CCTV cameras and associated equipment using uPNP/PNP-NAT to setup port-forwarding on routers leaving them open to the Internet and how to mitigate it?

If you are not using IP cameras, probably not a concern.

leafy211

its a great point - thank you.  We havent purchased any camera system yet due to the concerns about who would take on the  responsibility for any footage requests etc (not keen on the idea/expense of outsourcing it). But I will add your point above to my list of questions for the supplier - if we ever get that far! :-)