Here, for the hell of it:
The Data Protection Act considers to be protected any personal info, which is defined as:
data which relate to a living individual who can be identified from those data; or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual
Which clearly applies in this case. Furthermore,
Information will amount to personal data if it is capable of being processed so as to distinguish you from any other individual. For example, if a data controller can capture an image of you from a CCTV camera and then match that image to a photograph or a physical description of you, the CCTV footage will be personal data. On the other hand, CCTV footage of a public area where you are just a ‘face in the crowd’ and the data controller has no means of identifying who you are is unlikely to be considered your personal data.
I think that obviously applies.
ETA:
And
in some circumstances the use of CCTV footage that allows you to be identified and which reveals something private about you may engage your Article 8 rights. So in a notable case the European Court of Human Rights held that publishing CCTV footage that showed the applicant attempting to commit suicide breached his private life, even though the footage was taken from a CCTV camera in a public street.
*The court decided that for information to relate to an individual, it had to affect their privacy. To help judge this, the court decided that two matters were important: (1) a person had to be the focus of the information and (2) the information must tell you something significant about them. Whether or not the DPA covers a CCTV system thus depends on how it is used. If a particular person is intended to be the focus of CCTV and the information from the CCTV tells one something significant about that person, the data from the CCTV are likely to be covered by the DPA and the operator’s use of CCTV must comply with the provisions of the DPA. *
And, finally:
If, however, the CCTV is used remotely to zoom in on people, or for monitoring particular individuals, or the film recorded is used for anything other than for providing to law enforcement bodies, then the CCTV is likely to be covered by the DPA.
In other words: PRIVACY VIOLATED. Any questions, mhendo?