The Information Commissioner’s Office has issued a reprimand to Greater Manchester Police (GMP) following “serious shortcomings” around its storing and handling of CCTV footage.

In February 2021, a person was held in custody for 48 hours. A CCTV system was in operation during this period.

The GMP’s Professional Standards Directorate (PSD) later submitted an internal request to retain this information beyond the typical 90-day period.

When responding to a subsequent related subject access request, the police force noticed that two hours of the footage was missing.

GMP states that, despite all attempts, it is “unable to recover” the missing two hours of footage. This led GMP to self-reporting a personal data breach to the ICO in September 2023.

The ICO said its investigation assessed GMP’s compliance with data protection laws related to the storage of CCTV footage.

It ruled the GMP failed to provide the complainant with their personal data, both without undue delay and by the end of the applicable period of one month.

It also failed to ensure that the appropriate technical or organisational measures were in place to protect the loss of the CCTV data it was processing.

The ICO’s investigation on this front found two key failings in GMP’s data protection practices.

Firstly, a misunderstanding between GMP staff, with regard to the responsibility to conduct a quality check of the retained footage.

Secondly, a lack of policies and guidelines within GMP to identify that quality checks were required or who is responsible for this task.

The ICO said that, since the incident, GMP has taken remedial action.

An investigation into the wider case by the Independent Office of Policy Conduct is ongoing.

Recommended reading

• Labour Party Reprimanded by ICO Over Information Request Backlog
• Ada Lovelace Institute Condemns UK’s Facial Recognition Governance
• School’s Facial Recognition Tech Blunder Leads to ICO Reprimand

“CCTV footage, particularly of a person at their most vulnerable, can contain highly sensitive personal data and must be properly protected,” said Sally Anne Poole, head of investigations at the ICO.

“It is vital that authorities like police forces have the strictest measures in place to protect personal data to maintain public trust.

“It is clear in this case that Greater Manchester Police failed its obligation to keep the complainant’s personal data safe and demonstrated serious shortcomings in how it handles CCTV footage.

“Data protection is not an afterthought; it is a core responsibility. In this case, we see the potential consequences when this responsibility is not properly adhered to.

“Police forces and public bodies across the country can learn from failures like this and ensure they have the right systems and oversight in place to prevent these mistakes from happening again.

“Public trust depends on it.”