Commissioner set to close third party certification scheme for surveillance

There has been much debate around the Data Protection and Digital Information Bill, of course, which will effectively abolish the Office of the Biometrics and Surveillance Camera Commissioner. There has also been no suggestion about what – if anything – might replace the Surveillance Camera Code of Practice.

As the Data Protection and Digital Information Bill continues its passage through Parliament, there’s no indication as to whether non-statutory schemes, such as the third party certification scheme (for which the Security Systems and Alarms Inspection Board, IQ Verify Ltd and the National Security Inspectorate are accreditors) will survive, at least in their current forms.

The Biometrics and Surveillance Camera Commissioner has, in fact, commissioned his own independent review of what gaps there may be when the Office of the Biometrics and Surveillance Camera Commissioner is abolished. That report is scheduled to appear at the end of July.

In the letter, Professor Sampson notes: “With the Bill likely to receive Royal Assent early next year, I have decided to take matters into my own hands to ensure a sensible withdrawal or potential handover of non-statutory activity within my own responsibilities for surveillance cameras. At this stage, the Home Office cannot commit to taking over the third-party certification scheme, and it’s unclear as to whether any other statutory body would have the inclination to do so.”

Sampson continues: “Understandably, none is prepared to commit in advance of the Bill being enacted, but waiting until next year to decide on an exit strategy would only lead to confusion and I’m firmly committed to ensuring an orderly withdrawal.”

Delivering certainty

Addressing the certification bodies, Sampson notes: “My aim is to ensure that you, users of the scheme (ie your clients) and other interested parties have certainty in advance of the Bill coming into effect. Consequently, I have decided that the scheme should close at the end of July this year. This will give you an opportunity to discuss the ramifications, notify your clients and make preparations well in advance of the Office of the Biometrics and Surveillance Camera Commissioner closing and the effective removal of the Code of Practice.”

In terms of what this decision would look like in practice, there would be no new certification after 31 July 2023. Those clients due reaccreditation between 1 August and the commencement of the Bill should be offered an extension until that commencement date. “There is some precedent for this,” writes Sampson, “in the shape of extensions that took place during the COVID pandemic. While there would be nothing to prevent accreditors from carrying out a desk audit, we appreciate that this may be prohibitively expensive.”

What happens to those clients that are certified beyond the commencement of the Act? “In practice,” states Sampson, “there would be no Code of Practice against which businesses could be effectively tested. However, there would be nothing to prevent such businesses from measuring themselves and demonstrating good practice against the principles even though the Code of Practice would have expired. Similarly, as things stand, there would be no body or mechanism to remove certification after commencement of the Act, nor any sanction for advertising accreditation against the now expired Code of Practice.”

Important contribution

What would happen to those payments that have been made for periods beyond the commencement of the Act? “While the transactions are between accreditor and client,” states Sampson, “it would be most helpful to understand how accreditors are receipting their work. If payments are made monthly or annually then the certification could end at commencement of the Act, with payments no longer being made. Where pre-payments have been made beyond the early part of next year then accreditors and clients would have to consider an accommodation whereby certification could either end or be continued against the principles of the expired Code of Practice. None of this precludes another agency from stepping in to manage the scheme.”

Sampson closes the letter by thanking the certification bodies for their “important contribution” in the success of the third party certification scheme, which has been embraced by a range of clients using public space surveillance technology. “There will be more time to reflect on the scheme and your invaluable contribution at the end of my tenure as Commissioner.”