Statement on ICO investigation into Department of Health and Social Care CCTV footage

The ICO can confirm it is investigating an alleged data breach.

EMCOR Group (UK) plc, which provides facilities management and CCTV services for the Department of Health and Social Care (DHSC), has submitted a breach report as a processor of personal data, alleging images were taken from the DHSC CCTV system without consent from either EMCOR Group (UK) plc or the DHSC.

CCTV images were later published by The Sun newspaper on 25 June 2021.

As part of the investigation, ICO teams searched two residential properties in the south of England on Thursday 15 July 2021.

Personal computer equipment and electronic devices were seized as part of the operation and the ICO’s enquiries into alleged breaches of section 170 of the Data Protection Act 2018 continue.  

Steve Eckersley, Director of Investigations at the ICO said:

“It’s vital that all people, including employees and visitors to public buildings, have trust and confidence in the protection of their personal data captured by CCTV.

“In these circumstances, the ICO aims to react swiftly and effectively to investigate where there is a risk that other people may have unlawfully obtained personal data. We have an ongoing investigation into criminal matters and will not be commenting further until it is concluded.”