Are dash cams legal under the GDPR in the UK? Is licence plate blurring obligatory?

There are no specific dash cam laws in the UK, but the UK General Data Protection Regulation (GDPR) covers issues like the protection of employees’ personal data and the privacy of the public.

Dashcams can record a lot of personal data, so anyone using a dash cam should consider the law—particularly if you’re using a dash cam or in-vehicle camera for business purposes.

In this article, we’ll look at how the law applies to dash cams in the UK, including how to tell people you’re using a dash cam, whether you should blur licence plates in the videos, and how to meet the law’s other principles and requirements.

Is it legal to have a dash cam in the UK?

Yes, it’s legal to have a dash cam in the UK—or rather, there are legal ways to use dash cams. You have a few things to think about first, particularly if you u’re using the dash cam as part of your business operations.

Driving instructors, taxi drivers, and delivery companies all have legitimate reasons for using dash cams and in-vehicle cameras. However, you must only use a dash cam in a legally compliant way.

The UK GDPR sets rules and principles that apply when processing personal data. Dashcams process a lot of personal data, for example:

• People’s faces
• Licence plate numbers
• People’s activities in public places

In the UK, people still have data protection and privacy rights when they’re out in public, and you must take reasonable steps to protect these rights when using dash cams.

Do you have to tell someone you have a dash cam?

Yes, you must tell people that you’re using a dash cam. How you do this—and how much information you provide—depends on the context.

Article 13 of the GDPR includes a list of the information you must provide when collecting people’s personal data, including:

• The name of the data controller (e.g., your business)
• What types of personal data you collect
• Why you collect personal data
• What rights people have over their personal data

There are a lot more items on the list—you must be transparent about how your organisation uses personal data.

If you’re filming customers, you must ensure they have a copy of your privacy notice before you start filming. If your dash cams record employees, they must receive all the information required by the GDPR up front. You can include a privacy notice as part of your staff handbook and training materials.

Do you need a warning sticker for a dash cam?

If your dash cam is pointed at pedestrians and traffic, providing the information required under the GDPR can be a challenge. Obviously, it would not be reasonable to display an entire privacy notice on the outside of your vehicle.

The UK’s data protection regulator, the Information Commissioner’s Office (ICO) recommends putting a sticker on your vehicle that includes basic information such as: 

• The name of your organisation
• Your purpose for using a dash cam
• Where to read your full privacy notice (using a QR code to link to your privacy notice might be helpful)

This sticker is just a way to warn people that you’re recording them. You must create a longer privacy notice providing all the information required under the GDPR. Put this on your website and make it available wherever else you interact with staff or customers.

Do you have to blur licence plates when using a dash cam?

You may need to blur licence plates in footage recorded via your dash cam, depending on why you’re recording the footage and what you do with it.

• Under the GDPR, licence plates can be “personal data”—information about an identifiable individual.
• While it’s not always possible to identify an individual via their licence plate number, it can happen—and there have been GDPR cases involving the publication of unredacted licence plates.
• The UK GDPR applies when “processing” personal data, which can include storing it, sharing it, editing it, or doing practically anything else with it.

The GDPR’s principle of “data minimisation” states that you must only process the minimum data necessary for a given purpose. Therefore, if you need to store or share dash cam videos but don’t need them to show people’s licence plate numbers, you should blur the licence plate numbers.

It might be particularly important to blur licence plate numbers if:

• You’re using a dash cam for your business purposes
• You’re planning to share or publish some of the footage
• You’re planning to store the dash cam videos for a longer period

Because there’s an easy way to blur licence plates in videos using anonymisation software, it’s reasonable to do so when storing or sharing dash cam videos.

Do you have to blur faces when using a dash cam?

Yes, you may need to blur faces in videos recorded using your dash cam. Again, this partly depends on the context.

Videos and images showing people’s faces can be personal data under the GDPR. The same rules and principles apply to videos of people’s faces and videos of license plate numbers.

If you’re using a dash cam as part of your business operations, you should consider blurring faces before storing, using, or sharing the dash cam videos. Unless the purpose of the video is to identify an individual, then you likely don’t need it to include people’s faces.

This principle is particularly relevant if you’re sharing dash cam footage on YouTube, Facebook, or another social media platform. If you need help identifying an individual in the footage, you should blur the licence plates and faces of anyone else in the video.

How to comply with the GDPR when using a dash cam

As noted, data protection law does not stop businesses and individuals from using dash cams. But they do require you to put safeguards in place to protect people’s privacy.

We’ve looked at transparency (telling people about your dash cam) and data minimisation (blurring faces and licence plates where appropriate). Here are some other important GDPR considerations when using a dash cam.

Legal basis

All processing of personal data under the GDPR requires a legal basis (or “lawful basis). Before you use a dash cam, you must determine whether you have a legal basis for doing so. You’ll need to tell people your legal basis in your privacy notice.

The GDPR provides six legal bases, and it’s up to the data controller (i.e., your organisation) to decide which, if any, is appropriate in a given situation.

If you need to use a dash cam for business purposes, “legitimate interests” might be the most relevant legal basis. The ICO provides some guidance on legitimate interests that might help you decide.

Security

The GDPR requires you to keep personal data secure—whether you’re collecting it, storing it, sharing it, or using it in any other way.

• Only store dash cam footage in a secure environment, using encryption where possible.
• Use strict access controls so only the appropriate people can access the videos.
• If you’re sharing or using video footage, make sure you use a secure platform to do so.

The strength of your security controls depends partly on the resources available to your organisation, the sensitivity of the video footage, and any industry standards that apply to your company.

If you’ve anonymised your dash cam footage by blurring faces, licence plates, and other personal data, the GDPR’s security obligations no longer apply (although you might have other reasons to store it securely).

Storage limitation

Under the GDPR, you must not keep personal data in identifiable form for longer than necessary. If you need to store videos recorded by your dash cam, you must decide how long you need to keep the footage.

There’s no definitive rule on how long to keep personal data. The ICO says, “If you’re holding several weeks’ worth of recorded footage just in case you need it, that’s probably too long.”

If you’re storing footage for insurance purposes, the regulator suggests deleting it after “a week or so.” In the event of an accident or if you need to use the footage in court, you can likely justify keeping the footage for longer.

And remember that the GDPR doesn’t apply to anonymous data. If you irreversibly blur faces, licence plate numbers, and other identifiers in your videos, this is the same as deleting them under the GDPR. You can keep them as long as you want (unless required to delete them under another law).

Data subject rights

People have rights under the GDPR. As the controller of someone’s personal data, it’s your job to facilitate their requests under these rights.

If you have dash cam footage that reveals personal data about someone, they can:

• Request a copy of the footage
• Request that you erase the footage
• Request that you correct the footage if it’s inaccurate (this is unlikely to come up in this context)

Unless one of the GDPR’s limited exceptions applies, you must respond within a month. You can take an additional two months if necessary, as long as you notify the person within the first month. If someone requests footage you were due to delete, you should not delete it until you’ve processed their request.

Complying with GDPR requests concerning video footage has long been challenging, but it’s become easier now that businesses can access software for blurring faces and licence plates in videos.

Before sharing a dash cam video with someone who has requested access to it, you can blur other people’s faces and licence plates before you share it with the requester. This step ensures you do not violate other people’s rights when fulfilling the request.

Are driver-facing cameras legal in the UK?

Using driver-facing cameras, for example, to monitor fleet drivers as they work, can be quite intrusive and would only be legal under certain conditions.

If you’re considering installing driver-facing cameras, consider conducting a Data Protection Impact Assessment (DPIA) to ensure you can meet the GDPR’s requirements.

When conducting a DPIA, you’ll consider whether driver-facing cameras are necessary to meet your intended purposes, how you can ensure you’re upholding your employees’ rights, and whether you can implement mitigations such as blurring employees’ faces.

Is dash cam footage admissible in court in the UK?

Yes, dash cam footage can be admissible in court in the UK. The best way to ensure your dash cam footage is admissible in court is to ensure you record it lawfully—including by complying with the GDPR in the ways we’ve discussed above.

Ensuring GDPR compliance when using dash cams

Dashcams can have safety benefits, can reduce insurance costs, and could help your company defend itself in court. But your dash cams could cause bigger legal problems if you fail to comply with the GDPR.

• Create a privacy policy to explain how and why you use dash cams and what happens to the footage.
• Put a sticker on any vehicle with a dash cam so people know you’re recording.
• Keep recordings secure if they show personal data such as license plates or people’s faces.
• Don’t store recordings for longer than necessary unless they have been anonymised.
• Give people access to footage that identifies them on request, but avoid sharing videos that reveal other people’s faces or license plates.

Remember to blur licence plates and people’s faces where possible. If you remove all identifiers from the footage, it’s no longer subject to the GDPR—you can keep it for longer, you can use it for other purposes, and you won’t be at risk of a data breach.