Temporary by Design, Permanent by Default: Auditing Britain's Pop-Up CCTV Towers

A camera mast can go up in an afternoon. A privacy notice, apparently, takes considerably longer.

Anyone who has driven past a UK building site, retail park or park-and-ride in recent years will recognise the silhouette: a galvanised steel column, a cluster of white domes and bullet cameras near the top, a padlocked cabinet at the base and a solar panel angled at the sky. The units are hired by the week, delivered on a trailer and connected to a remote monitoring centre over a mobile network. They are, in most respects, a sensible answer to plant theft, fly-tipping, arson and antisocial behaviour on sites that cannot justify a permanent installation. They are also surveillance systems processing personal data, and the speed of their deployment is exactly what makes the paperwork fall behind.

Why the masts multiply

The commercial logic is straightforward. A towable tower costs a fraction of a manned guarding contract, works through the night without a break, and can be relocated when the risk moves. Insurers increasingly expect some form of monitored protection on sites holding high-value plant, copper or fuel. Festival organisers use them to cover car parks and perimeter fields that have no fixed infrastructure. Retail parks use them to watch overflows and service yards that fixed cameras cannot see.

Because the technology is rented rather than installed, the decision to deploy it can be taken by a site manager in a morning. That is where the governance gap opens. A permanent system usually passes through a procurement process, a documented assessment and a review before anyone signs off a five-figure capital spend. A rented mast sometimes passes through none of these.

Who is actually in control of the footage

The first question in any audit is not what the camera does, but who is accountable for what it captures. In most deployments the site operator or landowner is the data controller. The rental company that owns the hardware is often a processor, and the monitoring centre that receives the alerts may be a sub-processor or, where it makes its own decisions about who is watched and for how long, a controller in its own right.

In practice, the identifying details are frequently absent. Signs may name a security contractor but not the entity on whose behalf it acts, or display a generic '24-hour CCTV in operation' panel that tells a passer-by nothing about their rights. A QR code linking to a current privacy notice is acceptable; a QR code that links to a broken page, or to a sales brochure, is not.

Where to look: the base cabinet often carries a service sticker with a phone number, and the site hoarding will usually name the principal contractor. Those two details are enough to start a written enquiry.

What a compliant notice should contain

Under UK GDPR, transparency information must be provided before or at the point personal data is collected, which in this context means before a person walks into the covered area. For a temporary tower, a defensible notice sets out:

• the identity and contact details of the controller, and of any data protection officer;
• the purposes of the processing, described specifically rather than generically;
• the lawful basis, most often legitimate interests, with a short explanation of what those interests are;
• the categories of recipient, including the monitoring centre and any law enforcement disclosure arrangements;
• the retention period, expressed in days rather than 'as long as necessary';
• the individual's rights, including access and objection, and the right to complain to the Information Commissioner's Office;
• whether the system records audio, reads number plates or uses thermal imaging;
• whether footage is stored overseas and, if so, on what transfer basis.

A sign that says only that CCTV is operating fails most of these tests. Legible placement matters too: a panel bolted to a mast eight metres above a car park entrance, angled away from the pedestrian route, is not a notice in any meaningful sense.

Retention: the default nobody chose

Thirty days is the common industry default, and for good reason: it covers the period in which most incidents are reported without creating an indefinite archive. Some operators set ninety. Number plate recognition systems often retain for longer, and festival deployments sometimes keep footage for weeks after the event while incident reports are compiled.

Whatever the period, it should be documented in a retention schedule and enforced by automatic deletion. An audit question worth asking is not simply how long footage is kept, but who can extend that period, on what authority, and whether an extension is logged. Deletion should be a process rather than a promise.

The same applies to access. Ask who can view live and recorded images, whether viewing is logged, and whether the monitoring centre staff are subject to confidentiality obligations and appropriate training. Where a tower triggers a manned response, the officer attending may hold a Security Industry Authority licence; the licensing regime covers the guard, not the camera, but it is a useful indicator of professional accountability.

Audio, plates and other extras

Not every mast is a plain camera. Some carry loudspeakers for pre-recorded warnings, some include microphones, and a growing number offer number plate recognition for vehicle access control in car parks and logistics yards.

Audio capture in public or semi-public spaces is difficult to justify and attracts particular scrutiny; it is almost never necessary for site security. Number plate recognition creates a transactional record of vehicle movements that goes well beyond the original purpose of deterring theft, and should be supported by a specific assessment and a clearly limited retention period. Both features should be declared, not discovered.

Five questions to put in writing

For residents living beside a site, workers on it, or businesses sharing a car park, a short written enquiry to the site operator or landowner is usually enough to test whether the deployment is properly governed:

1. Who is the data controller for the system, and what are their contact details?
2. What is the documented retention period, and how is deletion verified?
3. Please provide the current privacy notice and a summary of the data protection impact assessment, including the review date and the legitimate interests assessment.
4. Does the system record audio, capture number plates or use any analytics beyond motion detection?
5. Who monitors the footage, from where, and under what contract?

A well-run deployment answers these within days. A poorly run one stalls, which is itself informative.

If the answers do not come

Individuals retain the right to make a subject access request, which must be answered within one month and normally free of charge, and to complain to the Information Commissioner's Office. Neither route requires a solicitor.

Separately, the physical presence of a tall mast is a planning question as well as a data protection one. Temporary structures on construction sites are not automatically exempt, and height, siting and proximity to conservation areas are matters a local planning authority can consider. Residents can raise concerns with planning enforcement without alleging any data breach.

Workers have an additional channel: health and safety representatives and any recognised union can press for consultation on monitoring that affects them, and event attendees can ask organisers how perimeter surveillance is covered in the event's own privacy information.

The habit worth forming

Temporary towers are not inherently objectionable, and a site that has suffered repeated theft has a legitimate interest in watching its perimeter overnight. Proportionality, however, requires evidence, a defined purpose and a review date. The audit question that matters most is the simplest one: when will this deployment be reassessed, and by whom?

If nobody can answer that, the word 'temporary' is doing very little work.