Data Protection film-making

Faceless is an unusual film for many reasons. The plot, apparently, talks of a world where everybody's faceless due to calendar reform (huh?), but one day a woman wakes up and finds she has a face (Terry Gilliam meets Kafka).

What makes the film truly unique is that it is the world's first CCTV feature thanks to the magic of the Data Protection Act 1998 and of London's unequalled surveillance network. The film-maker, Manu Luksch, has created a story by simply walking in front of CCTV cameras, and then making a data subject request to obtain the data held about her. She then edited out the faces in the crowd (save her own) and edited the footage with a voice over. According to the director/script-writer/actress:

"For FACELESS, the filmmaker swaps data controllers for a film team, already installed surveillance devices for cameras and cranes, and a lawyer for a script writer. The process of accessing these images activates multiple legal layers of regulations concerning these recordings: Data Protection Act 1998, Article 8 Human Rights Act 1998, Freedom of Information Act 2000, as well as aspects of copyright and image rights. It is this information that mirrors the way society relates to its techno/mediated environment and tries to arrange and control itself. The arrangements expressed in these legal codes is used to craft a story."

I think the Data Protection aspect is pretty straightforward. Data subjects have the right to access data held on them, and this includes CCTV footage. However, I find the copyright aspects intriguing. Who owns CCTV footage? I'm guessing that the owner is the institution making the recording, and I am guessing that the editing together of all the images is enough to warrant originality. What about image and personality rights?

(Via BBC's Digital Planet podcast)