Should Schools Allow Third Parties to Install Surveillance Cameras on Campus?

A request from an outside organization to install its own surveillance cameras on school property recently raised a larger question among members of the National Council of School Safety Directors (NCSSD): Who should control surveillance technology operating on a school campus?

The question came from an NCSSD member whose private school rents athletic facilities and office space to an outside sports organization. The program operates after school during the academic year and at the same time as school-run camps during the summer. The organization asked for permission to install its own cameras to monitor its office space and courts during instruction.

The school already has a video surveillance system but does not provide outside organizations with direct access to its footage. Any disclosure to law enforcement is handled under school policy and applicable law. Allowing an outside organization to install and independently operate its own cameras, the member said, raised concerns about who could access recordings, how footage would be retained or deleted, cybersecurity, evidence preservation, and the privacy of students, employees, parents, and visitors.

Other NCSSD members responding to the discussion raised similar concerns, with several suggesting that schools distinguish between an outside organization's need for additional camera coverage and who ultimately controls the technology and footage.

One member said their organization does not permit third-party surveillance on campus, including drones. When a vendor or contractor has a legitimate need for video, the organization instead works with the third party to provide footage or, in limited circumstances, restricted view-only access.

Another suggested that if additional cameras are warranted, schools could consider adding them to their existing surveillance systems, potentially at the outside organization's expense, rather than allowing a separately administered system.

A recent incident in Georgia illustrates the risks that can arise when surveillance equipment is installed on school property without clear authorization and oversight.

In September, Colquitt County School District said it discovered that an outside vendor hired to provide audio and visual support at Withers Auditorium had installed unauthorized cameras. The district revoked the vendor's access to school properties and contacted law enforcement.

At the time, district officials said they did not know how long the cameras had been in place, what had been recorded, or where potential footage was stored. The cameras were not located in public restrooms or dressing rooms, according to the district.

The incident differs from a school considering and approving a third-party camera request, but it highlights some of the same governance questions: who can authorize cameras on school property, who is responsible for knowing where they are located, what they record, where footage is stored, and who has access to it.

Start With Who Controls the Camera and Its Data

Guy Grace, an NCSSD founding board member, said the central issue is not necessarily who purchases the equipment.

“The question I would ask is not: ‘Who bought the camera?’” Grace said. “It is: ‘Who is responsible for everything that camera collects while it is operating on our property?’”

Before approving third-party surveillance equipment, Grace said schools should determine who approves its location and field of view; whether audio is enabled; where recordings are stored; who holds administrator credentials; who can view, download, share, or delete footage; how long recordings are retained; and whether access and deletions can be audited.

Grace said schools should also consider what happens when circumstances change. That includes how access is terminated when an employee of the outside organization leaves, what happens to recordings when the organization's agreement with the school ends, and who is responsible for preserving footage if a camera captures an incident involving a student.

Define Why the Cameras Are Being Used

Grace said schools should establish why an outside organization wants to record activity on campus and how the footage will be used.

A request to use cameras at an athletic facility, for example, could involve facility security, participant or employee supervision, coaching or instructional review, incident documentation, or remote observation. These purposes are not interchangeable, and clearly defining the intended use can help schools evaluate the request and determine what access and safeguards are appropriate.

Schools should not allow a camera approved for facility security to later become a tool for coaching review, employee supervision, participant evaluation, or another purpose that was not separately reviewed and authorized, Grace said.

Grace also emphasized the importance of considering the capabilities of the technology itself. Camera systems may include or later add features beyond basic video recording through software or firmware updates.

Audio recording, facial recognition, biometric identification, automated tracking, license plate recognition, AI-based identification, and other advanced capabilities should remain disabled unless separately reviewed and expressly authorized in writing, Grace said. A software or firmware update should not automatically expand how an approved system can be used.

Consider Who Else Could Be Recorded

Shared spaces can also affect who may be captured by third-party cameras. In the situation discussed by NCSSD members, the athletic organization operates at the same time as school-run summer programs. Its cameras could therefore capture not only its own participants and employees but also students, school employees, parents, visitors, contractors, and children who have no connection to the outside organization.

Grace said schools should determine which privacy requirements apply based on their jurisdiction and circumstances rather than assume every school-related recording is governed by the same law.

Grace also urged schools to consider audio separately. Many cameras include microphones or allow audio to be activated through an app, potentially capturing conversations involving student behavior, medical information, personnel issues, family circumstances, discipline, or other sensitive matters.

For that reason, Grace said audio should remain disabled unless its use has been separately reviewed and expressly authorized in writing.

Include IT in the Review

Third-party cameras can also introduce cybersecurity considerations, particularly if they connect to a school network or send footage to an outside cloud service.

Grace said IT staff should be involved in reviewing proposed equipment, including its network requirements, encryption, cloud architecture, account security, administrator privileges, remote access, firmware and update support, and data storage.

Using a cellular connection or separate network does not eliminate every concern, he added. While it may keep the device off the school's network, the camera may still be collecting and transmitting images of students and others on school property to an outside system.

Establish Rules for Access, Retention, and Evidence

Schools should also consider the difference between allowing someone to view video and allowing them to take possession of a recording. Before permitting third-party access, Grace recommends establishing what users are allowed to do with the system and its footage, including whether they can view recordings, download or export clips, or share footage with others.

If third-party access is necessary, Grace recommends limiting it to what the organization needs. An authorized user might, for example, receive access to specific cameras during the organization's operating hours without receiving broader access to recordings, camera settings, user management, or cameras elsewhere on campus.

Retention is another consideration, particularly when footage may be relevant to an incident. While routine recordings may be deleted or overwritten according to an established retention schedule, Grace said schools should have a process for preserving footage that may be needed following an accident, allegation, security incident, potential claim, or law enforcement investigation.

Schools should also consider who controls the system and stored recordings, particularly when a third party rather than the school administers the account.

Recording, Monitoring, and Response Are Not the Same

Schools should also be precise about what cameras are expected to accomplish.

“Recording is not the same thing as monitoring, and monitoring is not the same thing as response,” Grace said.

Grace said schools should make clear whether cameras are continuously monitored and who, if anyone, is responsible for responding to what they capture. The existence of a camera does not necessarily mean someone will see an incident as it occurs.

Several NCSSD members emphasized approaching surveillance as one component of a larger security strategy rather than treating cameras as a substitute for supervision, access control, emergency procedures, reporting, or human response.

Put Third-Party Surveillance Requirements in Writing

Schools may receive requests to install or access surveillance technology from outside organizations that operate on school property. Grace recommends establishing a process for reviewing those requests and documenting any approved use in writing.

He recommends addressing surveillance requirements in facility-use agreements or other written agreements, including the approved purpose and location of cameras, administrative control, network connectivity, data hosting, retention, authorized users, downloading and sharing restrictions, audio and analytics capabilities, incident reporting, breach notification, law enforcement requests, equipment removal, and what happens to stored data when the relationship ends.

For schools considering a request, the answer does not necessarily have to be simply yes or no.

An outside organization may have identified a legitimate safety, supervision, or operational concern even if an independently operated camera system is not the appropriate solution.

“A legitimate need does not automatically make the proposed technology solution the right solution,” Grace said.

Instead, Grace recommends identifying the problem the organization is trying to solve and considering whether additional coverage or another solution can be provided through a school-approved and school-governed system.

Download the Third-Party Surveillance Review Guide & Checklist

Considering a request from an outside organization to install or operate cameras on school property? Use this checklist to review privacy, access, audio recording, facial recognition, data storage, cybersecurity, and other considerations before approving a third-party video surveillance arrangement. Free to NCSSD members and SSL subscribers.

Access the Checklist →