Policies

CCTV Data Protection Policy

Introduction

 

CCTV will only be installed at premises owned or administered by Croft Parish Council (the "council”) with council approval. Each installation will need to be justified, normally because of logged incidents where CCTV can be judged to be appropriate to deter or prevent future incidents.

The policy of the council is to comply fully with the requirements of relevant legislation and guidance in the consideration and possible use of CCTV.

 

Legislative Requirements

 

All recorded material is owned by Croft Parish Council and each system and will be used in accordance with all prevailing statutory requirements including but not being limited to the Data Protection Act 2018, the General Data Protection Regulation, The Law Enforcement Directive (EU Data Protection Directive 2016/680), The Regulation of Investigatory Powers Act 2000 and the Protection of Freedoms Act 2012. The Council also takes proper regard to the Surveillance Camera Code of Practice 2013 issued by the Surveillance Camera Commissioner and will work to develop the good practice advice set out in ‘In the picture: A data protection code of practice for surveillance cameras and personal information’ published by the Information Commissioner’s Office in May 2015

 

Purpose of CCTV installations

 

Within premises owned or administered by the council, the purposes of CCTV installations are primarily to deter criminal action and are therefore intended to facilitate;

  • public safety whilst on, or using, council facilities or premises
  • monitoring the security of council premises

 

Purpose of the policy

 

The purpose of this policy is to provide the council with guidance to comply with relevant legislation relating to the possible use of CCTV in certain areas owned or administered by the council.

 

Roles & Responsibilities

 

Certain roles have been established to ensure that the council is able to meet its’ obligations to comply with relevant legislation. The roles are;

  • Data Protection Co-ordinator. This role is held by the Clerk
  • A Parish Councillor who will stand in for the Co-Ordinator or manager when unavailable.

 

This policy provides details on the associated responsibilities relating to the roles identified above.

 

Definitions, assessment methodology and justification for use

 

The definition of CCTV used in this policy is "equipment used to capture and store images, potentially including those of persons”.

The assessment methodology used by the Parish Council in determining the suitability of CCTV is to firstly consider all possible alternatives, such as security patrols and enhanced lighting systems, prior to selecting CCTV. An assessment pro-forma has been developed to aid the Parish Council in this respect and is included as appendix 1. ALL potential CCTV installations must be assessed using this document prior to any decision or installation.

The justification for use is "Prevention and detection of criminal activity and protection of council property".

 

Standards

 

CCTV cameras are in fixed positions to only monitor council land and premises.

CCTV installations are only operated by authorised council representatives and only for the purposes detailed above.

Signs are displayed at all entrances to areas covered by CCTV, notifying the public that they are entering an area covered by CCTV equipment.

Viewing of live images will only take place in restricted areas, out of sight of the public, by authorised representatives of the council. Viewing of recorded images is only by authorised council representatives.

Recorded images may be retained for longer than one week but only when put aside because of a known incident and required for the apprehension or prosecution of offenders. Recorded images are stored in one of two ways depending on the equipment installed; digital or tape. The following standards apply whichever method is used.

 

Recording-medium management

 

Where tape or digital recording-medium are used, the following rules are applied;

  • Tapes and/or digital recordings will normally only be viewable by the Data Protection Co-ordinator or Data Protection Manager of the council on a need-to-view basis, in an area secure from casual/accidental viewing by un-authorised persons.
  • Appropriate measures will be taken to prevent un-authorised/ unlawful processing of data or accidental loss.
  • Tapes, if used, will be of good quality and replaced every 6 months.
  • Enough tapes and/or digital recording medium will be held on site to allow for 14 days of recordings to be retained.
  • Tapes and/or digital recording medium should be labelled with a unique reference or serial number (e.g., date) so that the tape can be easily identified.
  • Tapes will not normally overwrite images taken at an earlier date. Old recordings will be erased before reusing the tape; before disposal, tapes will have any existing images erased.
  • Tapes and/or digital recording medium will always be held in secure locked storage.
  • Recordings will only be retained for an adequate period for the purpose for which they are being made (called the 'Retention Period'), which shall be 14 days.

 

Live-imaging only

 

The council does not currently operate live imaging CCTV systems. In the event that equipment of this nature is used, or existing equipment adapted for this purpose, the Data Protection Manager should give written authority to do so.

 

Disclosure to third parties

 

The council may sometimes disclose CCTV images to third parties such as the police for the apprehension or prosecution of offenders. In such cases the Data Protection Co-ordinator must ensure that the correct request is completed by the person requesting disclosure and that this request includes details of; the purpose of the request (e.g. crime detection), the name of the person requesting disclosure (e.g. PC Smith), the authority under which they are requesting access (e.g. PACE) and the date of removal and expected return of any recordings. The Data Protection Co-ordinator must also;

  • Record the names of all council members and others (e.g. police) viewing the image(s), the outcome of the viewing and, importantly,
  • Record the name and authority of anyone removing images from site, and the date of their return.

 

Registration

 

 

The CCTV systems installed and used by the council do not require to be registered with the Information Commissioner due to their nature i.e. static. All CCTV systems used by the council will be registered, however, with the Council's Data Protection Co-ordinator.

 

Signs

 

One or more prominent signs (black and yellow) will be displayed in the vicinity of where the CCTV is deployed. Signs will be laminated once contact details have been added and will state/give the following:

  • Why CCTV is being used
  • Who manages the CCTV operation?
  • Contact details (Data Protection Co-ordinator), plus telephone number, in case anyone wants to find out more about the scheme or request access to their CCTV images.

 

Maintenance

 

A designated person will be charged with ensuring the system is adequately maintained (and a record kept of who that person is). This person should ensure that the operation of the equipment is checked regularly, and any faults are rectified as soon as possible.

 

Additional maintenance requirement for CCTV with tape/digital recording equipment

 

Tapes and/or digital recording equipment will be managed adequately (see above). A maintenance log will be kept listing installation dates, repair details and tape changes. A maintenance contract will be in place for the equipment in use.

 

Data subject access rights

 

All persons whose image is/might be recorded on a CCTV tape/media have a right to have a copy of those images including themselves but have no right to view images of persons other than themselves. No data subject, including residents of the parish, will be given access to CCTV footage unless they make a formal "Data Subject Access Request - (SAR)". They should do this by expressing their desire to access information under the terms of the (1998) Data Protection Act in writing. The written request MUST be referred to Data Protection Co-ordinator, whose responsibility it is to ensure full legal compliance with lawful processing. The council policy is to respond to a SAR within 20 days to ensure compliance with the FOIA. In unusual circumstances, the council may advise the applicant in writing that the full 40-day periodallowed for under the DPA is required. A charge of £10 per application will be made by the council for the administration of each request. Additional charges will apply if images of other individuals are included in the footage requested. This is in line with FOIA as these images will need to be removed by specialists to protect their identity.

Where live-imaging only occurs, i.e. where a monitor only is in use without a recorder, there is nothing to supply for a data subject-access request. The response to any request to view should be that "tapes and/or digital recordings are not held."

 

Review

 

This policy, together with the continued need for CCTV usage, will be reviewed every two years by the council.

 

Approved March 2019