Autotowing Ltd. - Closed Circuit Television (CCTV) Policy & Guidelines

1. Introduction

This policy relates to the use of Closed-Circuit Television (CCTV) Systems both internally and externally on the property occupied by Autotowing Ltd., Coolready, Castleconnell, Co. Limerick.

 

This policy is designed to regulate the use of Closed-Circuit Television (CCTV) and its associated technology in the monitoring of the internal and external environs of the premises under the remit of Autotowing Ltd.

 

CCTV is a technology that uses video cameras to transmit signals to a specific place but does not transmit the images publicly.

 

CCTV systems capture images that may identify individuals either directly or indirectly by recording for example vehicle registration numbers or distinctive items of apparel.

 

A copy of this CCTV policy is available on the Autotowing Ltd.’s website https://www.autotowing.ie/ 

 

2. Scope

This policy relates directly to the location and use of CCTV and the monitoring, recording and subsequent use of such recorded material or images.

 

The technical and organisational measures implemented in respect of data protection of personal data ensures that only personal data which is necessary for a specific purpose is processed. This has been enhanced by the placement of CCTV cameras, the focus of the cameras, the capability of the cameras, the functionality of the camaras (pan, tilt, zoom etc.) and the retention period of recordings processed.

 

This policy applies to all staff, students, parents, guardians, visitors, contractors, and the general public impacted by the operations of Autotowing Ltd. CCTV systems.

 

Note; Recognisable images captured by CCTV systems are “ personal data ” and are therefore subject to the provisions of the GDPR and the Data Protection Acts 1988, 2003 and 2018.

 

Therefore, the CCTV System operated by Autotowing Ltd. is regulated in accordance with the Data Protection Acts 1988/2003/2018 and GDPR.

 

 

3. Justification for the use of CCTV

Article 5(1)(c) of the General Data Protection Regulation (the “GDPR”) requires that data are “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”.

 

The following are the purposes that Autotowing Ltd. has deemed justified to obtain and use Personal Data by means of a CCTV system:

• Autotowing Ltd. has a statutory responsibility for the protection of its property, equipment and other plant as well providing a sense of security to its employees, customers, invitees, contractors and visitors to its premises.
• Autotowing Ltd. owes a duty of care under the provisions of Safety, Health and Welfare at Work Act 2005 and associated legislation and thus utilises CCTV systems and their associated monitoring and recording equipment as an added mode of security and surveillance for the purpose of enhancing the quality of life of the business community by integrating the best practices governing the public and private surveillance of its premises.

 

 

4. Criteria for the use of CCTV System

The use of CCTV systems was considered in relation to other security measures such as static security personnel or security mobile patrols and the CCTV surveillance and security applications made it a preferred choice as they

• acted as a deterrent to potential criminals in having their movements and actions recorded.
• provided a visual record of events which can be used in subsequent enquiries, investigations, or legal actions as applicable.
• provided 24/7 round-the-clock monitoring of Autotowing Ltd. premises.
• provided remote monitoring capabilities enabling viewing of live footage or recorded videos.
• cost-effective as opposed to employing a team of security personnel to monitor Autotowing Ltd.’s premises.
• scalability of the CCTV system allows additional cover to be installed if required.
• their integration suitability with other security systems such as access controls and alarms were an advantage.
• ability to record evidence in relation to incidents to assist with enquiries, investigations or insurance claims etc.

 

5. The Purpose of CCTV System

The CCTV system was installed (internally and externally) by Autotowing Ltd. for the purpose of

• enhancing security and protecting Autotowing Ltd.’s buildings and assets, during and after working hours.
• promoting the health and safety of staff, customers, contractors, visitors and general public.
• monitoring and recording of restricted access areas, especially at entrances to buildings and other relevant areas.
• deterring and detecting crime or anti-social behaviour.
• assisting in investigating security or health and safety incidents / issues.
• In exceptional circumstances and where it is considered appropriate, CCTV material or images may be used to visually monitor customers, visitors or staff members. Such exceptional circumstances could include, for example, where an accident or incident has taken place or in the case of a staff member(s) where there is an allegation has been made or where the controller may be liable for injuries caused to data subjects.

 

6. The lawful basis for the use of CCTV System

The General Data Protection Regulations (GDPR) under Article 6 sets out the circumstances under which processing of personal data shall be lawful.

 

Article 6.1(f) GDPR states that

“Processing shall be lawful only if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.

 

The Data Protection Commissioner had indicated that CCTV System have legitimate uses in securing premises, supporting workplace safety management and in aiding in the prevention and detection of crime^[1].

 

Autotowing Ltd. lawful basis for the use of CCTV systems to process personal data is one of “Legitimate Interest”.

 

7. Management of CCTV System

The management of the use of the CCTV system is to ensure that the

• CCTV system will be conducted in a professional, ethical and legal manner.
• CCTV system will be accessed controlled.
• CCTV will not be used for monitoring employee’s performance.
• CCTV Systems already in operation, will be reviewed regularly in consultation with the Management / Staff.
• CCTV monitoring of public areas will be conducted in a manner consistent with Equality & Diversity, Dignity at Work, Harassment in the Workplace and Sexual Harassment as well as other relevant legislation.
• That no monitoring occurs based on the characteristics and classifications contained in equality and other related legislation e.g. race, gender, sexual orientation, national origin, disability etc.
• Video monitoring of public areas within Autotowing Ltd. premises is limited to uses that does not violate the individual’s reasonable expectation to privacy.
• New CCTV systems will be introduced in consultation the management and staff.
• CCTV systems will not be used to monitor employees work performance in the workplace.
• The release CCTV recordings or any material recorded or stored in the system will be recorded in either the ‘Data Subject Rights Request Record’ and or “CCTV Recordings Access Request Record” as applicable.
• Co-operate with the Health & Safety Officer of Autotowing Ltd. in reporting on the CCTV system in operation within the business.
• Ensure that external cameras are non-intrusive in terms of their positions and views of neighboring residential housing and comply with the principle of “Reasonable Expectation of Privacy”.
• Ensure that monitoring recordings are stored in a secure place with access by authorised personnel only.
• Ensure that images recorded on tapes/DVDs/digital recordings are stored for a period not longer than 30 days and then erased, unless required as part of a criminal investigation or court proceedings (criminal or civil) or other bona fide use as approved by the controller.
• Ensure that when a zoom facility on a camera is being used to guarantee that there is no unwarranted invasion of privacy.

 

In order to protect the security of the CCTV system, a number of technical and organisational measures have been put in place, including:

• Administrative measures that include the obligation of all outsourced personnel requiring access to the CCTV system (including those maintaining the equipment and the systems) being obliged to sign a confidentiality agreement.
• Access rights to the CCTV system will only be granted to users where it is strictly necessary for them to carry out their work.
• Bob Sweeney of Autotowing Ltd. grants, alter or annuls access rights of users of the CCTV system.

 

8. Legislation Governing the Use of CCTV Systems

Data Protection Acts 1988 / 2003 / 2018 & the Genera Data Protection Regulations (GDPR).

 

Data Protection Principles of the GDPR

• Obtain and process personal data lawfully, fairly and transparently.
• Process personal data only in ways compatible with the original purpose.
• Only collect personal data for one or more specified, explicit and lawful purpose.
• Keep personal data safe and secure and protect it against any unauthorised or unlawful processing, accidental loss, destruction or damage, while using appropriate technical or organisational measures (‘integrity and confidentiality’).
• Keep personal data accurate, complete and up to date.
• Ensure that personal data is adequate, relevant and not excessive.
• Retain personal data no longer than is necessary for the specified purpose.
• Provide a copy of a data subject’s personal data to any individual, on request.

 

9. Summary Description & Technical Specifications for the CCTV System

The CCTV system records any movement detected by the cameras in the area under surveillance, together with time, date and location. All cameras operate 24 hours a day and 7 days a week. The image quality allows identification of those in the camera’s area of coverage.

 

10. Location of Cameras

It is essential that CCTV equipment is sited in such a way that it only monitors those areas intended to be covered by the equipment. Autotowing Ltd. has endeavoured to select locations for the installation of CCTV cameras which are least intrusive to protect the privacy of individuals.

 

The use of CCTV to monitor areas where individuals have a reasonable expectation of privacy will not be undertaken under this policy.

 

Cameras placed so as to record external areas are positioned in such a way as to prevent or minimise recording of passers-by or of another person's private property.

 

 

11. Signage

In compliance with the Lawfulness, Fairness and Transparency Principle [Article 5, clause 1(a)] of the General Data Protection Regulation (the “GDPR”), individuals (or “Data Subjects”) whose images may be captured on Autotowing Ltd.’s CCTV cameras must be made aware of Autotowing Ltd.’s recording activities.

 

Autotowing Ltd. does this through CCTV Signage which is placed and the entrances and in prominent locations both internal and external to the business’s premises, as well as in the privacy notice and the CCTV policy published on the business’s website https://www.autotowing.ie/

 

The signage at the entrances includes details relating to:

• Controller’s Identity – i.e., informing you that Autotowing Ltd. is recording your image (i.e., Autotowing Ltd. is the Data Controller). (Entrance Signs only)
• Contact Details – how you can contact Autotowing Ltd. (Entrance Signs Only)
• Purpose of CCTV System – the purpose of the recording of CCTV system will be stated on the signage at the entrance(s) to the premises. (Entrance Signs)
• An Image of a Camera – a picture image of a camera will be placed at locations where CCTV camera(s) are sited to indicate that CCTV is in operation.

The signage at other locations internally and externally to the business premises consists of an image of a CCTV camera.

12. Data Retention and Processing Images

The Personal Data captured from Autotowing Ltd. CCTV cameras are securely stored as electronic data.

 

Article 5.1(e) of the General Data Protection Regulation (GDPR) on Storage Limitations requires that Personal Data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are published.’’

 

Autotowing Ltd. CCTV recordings are recorded over after a period of 30 days, unless downloaded in accordance with the principals of the GDPR, bearing in mind the purpose and legal basis for such further processing of personal data.

 

It is important to note that in exceptional circumstances, images may be retained for longer time periods. This occurs where, for example an image captured on Autotowing Ltd. CCTV systems identifies an incident that is subject to an investigation (e.g., an alleged crime has been captured by the CCTV footage and a copy of the footage has been requested by An Garda Síochána or/and other competent bodies for law enforcement purposes’. ‘Competent authority’ is defined at section 69 Data Protection Act 2018). In these cases, the CCTV images or “footage” will be retained until the investigation and all associated appeal processes have been concluded.

 

Images/recordings will be stored in a secure environment with a log of access kept in the “Data Subject Rights Request Record’ and or “CCTV Recordings Access Request Record” as applicable. 

 

Access to the CCTV System recordings will be restricted to authorised personnel only. Supervision of the access and maintenance of the CCTV System is the responsibility of the Bob Sweeney of Autotowing Ltd.

 

 

 

 

13. Access to the Images

Access to, and disclosure of CCTV images to third parties is strictly controlled and documented in the ‘Data Subject Rights Request Record’ and or “CCTV Recordings Access Request Record” as applicable. This is to ensure that the rights of the individual(s) are maintained, and that the chain of evidence remains intact should the CCTV images be required for evidential purposes.

 

In relevant circumstances, CCTV footage recorded by Autotowing Ltd. may be accessed by:

• The Director, Management, Staff, insurance company pursuant to claim for damages and other statutory body charged with health and safety etc).
• Individuals whose images have been recorded by Autotowing Ltd. CCTV systems and who have submitted a valid Subject Access Request (or “SAR”) under the GDPR, Data Protection Acts 1988 to 2018 or a valid Freedom of Information (or “FOI”) Access Request under the Freedom of Information Act, 2014.
• Individuals whose images has been captured by Autotowing Ltd. CCTV systems or requests on their behalf by their legal representative subject to a Court Order.
• An Garda Síochána, ‘and other competent bodies for law enforcement purposes, (‘Competent authority’ is defined at section 69 Data Protection Act 2018), where the business is required by law or following a written request to make a report regarding a suspected crime or incident.
• The Insurance Company as Autotowing Ltd.’s insurer where the footage is required to pursue a claim for damage or injury sustained.
• In exceptional circumstances, CCTV images may be used in the context of a formal internal investigation or disciplinary procedure concerning a staff member. In such cases, the disclosure of the image(s) may be used to assist in the investigation or prosecution of a sufficiently serious disciplinary matter or a criminal offence.
• When CCTV recordings are being viewed, access will be limited to only authorised individuals on a need-to-know basis.
• Only in exceptional circumstances may images be disclosed to those carrying out a formal internal investigation or disciplinary procedure, where it can reasonably be expected that the disclosure of the images may help the investigation or prosecution of a sufficiently serious disciplinary offence or a criminal offence.

 

 

 

14. Subject Access Requests

Under Data Protection legislation, an individual has the right to exercise their data subject rights of access to their personal data recorded on a CCTV System from the Data Controller, such as Autotowing Ltd.

 

All requests should be made in writing to Autotowing Ltd. at bob@autotwing.ie. The individual making the request may be asked to give a reasonable indication of the date and time of the footage they are looking for.

 

In the event of a requests not being complied with where there is insufficient detail supplied relating to the date and time of the recording, correspondence indicating the reason(s) for non-compliance will be sent to the requester advising them of this.

 

If the data subject wishes to view the images on site, as opposed to a copy being sent, the viewing should take place in a closed office with only the relevant individuals present.

 

A data access request will be complied with provided that such an image/recording exists i.e. it has not been deleted or it is exempted/prohibited from release.  Where the image/recording identifies another individual, those images may only be released where they can be redacted/anonymised so that the other person(s) is / are not identified or identifiable. 

 

 

15. Access Requests from An Garda Síochána

In line with Section 8 of the Data Protection Acts 1988/2003, An Garda Síochána are entitled to view personal information about individuals, if it is for the following purposes:

• For the prevention or detection of crime.
• For the apprehension or prosecution of offenders.
• When it is required urgently to prevent injury or other damage to the health of a person, or serious loss of or damage to property.
• When it is required by, or under any enactment, or by a rule of law or order of a Court.

With regard to requests from An Garda Síochána to download footage, any requests for copies of CCTV footage will only be acceded to where a formal written request is provided to the data controller, stating that the footage is required due to An Garda Síochána investigating a criminal matter. For practical purposes, and to expedite a request speedily in urgent situations, a verbal request will be sufficient to allow for the release of the footage sought. However, any such verbal request must be followed up with a formal written request. All such requests should be recorded in the “CCTV Recordings Access Request Record” by data controllers and processors.

All such requests must be made on an official Garda Data Protection Form.

 

16. Security Companies

Autotowing Ltd. CCTV system is controlled by an external monitoring company contracted by Autotowing Ltd. the following applies:

 

Autotowing Ltd. has a contract with the external monitoring company in place which details the areas to be monitored, how long data is to be stored, what the security company may do with the data, what security standards should be in place and what verification procedures apply. The written contract shall also state that the security company will give Autotowing Ltd. all reasonable assistance to deal with any subject access request made under GDPR which may be received by Autotowing Ltd. and responded to within the statutory timeframe (30 days). 

 

Security companies that place and operate cameras on behalf of clients are considered to be "Data Processors."  As data processors, they operate under the instruction of data controllers (their clients). GDPR place a number of obligations on data processors.  These include having appropriate security measures in place to prevent unauthorised access, alteration, disclosure or destruction of data, in particular where the processing involves the transmission of data over a network and against all unlawful forms of processing.  This obligation can be met by having appropriate access controls in relation to the storage of images or implementing robust encryption where remote access to live recording is permitted. Employee(s) of the security company are also required to have been made aware of their obligations relating to the security and protection of such personal data.

 

17. Disposal of CCTV Recordings

In the event of CCTV recording being saved beyond the 30 days retention period, the CCTV recording will be manually deleted when the purpose(s) of the extended retention period of the CCTV is no longer necessary.

 

 

18. Implementation & Review

This policy will be reviewed and evaluated from time to time. On-going review and evaluation will take cognisance of changing information or guidelines (e.g. from the Data Protection Commissioner, An Garda Síochána, legislation and feedback from directors, management, staff, service providers, and third parties). 

 

This policy will be implemented by Autotowing Ltd.

 

A copy of this CCTV policy will be available on Autotowing Ltd.’s website https://www.autotowing.ie/

 

 

 

^[1] Data Protection Guidance for Controllers on the use of CCTV Systems November 2023.