We're committed to protecting your personal data and ensuring that it is processed fairly and lawfully. Information you provide to us will be processed in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and subsequent legislation.
Information we collect
The data that we process is footage showing employees, visitors and members of the public which is captured by our CCTV cameras and stored on our systems.
Some more sensitive information, known as special category data, may also be processed passively if the footage collected reveals an individual’s ethnic or racial origin, or data concerning their health (for instance, if they have a visible disability).
Where there is a security incident, some criminal offence data may also be processed.
Processing personal data
The information collected will be only be processed for one or more of the following purposes:
- protecting the health and safety of employees and visitors to sites
- preventing and detecting crime or criminal activity, and protecting our buildings and assets from damage, disruption, vandalism or other criminal activity
- creating a safer environment and providing reassurance to employees and the general public
- improving traffic management
- countering terrorism
- assisting with investigations, where appropriate
- assisting in the effective resolution of any disputes or legal or insurance-related claim involving ourselves
It will not be processed for any other purpose. The legal basis for processing is:
- GDPR article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where special category data is processed, the legal basis is:
- article 9(2)(g): processing is necessary for reasons of substantial public interest.
The relevant basis in UK law is set out in section 10(3) of the DPA 2018. This means that we're required to meet one of the 23 specific substantial public interest conditions set out in Schedule 1. The substantial public interest condition is one or more of the following:
- Sch 1 para 7: Administration of justice
- Sch 1 para 10: Preventing or detecting unlawful acts
- Sch 1 para 11: Protecting the public
- Sch 1 para 20: Insurance
Where personal data relating to criminal allegations or offences is processed, this will be carried out only where authorised under UK law in compliance with GDPR Article 10 and will meet one or more of the following conditions set out Schedule 1, Part 3 of the Data Protection Act 2018:
- Sch 1 para 33: Legal Claims
- Sch 1 para 36: Substantial Public Interest
- Sch 1 para 37: Insurance Claims
Access to data
There is no planned regular or scheduled sharing of CCTV footage with any external organisation. However, in the event of a security incident or suspected security incident, footage may be shared with third party organisations such as the police or insurance companies.
Footage may be shared with an individual in response to a subject access request. Where a subject access request is made, efforts will be made to seek the consent to disclosure of images of any other individuals captured in the footage, and where this is not possible, consideration will be given as to whether or not it is reasonable to share the information without their consent.
The information provided will not be used for marketing purposes, unless you have agreed to this, or to take any automated decisions.
Data security
Images captured on camera re transmitted to and recorded on hardware hosted within our infrastructure and as a result will be subject to appropriate security protocols. They can then be viewed remotely from the control room, which is located in County Hall.
CCTV footage from our other sites, such as Shand House, are streamed back to the control room at County Hall. Access to the control room is restricted to trained personnel only. Where CCTV is used in libraries, footage is not streamed to the control room but is monitored within the library premises only, by trained and authorised staff.
We're committed to protecting personal data and have policies and procedures on information security in place to ensure that it is safeguarded.
Data retention
The information provided will be kept in accordance with the relevant retention schedule.
Your rights
Should you wish to raise any concerns about how we have processed your personal data you can contact the data protection officer, please email access2info@derbyshire.gov.uk or write to:
Data Protection Officer
County Hall
Matlock
Derbyshire
DE4 3AG
You also have the right to contact the Information Commissioner.
If you would like a copy of this information in a different format, please email access2info@derbyshire.gov.uk