CCTV Advice

[jaminben]

Hi,

 

We've just installed some CCTV equipment with a DVR and I'm after some advice as to who can view and take copies of video from the device... so far in the last two days I've had 3 members of staff ask me to show them how to take a snippet from the DVR.

 

We don't have any policies for CCTV yet.

 

Can anyone offer any advice?

 

Thanks

 

Ben

[synaesthesia]

CCTV should absolutely be restricted access, and would suggest getting a policy in place before you even dare to "use" CCTV in that manner; the school and you are open to being taken royally by DPO.

[jaminben]

CCTV should absolutely be restricted access, and would suggest getting a policy in place before you even dare to "use" CCTV in that manner; the school and you are open to being taken royally by DPO.

 

This is my thoughts also... but, I don't have anything to back it up.

[synaesthesia]

There's lots to back it up, if you have been given "control" of it by means of you setting it up etc, then you put your foot down and say you need a policy in place to protect you and the school, you need to know who the data protection officer is, they need to be named on the signage you have etc. Failure to do so could mean a large fine should something happen, and an even larger fine when GDPR hits in a few months. You're protecting the school too, raise it with SLT immediately.

https://www.gov.uk/data-protection-your-business/using-cctv

[AJWhite1970]

From our Security policy

 

"CCTV

41. The school is fitted with a CCTV system which is controlled by the ICT Network Manager. Having cameras in the School should provide parents and staff with an

added sense of security without being intrusive to teachers, pupils or parents.

 

42. The colour pictures produced are recorded on a file server hard drive which can be monitored. Other than the ICT Network Manager the only personnel permitted to view any

recordings are as follows:-

Headmaster

Deputy Headmaster

Business Manager

Site Manager

Police Authority (on receipt of a written request).

 

A parent, pupil, member of staff or governor does not have a right to view. "

[IrritableTech]

That's an interesting statement you've got there... "A parent, pupil, member of staff or governor does not have a right to view."

 

Under a subject access request I believe they do have the right to see themselves but nobody else. https://ico.org.uk/for-the-public/cctv/

 

From our Security policy

 

"CCTV

41. The school is fitted with a CCTV system which is controlled by the ICT Network Manager. Having cameras in the School should provide parents and staff with an

added sense of security without being intrusive to teachers, pupils or parents.

 

42. The colour pictures produced are recorded on a file server hard drive which can be monitored. Other than the ICT Network Manager the only personnel permitted to view any

recordings are as follows:-

Headmaster

Deputy Headmaster

Business Manager

Site Manager

Police Authority (on receipt of a written request).

 

A parent, pupil, member of staff or governor does not have a right to view. "

Edited September 29, 2017 by IrritableTech

[GrumbleDook]

There is an old policy on the wiki (remember that everyone) but it does need some TLC to take into account recent advice from ICO (already linked above)

[AJWhite1970]

Good point, well made. That policy is due for renewal this term, I'll make sure it's updated.

 

The exact wording on the ICO's website is:-

 

"You have the right to see CCTV images of you and to ask for a copy of them. The organisation must provide them within 40 calendar days of your request, and you may be asked to pay a fee of up to £10 (this is the maximum charge, set by Parliament). This is called a Subject Access Request. You will need to provide details to help the operator to establish your identity as the person in the pictures, and to help them find the images on their system."

[Koldov]

"the right to see themselves but nobody else"

 

Good luck with that!

 

How is that even practically possible...?

[Blue_Cookeh]

It's not. We were told by the ICO that if images requested by a parent included other children, staff, or parents then we should not disclose the images to the requesting parent.

 

The only people with access to CCTV in our school is me (IT) and the headteacher. Our policy says all requests must be in writing, approved by the headteacher, and complaints on decisions can be taken up with the governors, £10 is payable before delivery of images. Police are allowed to be sent recordings, but they're logged in a book in the office and signed by the officer.

 

Realistically it's too awkward for anyone external to be bothered.

Edited September 29, 2017 by Blue_Cookeh

[minimoo]

For entertainment value: https://www.whatdotheyknow.com/request/ps95_fee_for_cctv_subject_access

[IrritableTech]

It may be worth reminding anyone who is updating their CCTV policy that under GDPR you will no longer be able to make any charges for subject access requests.

 

Good point, well made. That policy is due for renewal this term, I'll make sure it's updated.

 

The exact wording on the ICO's website is:-

 

"You have the right to see CCTV images of you and to ask for a copy of them. The organisation must provide them within 40 calendar days of your request, and you may be asked to pay a fee of up to £10 (this is the maximum charge, set by Parliament). This is called a Subject Access Request. You will need to provide details to help the operator to establish your identity as the person in the pictures, and to help them find the images on their system."

[enjay]

It may be worth reminding anyone who is updating their CCTV policy that under GDPR you will no longer be able to make any charges for subject access requests.

 

Also, 30 days to comply not 40 under GDPR too.

 

As for the OP, if you don't have a CCTV policy, turn it off. Now. Do you have signs up saying you're using CCTV, why, and who to contact? Have you informed the ICO?

[mjk]

From a course I went of about CCTV in relation to DPA, not GDPR, I was told that we had to 'restrict access' to the CCTV and have a policy detailing that.

As long as the data is restricted in some way I believe this is compliant. We chose to restrict access to all teachers who are physically in the building. ie they cannot access the system from home, and students cannot access it at all.

The LA said this was compliant with DPO , it keeps the teachers happy because they can all access the system and it gives me less work to do (going through tapes is a chore especially if there isn't a good fight to watch at the end)

[Roberto]

As for the OP, if you don't have a CCTV policy, turn it off. Now.

 

I know this sounds extreme but I agree completely. CCTV is a potential minefield and every moment the CCTV is running without knowledge of what you can and can't do and who does and does not have access, and under what circumstances, you're really not far away from a very expensive foot in the wrong place.

[Blue_Cookeh]

It's a powerful tool and has helped us a few times in different situations involving police, staff, and intruders. As with anything GDPR/DPA it's a potential minefield, but that doesn't mean you bury your head in the sand. Get compliant before turning the system on, though.

 

You need stickers on entrances to buildings, publicly visible signs detailing contact information for the scheme operator, the policy should be made available to the public on your website and signed off by governors, and you need to register the fact you're recording CCTV with the ICO. Log absolutely anything you do on it in terms of access and maintenance. Just be as transparent as possible. We had support from our LA on writing policies etc.

[jaminben]

Also, 30 days to comply not 40 under GDPR too.

 

As for the OP, if you don't have a CCTV policy, turn it off. Now. Do you have signs up saying you're using CCTV, why, and who to contact? Have you informed the ICO?

 

Thanks for everyone's responses

 

I've passed all this information up the chain, they can decide what they want to do.... we do have signs but we don't have the required information on the signs by the looks of it.

 

What is the 30 days to comply?

Edited October 2, 2017 by jaminben

[Blue_Cookeh]

Thanks for everyone's responses

 

I've passed all this information up the chain, they can decide what they want to do.... we do have signs but we don't have the required information on the signs by the looks of it.

 

What is the 30 days to comply?

 

30 days to comply to requests for data, similar to FOI requests now but different timing.

[GeekyPete]

All the red light have been about the DPA and GDPA.. But there's also the Public Space Surveillance regulation too. Don't let the name fool you it covers private spaces too. If you only use it to detected intruders your OK. If you identify people on it you need to get licenced, and so does your boos.

 

https://www.sia.homeoffice.gov.uk/Documents/licensing/sia_get_licensed.pdf Read page 10.

[Blue_Cookeh]

All the red light have been about the DPA and GDPA.. But there's also the Public Space Surveillance regulation too. Don't let the name fool you it covers private spaces too. If you only use it to detected intruders your OK. If you identify people on it you need to get licenced, and so does your boos.

 

https://www.sia.homeoffice.gov.uk/Documents/licensing/sia_get_licensed.pdf Read page 10.

 

This is only for people specifically working in surveillance or as a CCTV operator. Running CCTV for the purposes of crime prevention and property preservation don't require this, especially as using the images for identification is up to the police, not us.

 

Maybe I'm missing something but Page 10 doesn't have anything relevant? Schools aren't "manned guarding" nor providing contractual services.

Edited October 10, 2017 by Blue_Cookeh

[enjay]

Running CCTV for the purposes of crime prevention and property preservation don't require this, especially as using the images for identification is up to the police, not us.

 

Hmm, interesting. Surely if we showed the Police our CCTV footage of a teenager committing a crime or damaging property, the Police would ask "and do you recognise the child?", at which point we the school are using it for identification, not the Police...

[gavinprime26]

Hmm, interesting. Surely if we showed the Police our CCTV footage of a teenager committing a crime or damaging property, the Police would ask "and do you recognise the child?", at which point we the school are using it for identification, not the Police...

 

Section 29 of the dpa covers this: (ii)the prevention or detection of crime, or apprehension or prosecution of offenders. Also cctv licensable activity in the space of pss (public space surveillance) is for contracted services and public spaces like council cctv, shopping centres etc. It is not required in schools or colleges unless you have a contracted security provision and public space cctv. For example, in my college our main entrance is public space and we have manned guarding provision therefore it is a licensable activity.

 

Hope it helps.