CCTV Question

[sparkeh]

really do you work in a school or maybe its just my school that has drug dealers at the gates and students bullying each other, not to mention the angry parents coming on site threatening students & Staff

Yep I certainly do. And in a very similar sounding area.

We use CCTV too. However, it is only accessed to view footage of incidents.

 

Hey I was just trying to point in the direction of some guidance on the proper use of CCTV footage. If your school can justify its use then you're golden. But actually from reading your post the school is reviewing its use and ultimately its up to management to decide and justify its usage. Do with the advice what you will

[JamesParker]

Yep I certainly do. And in a very similar sounding area.

We use CCTV too. However, it is only accessed to view footage of incidents.

 

Hey I was just trying to point in the direction:)

 

yes sorry it is appreciated , i just know for a fact in our case it will have a very negative effect once they are off

 

students will see it as a free for all, as we don't have enough staff to police them all

 

hey but its out of my hands i can only give them the advice & in the end its one last job for us to be responsible for every cloud and all that

 

to be honest the job was forced upon us for safeguarding reasons years ago after a local school had decided to visit ours and show the students what they though of us!

 

we are more upset with the fact of how it was put to us than anything else, though no one else apart from this dept is of the same opinion which is strange !

Edited February 9, 2018 by JamesParker

[eyetea]

Not passively on, site manager or myself respond to requests dependent on issue (site manager for generic requests, I deal with potential safeguarding issue cctv requests as on the safeguarding team as a DDSL)

[MkII]

We have an attached small public leisure centre (gym, sports hall and fitness suite, no swimming pool, sauna etc) who want to passively monitor centre users for user safety. Maybe equipment abuse. The school use it weekdays term time.

Is this ok under GDPR?

I don't think there are ever enough staff on site to man rooms individually.

Thanks.

Edited February 11, 2018 by MkII

[geezersoft]

Poorly worded for sure. You are taking it personally and I doubt it was intended that way.

 

You should have a clear CCTV policy that is policed by your data protection officer. If you are not given permission to monitor CCTV in either the policy, your job description or directly from your data protection officer you should not be looking at it full stop.

[chrisakak9]

ours is in tbe schools office which displays the access gates to the grounds. wash you hands of it and pass it on to buildings, if you need access from time to time set up remote access and login when needed

[synaesthesia]

The only CCTV cameras we have actively monitored are covering pupil entrances from the public areas. The others are for recording only and not actively monitored. It would be tough to compare to a supermarket depending on the school... supermarkets are absolutely chock full of tea leaves and need monitoring. The majority of schools won't have the same affliction but schools in some areas will need monitoring more closely than others. That's not anyone being a snowflake, or anyone wishing to be Big Brother but merely a reflection of modern times. Personally I'd put it down to the lack of discipline afforded to young people these days, but discipline itself is fast becoming a bad word amongst crazies.

[rom1984]

We have an attached small public leisure centre (gym, sports hall and fitness suite, no swimming pool, sauna etc) who want to passively monitor centre users for user safety. Maybe equipment abuse. The school use it weekdays term time.

Is this ok under GDPR?

 

Thanks.

 

The GDPR doesn't specifically set out if you can or can't use CCTV, but some of the principles and rights you will need to think of are;

 

Lawful Processing - on what lawful bases are you going to process the data (i.e on what lawful bases are you going to record people). The GDPR sets out 6 reasons why you can process personal data. You data officer and SLT will need to decide which one is relevant for them. The most popular that most people think of is consent, but you probably wouldn't choose consent for CCTV recording.

 

 

The bases for what you are lawfully processing data will need to be balanced against the rights of the individuals and you will need to justify how you balanced this. For example if you are recording to prevent people breaking equipment, but there are no records of broken equipment in the last 12 months, you may be asked to justify why then are you recording people then. A big one that is looked at is the quality of the CCTV, if you are using it to record potential crimes to convict people, but the quality of the CCTV is such that you could never make out the person, then you will be asked to justify why you are recording on that bases.

 

 

The GDPR sets out 7 principles that your data protection officer will need to work through and decide how they will comply. For example the principle of fair processing (i.e transparency is the key - are you telling people in clear terms that they are being recorded and for what purposes).

 

If there is a data breach relevant to CCTV you will be asked to show what other strategies could you have used that didn't collect personal data, for example would security lights / street lights have achieved the same result of crime prevention. You will then be asked to show how you justified CCTV over security lights etc.

 

Storage Limitations - you will need to justify how long are you keeping the data and if the length of time is compatible with the reason you are collecting data. For example if you are recording for the reason of protecting the equipment, and at the end of the night there is no broken equipment, then you don't need to keep the recording anymore and it should be deleted that night. If its not, you need to justify why.

 

 

Integrity and Confidentially - you will need to document who has access to the CCTV, why do they have access, how do they access it, how do you prevent unauthorised access

 

These are just a few examples that your Data Protection Officer and Senior Leadership team will need to work through and decide.

[Seb1780]

I have nothing to do with the CCTV at our site, but a thought occurred whilst reading this thread - If no-one is monitoring the feed from the cameras how do you know they are working? I'd have thought that an "overview" screen showing a composite of all the cameras on site would suffice to show what cameras were working without providing enough detail to allow identification of any individuals.

[MkII]

I have nothing to do with the CCTV at our site, but a thought occurred whilst reading this thread - If no-one is monitoring the feed from the cameras how do you know they are working? I'd have thought that an "overview" screen showing a composite of all the cameras on site would suffice to show what cameras were working without providing enough detail to allow identification of any individuals.

We have the facility to view all 56 camera feed as thumbnails which is useful for that very reason. I'm not interested in the image just that there is an image.

[welshman]

Same here. 61 camera feeds showing live on a screen. All the size of a postage stamp so no useful detail can be made out but it's possible to see that the feed is working. When detail is needed we can open up a feed full screen.

[JamesParker]

lol actually ours have always been like that the cameras show no bigger than 3cm's square.

 

the number of cctv request i have received this year (2018) is 22 so far , the last one was drugs related the others vary from vandalism to bullying

 

wish I could ditch this part of my job , but its in my Job Description

[psydii]

Our interpretation has been the viewing of recorded material must be done in a private space by authorised personal only, and documented. This is enshrined in policy and operational practice.

 

Live view - unless there would be an expectation of privacy in the location of the camera, live views can be seen by anybody, in the same way anyone could walk round the corner and see what is going on in front of the camera without warning anyway.

[JamesParker]

Our interpretation has been the viewing of recorded material must be done in a private space by authorised personal only, and documented. This is enshrined in policy and operational practice.

 

Live view - unless there would be an expectation of privacy in the location of the camera, live views can be seen by anybody, in the same way anyone could walk round the corner and see what is going on in front of the camera without warning anyway.

 

I totally agree with both statements , couldn't have put it better myself and these are the basis we have worked on for the last 5 years

 

though it now feels like we (myself and my techs) are being classed as perverts for having them on display !

Edited February 13, 2018 by JamesParker

[PotNoodleTech]

IMHO, CCTV daily usage is not an IT Support issue, it is a site management issue, dump it all in the site office and wash your hands of it and don't take offence to being told it is not your job as, it is actually not your job!

[rom1984]

I wouldn't take it personally mate! I used to work in the same school as my missus and I trust her with my life, but I wouldn't give her my domain admin credentials.

 

Not because I don't trust her or I think she will use them to go snooping, but if there is ever a data breach I want to be able to put my hands up and say I followed best practises so you can't blame me!

 

I think this is what the deputy head is doing, although he's not articulated it very well lol

[JamesParker]

thanks for the support everyone

[GrumbleDook]

A quick note for those who say that they have a thumbnail of every image as a way of checking all the cameras are working ...

In your CCTV policy you should have a maintenance log. This will be a record of when you check every device that it is viewing what it is meant to be viewing, that it operates as specified in the policy .... Some places will do this check on a weekly basis, some daily ... in shopping centres it will be at least once a shift, and is combined with a rolling (and usually automated) check on each camera.

 

What you do is based on your school's need. If there is a high risk of intruders, a risk to damage to the cameras to prevent things being recorded ... then you will have a different operating procedure to other lower risk establishments.

[gypo]

Hi Everyone

 

can you please give me your opinion on CCTV at my current school we have had the CCTV on in our office for the last 5 years however now a new deputy has started and said that we should have this removed as it is inappropriate for us have cctv that shows children continually on show, he said it should be removed under safeguarding.

 

As far as I’m aware most schools have CCTV on display be it in the ICT support office or some other office!

 

We have all taken it a little personal, it is like saying we do not trust you and we think you may be inappropriately watching children all day!

 

Your opinions would be much appreciated

 

James

Hi James,

 

We had a similar issue in our IT office as we have 5 16CH DVR's linked into monitors above the cabinet which were on show to students walking past and inside our office.

 

These had to be turned off due to the nature of some live footage, and any CCTV footage has to be shown through the remote client.

[dclarkeswc]

On show in ICT office, cannot be seen by anyone visiting the office unless they come round the desk, by which time I could have turned it off.

The safeguarding comment is just how anyone is a school gets their way, it can't be argued with easily.

 

Makes me wonder what the deputy has to worry about. Let the head make the decision, deputy can't override it then.

[CyberDrac]

We have been told previously that viewing a live feed for monitoring purposes is a very different case to reviewing historical footage in light of an incident. When you register with the ICO you would need to explicitly state that the CCTV is being used for that purpose and it is being viewed by appropriately trained personnel in an appropriate location.

[Grey-gear]

The school I work at does not have it on display, there are four or five staff that can access from their computers in their office but most of the time I'm asked to get stuff off for them.

[GrumbleDook]

Can I check with everyone who does retrieval of data from CCTV, do you make sure you have a log of who is authorised to make the request, the request itself (including justification), and who any data is subsequently shared with *as a minimum*?

[Bionic]

I have been trying to get SLT to treat the use of CCTV more seriously with respect to data protection etc. For whatever reason, they don't seem interested. We have no log of who requests footage, who views footage, or the reason why it is being viewed. I have tried to raise awareness of data security time and time again, but I seem to be getting nowhere.

[synaesthesia]

We've never gone down that route but sounds very much like it's time we do. Everything has been on a "common sense" basis; we've actively refused some staff to see something from their lesson or outside their lesson when it wasn't security or vandalism related. We don't want to go jumping through hoops or being "those guys" but it certainly wouldn't hurt to log requests or make it clear to staff that all requests must come from a certain team.

In most current cases it's either our behaviour team making the requests, or something happening that requires attention for example vandalism. Oddly enough our site team have never had direct access to CCTV which we're about to correct.