From 25 May 2018, the General Data Protection Regulation (GDPR) will come into force across the EU with implications for how we capture and handle CCTV footage.Businesses must learn to adapt to the new regulations and understand the penalties – fines up to €20m or 4% of turnover (whichever is greater) – they may face if they don’t.
In this article, we discuss how you can make sure that your business is working within the framework of GDPR rules once they’re introduced.
Many businesses have CCTV within their premises, whether this is to protect assets and/or protect their staff – but now you must have a strong, ‘fair use’ reason for its placement. An example of this would be to help protect employees when it comes to health and safety or to capture footage of any incidents that occur within the company.
Video surveillance that allows employers to spy on their staff is against the rules of this new regulation – although if you feel to have CCTV in areas that they are operating, you must compile an operation requirement (OR).
CCTV in public spaces can be tricky as people who expect privacy in certain areas can make an objection. This can range from places such as canteens, break areas and public spaces.
If you can highlight a security risk that could be minimised through using CCTV, it is more likely that the CCTV will be accepted in these places
If you can highlight a security risk that could be minimised through using CCTV, it is more likely that the CCTV will be accepted in these places. Again, think of the OR.
If you have CCTV, you’re instantly collecting personal data from everything captured on camera. To inform people who operate in and around your business, you should disclose to them that CCTV is in use and that they could be captured on footage obtained.
A common method is to have signs with a clear and feature a number for those who want to contact the CCTV operators if they have any queries.
Once you’ve captured the data, it can be normally retained for 30 days. If you need to keep it longer, you need to carry out a risk assessment that explains the reasons why.
Images and videos acquired through your CCTV system might be requested by the police. 2020 Vision, which provides access control systems, recommends that you make sure they have a written request. Police will usually view the CCTV footage on your premises and this would not warrant any concerns about the data being leaked.
With the new regulation coming into play, it’s important to understand that your security supplier will become your data processor. Have a contract in place that specifies what they can and can’t do with any date collected.
Data breaches are a possibility when sharing data with a third party, so you need to be extra careful when it comes to handling.
