1. Policy Statement
1.1.The British Council School uses Close Circuit Television (“CCTV”) within its premises. The purpose of this policy is to set out the position of the British Council School as to the management, operation and use of the CCTV at its premises in c/ Solano (Pozuelo) and c/ Alfonso Rodriguez Santamaría (El Viso).
1.2.This policy applies to pupils, all members of our Workforce, contractors, visitors to the British Council School premises and all other persons whose images may be captured by the CCTV system.
1.3.This policy takes account of all applicable legislation and guidance, including:
1.3.1.Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, also referred to as General Data Protection Regulation (“GDPR”).
1.3.2.La Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (en adelante la “LOPD”).
1.3.3.Instrucción 1/2006 de la Agencia Española de Protección de Datos sobre el tratamiento de datos personales con fines de vigilancia a través de sistemas de cámaras o videocámaras (together, the “Data Protection Legislation”).
1.3.4.CCTV Code of Practice produced by the UK Information Commissioner (“ICO”)
1.3.5.Guidance on the use of CCTV for Security and other purposes, produced by the Agencia Española de Protección de Datos (“AEPD”)
2. Purpose of CCTV
2.1.The British Council School uses CCTV for the following specific, explicit and legitimate purposes and will not use CCTV footage for further processing.
2.1.1.To provide a safe and secure environment for pupils, staff, contractors and visitors.
2.1.2.For investigation of child protection related incidents.
2.1.3.To prevent the loss of or damage to the British Council School buildings and/or assets.
2.1.4.To assist in the prevention of crime and assist law enforcement authorities in apprehending offenders.
2.1.5.To assist in the supervision of compliance with H&S at work and the prevention of occupational hazards legal requirements.
2.1.6.To prevent violence, racism, xenophobia and intolerance in sports activities that take place at the British Council School.
3. Lawful basis
3.1.The lawful basis for the processing of CCTV images, for the purposes outlined in section 2 above, is to carry out these purposes in the public interest, as laid down by the following Spanish laws:
3.1.1.Ley 5/2014, de 4 de abril, de Seguridad Privada;
3.1.2.Ley Orgánica 1/1996, de 15 de enero, de Protección Jurídica del Menor, de modificación parcial del Código Civil y de la Ley de Enjuiciamiento Civil;
3.1.3.Ley 31/1995, de 8 de noviembre, de prevención de Riesgos Laborales, y
3.1.4.Ley 19/2007, de 11 de julio, contra la violencia, el racismo, la xenofobia y la intolerancia en el deporte.
4.1.Signs will be erected to inform individuals that they are in an area within which CCTV is in operation.
4.2.Transparent information about CCTV processing will be made available to individuals on request in the form of a written Privacy Notice in the all Security lodges.
5. Description of system
5.1.There are two CCTV systems in operation:
5.2.The Perimeter system covers the external perimeter and security lodges on the Pozuelo site.
5.3.The Internal system includes two standalone systems which cover a) internal areas within the Pozuelo site b) external doors and internal areas on the El Viso site (Internal).
5.4.Each system is installed on a separate local area network, not accessible externally.
6. Siting of cameras
6.1.Proportionality will be taken into account prior to considering CCTV in any School area, as well as in the number of CCTV cameras to be used and their type, whether fixed, mobile or dome cameras.
6.2.All CCTV cameras will be sited in such a way as to meet the purpose for which the CCTV is operated. Cameras will be sited in prominent positions where they are clearly visible to staff, pupils and visitors.
6.3.Cameras will not be sited, so far as possible, in such a way as to record areas that are not intended to be the subject of surveillance. The British Council School will make all reasonable efforts to ensure that external CCTV will capture the minimum necessary street area to meet the established purposes
6.4.Cameras will not be sited in areas where individuals have a heightened expectation of privacy, such as changing rooms, toilets or classrooms.
7. Privacy Impact Assessment (PIA)
7.1.CCTV was in place at the British Council School before the GDPR introduced the requirement to conduct a PIA. This will therefore be carried out retrospectively during the first half of academic year 2018-19 to ensure that the installation is compliant with legislation, ICO guidance and Spanish AEPD guidance.
7.2.The British Council School will adopt a privacy by design approach when installing new cameras and systems, taking into account the purpose of each camera so as to avoid recording and storing excessive amounts of personal data.
8. Management and access
8.1.The Perimeter CCTV system will be managed by the School´s Security Contractor as a British Council supplier and data processor, with all the appropriate contractual safeguards required by data protection legislation.
8.2.The Internal CCTV system will be managed by the School´s IT contractor as a British Council supplier and data processor, with all the appropriate contractual safeguards required by GDPR.
8.3.CCTV will not be connected to an external central alarm receiver (CAR) or an external control centre without a prior review of the proposed setup.
8.4.On a day to day basis the internal CCTV system will be operated by School IT contractor
8.6.Perimeter system - the viewing of live CCTV images will be restricted to security guards, facilities team, school senior management.
8.7.Internal system – live images of external doors monitored by the Receptionist of the El Viso centre. No other live images are monitored -
8.8.Recorded images stored by the Perimeter and Internal CCTV systems will be restricted to access by School Senior Management team, Facilities team and/or DPO or DP manager.
8.9.No other individual will have the right to view or access any CCTV images unless in accordance with the terms of this policy as to disclosure of images.
8.10.The Perimeter and Internal CCTV systems are checked weekly by School IT Contractor and the external CCTV system is checked daily by School Security Contractor to ensure that they are operating effectively.
9. Storage and retention of images
9.1.Any images recorded by the CCTV system will be retained for the maximum period of 30 days as established by Spanish law.
9.2.The thirty-day period will be reduced to fifteen days, where footage involves images of minors.
9.3.Images will only be retained for longer when they are required for an ongoing investigation, meeting the legal requirements established by Spanish law and, in particular, making them available to law enforcement authorities within the established legal timeframe.
9.4.In this case, and only with the explicit approval of the Head of School and/or DPO or DP Manager, images will be retained for the duration of the investigation and judicial proceedings.
10. Security Measures
10.1.The British Council School will ensure that appropriate security measures are in place to prevent the unlawful or inadvertent disclosure of any recorded images. The measures in place include:
10.2.CCTV recording systems being located in restricted access areas;
10.3.The CCTV system being encrypted/password protected;
10.4.Restriction of the ability to make copies to specified members of staff (System Administrator)
10.5.All CCTV equipment configured with robust access control systems
10.6.Monitors for viewing CCTV images are located at secure rooms such as IT Dpt., Security lodges and the School boardroom.
10.7.Logs of any access to the CCTV images, including time and dates of access, and a record of the individual accessing the images, are kept for a period of three months and are maintained by the British Council School.
11. Disclosure of images to data subjects
11.1.Any individual recorded in any CCTV image is a data subject for the purposes of the Data Protection Legislation and has a right to request access to those images.
11.2.Any individual who requests access to images of themselves will be considered to have made a subject access request pursuant to the Data Protection Legislation. Such a request should be immediately addressed to email@example.com to be dealt with following the appropriate process.
11.3.When such a request is made, the Head of School and DPO or DP Manager will review the CCTV footage, in respect of relevant time periods where appropriate, in accordance with the request.
11.4.If the footage contains only the individual making the request, then the individual may be permitted to view the footage. This must be strictly limited to that footage which contains only images of the individual making the request. The System Administrator will take appropriate measures to ensure that the footage is restricted in this way.
11.4.1.If the footage contains images of other individuals, then the British Council School must consider whether the request requires the disclosure of the images of individuals other than the requester.
11.4.2.If footage contains images of minors, the protection of their rights and freedoms will prevail. If disclosure is necessary, this will only be allowed if images can be distorted to prevent the identification of other individuals, or if the other individuals in the footage, or their parents/guardians in case of minors, have consented to the disclosure of the images.
11.5.A record must be kept, and held securely, of all disclosures which sets out:
11.5.1.When the request was made;
11.5.2.the process followed by School Senior Manager and the DPO or DP Manager in determining whether the images contained third parties;
11.5.3.the considerations as to whether or not to allow access to those images and the reasons that justify the rejection;
11.5.4.the individuals that were permitted to view the images and when;
11.5.5.whether a copy of the images was provided, and if so to whom, when and in what format.
12. Disclosure of images to third parties
12.1.The British Council School will only disclose recorded CCTV images to third parties where it is permitted to do so in accordance with the Data Protection Legislation.
12.2.CCTV images will only be disclosed to law enforcement authorities in line with the purposes for which the CCTV system is in place.
12.3.If a request is received from a law enforcement authority for disclosure of CCTV images, then the Head of School and/or DPO or DP Manager must follow the same process as above in relation to subject access requests. In these cases, the British Council School will ensure that the request is an adequately reasoned request and that the disclosure of images is proportionate to the purpose of the request.
12.4.The information above must be recorded in relation to any disclosure.
12.5.If an order is granted by a Court for disclosure of CCTV images, then this should be complied with. However very careful consideration must be given to exactly what the Court order requires. If there are any concerns as to the disclosure, then the Council’s Information Governance Risk Advisor Iberia should be contacted in the first instance and appropriate legal advice may be required.
13. Review of policy and CCTV system
13.1.This policy will be reviewed every two years, and in any case, whenever there is a change in Data Protection Legislation.
13.2.The CCTV system and the privacy impact assessment relating to it will be reviewed every two years and, in any case, whenever there is a change in the installation/configuration of the system.
14. Misuse of CCTV systems
14.1The misuse of CCTV system could constitute a criminal offence.
14.2.Any member of staff who breaches this policy may be subject to disciplinary action.
15. Complaints relating to this policy
15.1.Any complaints relating to this policy or to the CCTV system operated by the British Council School should be made in accordance with the British Council School Complaints Policy.
16. Rights of the data subjects
16.1.Individuals have the right to ask us what information we hold about them (in the terms established in section 11 above) or, where appropriate, to request erasure when this personal information is no longer necessary for the purposes for which it was collected. In certain circumstances, individuals may also request the restriction of processing or object to such processing.
16.2.These rights can be exercised by contacting firstname.lastname@example.org, including identification documentation. There is a thirty-day period to address and answer the request from the date it is received.
16.3.The documentation provided for in paragraph 4.2 above shall contain information for data subjects of their rights, as well as the possibility of bringing a claim to the Spanish Data Protection Agency (as the supervisory authority) if they consider that their rights have not been adequately addressed by the Data Controller.
Adopted: October 2018 Review date: October 2020