This page sets out our privacy notice related to closed circuit television (CCTV) data. It explains how we comply with General Data Protection Regulation (GDPR) regulations.
In accordance with General Data Protection Regulation (GDPR) which came into force on 25 May 2018, this notice sets out how Careers Wales processes data that is captured by CCTV (closed-circuit television) in our premises.
Where CCTV is in operation at a building this will be clearly indicated through signage.
We do not capture audio via the CCTV system.
Data Controller
Career Choices Dewis Gyrfa Ltd trading as Careers Wales is the data controller for the personal data we process. We are registered as a data controller with the Information Commissioner's Office (ICO), registration number: Z276256.
Purpose
The purpose of this privacy notice is to provide information about how we use, collect and share the data that we collect through CCTV.
1. Why we process the personal data
The purpose of processing personal data is:
- To help detect, deter and reduce crime
- Enhance the general security of our offices and assets
- To create a safer environment
- To enhance the health and safety of our employees and visitors to our buildings
- For safeguarding purposes
- To assist with complaints or concerns
- For the defence of insurance or legal claims
2. Our lawful basis for processing personal data
Our lawful basis for processing personal information is:
- Public Task, Article 6(e) – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- Data Protection Act, Schedule 1, Part 2,6 – Statutory and Government Purposes
- Data Protection Act, schedule 1, Part 2,10 – Preventing and detecting unlawful acts
- Data Protection Act, Schedule 1, Para 33 - Legal Claims
- Data Protection Act, Schedule 37 - Insurance Claims
- Legal Obligation, Article 6(c) – Processing is necessary for compliance with a legal obligation to which the controller is subject
- Legal Proceedings, Article 9(f) - GDPR processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
- Our basis for processing special category data is substantial public interest in processing this information for the purpose and detection of crime
3. Who and where we get the personal data from
We obtain the personal data directly from individuals whose image is captured by the CCTV system.
4. The categories of personal data we process
We collect static and moving images of people, this may result in the collection of sensitive data, known as special category data, such as an individuals ethnic or racial origin or possibly disability data. If there is a security issue it may result in the collection of criminal data.
5. Who we share personal data with
We do not regularly share any of our CCTV coverage with third parties but where there is a legal right to do so, we may share. The CCTV coverage will only be accessed by Careers Wales staff who are authorised to do so and with other departments where there is a legitimate and lawful reason for them to view the footage, such as HR in the event of an investigation.
We may on occasions be asked for footage by the police to help criminal investigations. We may also share with insurance companies.
We may share CCTV coverage with an individual in response to a subject access request. If there are other individuals in the footage we will ask for their consent to share. If we do not receive consent we will make a decision as to whether it is reasonable to share the information without consent.
6. How do we keep your personal data safe?
We have put in place appropriate security measures to prevent CCTV footage from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those of our employees who have a business need to know. We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
7. How long do we keep your personal data?
The CCTV images collected are deleted automatically after 30 days.
8. Individual rights
Under GDPR, you have the following rights in relation to the personal information you provide. Specifically you have the right:
- To access a copy of your own data
- For us to rectify inaccuracies in that data
- To object to or restrict processing (in certain circumstances)
- For your data to be ‘erased’ (in certain circumstances); and
- To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection.
The contact details for the Information Commissioner’s Office are Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 01625 545 745 or 0303 123 1113. www.ico.org.uk
9. Further Information
Careers Wales Data Protection Officer can be contacted in relation to data protection matters, by post at, Unit 4 Churchill House, 17 Churchill Way Cardiff CF10 2HH, Or Email: personal.data@careerswales.gov.wales