What is the purpose of this page?
As we are committed to the safety of our staff, patients, and visitors we use a closed-circuit television system (“CCTV”) at our surgery. The purpose of this document is to set out how the CCTV system will be managed and used by the practice and to inform individuals, whose personal data may be captured on the CCTV system, about how and why that personal data may be processed by the surgery.
Who collects the information?
The partners at Friary House Surgery are the data controllers of personal information collected about you. This means that we are responsible for deciding how we hold and use personal information about you and that we are required to notify you of the information contained in this Notice. It is important that you read this Notice so that you are aware of how and why we are using your personal information and how we will treat it.
Compliance
The surgery is aware that images of recognisable individuals, such as staff, patients, and visitors, captured by the CCTV system constitute ‘personal data’, use of which is governed by data protection law.
The surgery will ensure that its use of the CCTV system and the personal data that it captures complies with the law.
This document has been drafted in accordance with the Information Commissioner’s Office (ICO) CCTV Code of Practice and the Home Office Surveillance Camera Code of Practice. Copies of these codes can be found at www.ico.org.uk and www.gov.uk/government/publications/surveillance-camera-code-of-practice respectively.
Purpose of the CCTV system
The purpose of the CCTV system is:
- To increase the personal safety of our staff patients and visitors to our surgery.
- To assist in identifying, apprehending, and prosecuting any offenders on surgery premises.
- To protect the surgery building and assets and those of its staff from intrusion, theft, vandalism, damage, or disruption.
The legal basis for the surgeries use of any personal data which is captured by the CCTV system is that the processing is necessary for the carrying out of a Task in the public interest. The surgery may also need to use this personal data to establish, exercise or defend against legal claims.
Operation
CCTV cameras are located at strategic points on our premises, primarily access points, such as the entrances to the surgery and in the reception area, CCTV cameras are not placed in any clinical areas. Signs are displayed prominently around the building to inform staff and visitors that CCTV cameras are in operation and who to contact for further information.
The cameras are in operation 24 hours a day, 7 days a week and record the images taken. The system is not monitored but may be viewed in the case of an incident occurring, requiring such a viewing.
The CCTV system is regularly maintained in accordance with the manufacturer’s instructions.
Security
Physical protective measures: The CCTV system is kept in the locked server room.
Technical protective measures: Access to the system is by way of password protection and only senior management staff has the necessary access to the system. All access to the CCTV system is logged.
We have put in place procedures to deal with any suspected personal data breach and will notify any affected individuals and/or the ICO where appropriate.
Access and disclosure
Access to recorded CCTV footage is restricted to a limited number of senior staff as authorised by the Managing Partner from time to time (“Authorised Persons”) and all requests for disclosure of CCTV footage must be submitted to one of these Authorised Persons.
CCTV footage may only be accessed or disclosed to the extent necessary in order to deal with an incident which falls within the purpose identified above or in order to respond to a request made by an individual under the law (see further below). CCTV footage will not be accessed or used for any other purpose.
CCTV footage will be viewed in a secure office and any access to and any disclosures of recorded footage will be recorded in the CCTV log. This process is overseen by the Managing Partner and as appropriate, with reference to the Data Protection Officer.
External disclosure of CCTV footage will usually not be permitted other than to law enforcement agencies or to regulators, or in order to comply with a court order. CCTV footage will not be uploaded to the internet.
Training
All staff who may be involved in the management or operation of the CCTV system will be trained in how to comply with this document and to ensure that the system is used in accordance with the law.
Information retention
The images captured by the CCTV System will not be stored for any longer than is required in order to achieve the purposes identified above. CCTV footage will automatically be deleted on a 30-day rolling basis, unless specific images are required in order to deal with an incident or in order to respond to a request by an individual made under the law (see further below).
Data subject’s rights
The GDPR provides the following rights for individuals:
- The right to be informed
The right to be informed covers some of the key transparency requirements of the GDPR. It is about providing individuals with clear and concise information about what you do with their personal data. These details are contained in the Privacy Notice published online and in hard copy. - The right of access
See section below - The right to rectification
The right to have erroneous data corrected or removed. - The right to erasure
- The right to restrict processing
This is the right to prevent data from being processed in a certain way. - The right to data portability
The right to have one’s personal data prepared in a format to allow the data subject to use it for another purpose - The right to object
Article 21 of the GDPR gives individuals the right to object to the processing of their personal data. This effectively allows individuals to ask you to stop processing their personal data. - Rights in relation to automated decision making and profiling.
Changes to this privacy notice
We reserve the right to update this Notice at any time, and we will provide you with a new Notice when we make any material updates. We may also notify you in other ways from time to time about the processing of your personal information.
Contacting us
Any queries or complaints about the CCTV system should be addressed to the Alison Shelton, Managing Partner, Friary House Surgery, 2a Beaumont Road, St Judes, Plymouth. Devon PL4 9BH. Or telephone (01752) 663138.
Updated: March 2022.