GDPR: Data Protection Policy - CCTV
CCTV & Access Control Policy
The Data Controller is Homerton College, Cambridge. Questions on this Statement should be addressed to the College’s Data Protection Officer, Homerton College, Cambridge, CB2 8PH. 01223 747180 - firstname.lastname@example.org
The scope of this policy covers
What data is processed, and why?
The College operates a CCTV and Access control system to record access and activity around the College grounds. The CCTV system records images of people around the site. It also reads and records Licence Plate numbers of vehicles accessing Harrison Drive. The Access Control System records door access data including:
- First Name
- Last Name
- Door Name
- Time and Date Accessed.
Where does the data come from?
Access Control Data is populated via The University of Cambridge’s CamSIS system and Kinetics software for students. Staff information is populated via New Starter forms received from Human Resources. Visitor information is populated from Kinetics Conference Management Software. CCTV camera data is recorded from the CCTV Cameras installed on site.
Sharing with Third Parties
In the case of a College incident being investigated. Access Control and CCTV footage may be shared with both The Police and College Officers. Retention of data CCTV footage is stored and automatically deleted after 28 days. Door data is retained for 12 months.
Rights of the Data Subject
Those whose personal data is recorded by these means – the data subjects – have the right: to ask for access to, rectification or erasure of their personal information; to restrict processing (pending correction or deletion); to object to communications; and to ask for the transfer of their personal information electronically to a third party (data portability).
Some of these rights are not automatic, and we reserve the right to discuss with the data subject why we might not comply with a request from them to exercise such rights.
If data subjects have questions or concerns about their personal information, or how it used, they are invited to speak to the Data Protection Officer at email@example.com.