Outhouse, as the data controller, has a registered address at 105 Capel Street, Rotunda, Dublin, DO1 R290. We are a not for profit organisation, registered in Ireland under Charity No. 11815. Telephone number: 01-873-4999. If you have a question or concern regarding the impact on your privacy due to the use of CCTV, please contact David Hand, Operations Manager & Privacy Officer firstname.lastname@example.org or at the above address.
Closed Circuit Television System (CCTV) has been in place since 1997 and system was updated in 2019 to comply with new security regulations. This Policy was last reviewed and updated September 2019, following on from the results of a Data Protection Impact Assessment (DPIA). The outcome of the DPA was to ensure our CCTV system did not compromise the privacy of any individual. The organisation ensures that the use of CCTV is in line with requirements under Irish Data Protection regulations.
CCTV is used by the organisation as part of the operational system for security. We wish to create a safe working environment and place of public assembly. We also wish to protect and safeguard our activities, assets and our building. As a public building with over 500 public meetings, events and café footfall – we have over 50,000 visitors to our Resource Centre per year. CCTV is a vital and integral part of our security and safety procedures.
The intended effect is to capture clear images, capable of identifying individuals, which will only be used for the stated purposes. The benefits include providing a safe, monitored environment for all who engage with the building.
Legal Basis for Processing
The legal basis for processing is public interest. Creating a safe and secure environment for the public, members and staff of Outhouse.
Responsibility & Restricted Access
Overall responsibility for the organisation’s CCTV system lies with our Operations Manager & Privacy Officer. Access rights to CCTV footage has been assigned to a restricted number of personnel who have been appropriately trained to view, playback and download footage. Otherwise, there is no access to the CCTV system and recorded material by Outhouse staff.
The restricted number of staff with responsibility for processing CCTV images must only do so in line with established procedures and must always ensure the security of the data . Any employee who uses the CCTV system or CCTV images in an unauthorised manner may be subject to disciplinary action up to and including dismissal. All employees have a responsibility to adhere to this policy.
Recorded images are retained 42 days from the date of recording. However, the organisation reserves the right to retain images for a longer period where there are objective reasons for doing so such as a written request from An Garda Siochana or we have received a Subject Access Request to view footage.
Subject Access Request
All individuals have the right to access images containing their personal data. This applies equally to staff and members of the public. We would request that all requests to view footage is made in writing and addressed to Operations Manager & Privacy Officer (details above). Careful consideration must be given to requests for access that would involve disclosing images of other individuals. Individuals requesting access to images must supply the organisation with the following:
adequate information for the images to be located
sufficient information/justification to verify a legitimate right to request access
proof of identification, if necessary
Individuals should specify whether they would be satisfied with merely viewing the images rather than requiring a copy. A request in relation to what personal data is stored will be responded to within 15 days explaining whether such data is kept and, if so, giving a description of the data and the purpose of keeping it. A copy of the personal data of the individual will be supplied within 30 days of the request.
Due to the anonymity we offer visitors and our strong privacy culture, there will be occasions that a request will be denied. On these occasions, we will log the request, purpose of request and reason for refusal. Then inform the individual of the reason. The data subject has the right to dispute this decision with the Irish Data Protection Commission.
Unauthorised use is any processing incompatible with the data’s original purpose including, but not limited to:
disclosure of images containing personal data to an unauthorised third party, including other employees
unauthorised processing of personal data in the form of copying the images on to a disk, website or print format
circulation of images containing personal data by email or posting of images containing personal data on the internet
Access to and disclosure of images to third parties
Access to and disclosure of images recorded by the CCTV system is carefully restricted with limited access. Some circumstances for disclosure may include:-
prevent, and investigate offence
prevent injury or damage to property
meet legal requirements
obtain legal advice, or for the purpose of legal proceedings
meet a request from, or with the consent of, the data subject, or a person acting on his or her behalf
Requests from An Garda Siochana must always be followed up by a written request on Garda headed paper confirming that An Garda Siochana are investigating a criminal matter. Gardaí are permitted to view footage on the premises of Outhouse. The organisation also reserves the right to disclose personal information to specific third parties where there are objective business reasons for doing so. Such third parties may include: insurance providers or medical practitioners.
Third Party Processing
We have a Data Processing Agreement in place with our security system provider Dublin CCTV.
Location & Signage
The organisation operates two external and seven internal cameras. These operate on a 24-hour basis, seven days a week. Adequate signage is placed in the vicinity of each CCTV camera to indicate that CCTV is in operation.
Notification & Dispute
A copy of this CCTV Policy is available to all staff and Board members through the staff handbook and in the café/reception for members and visitors to the Resource Centre.
We will only process your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal data, please communicate in the first instance with our Operations Manager & Privacy Officer. If you are unsatisfied with how we have handled your information, you have the right to lodge a complaint with the Supervisory Authority (Irish Data Protection Commission) if you believe that we have not complied with this CCTV Policy and the GDPR regulations with regard to your personal data.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, D02 RD28, Ireland.