1. Policy Statement
1.1. This policy seeks to ensure that the close circuit television (CCTV) system used at Exeter Rowing Club is operated in compliance with the law relating to data protection (currently the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (“DPA 2018”)) and includes the principles governing the processing of personal data. It also seeks to ensure compliance with privacy law.
1.2. It takes into account best practice as set out in cods of practice issued by the information commissioner and Home Office.
1.3. Exeter Rowing Club only uses CCTV where it is necessary in pursuit of a legitimate aim, as set out in clause 1.4, and only if it is proportionate to that aim
1.4. ERC seeks to ensure, as far as possible the security and safety of all members and visitors, its property, premises and equipment. Therefore, ERC uses CCTV to:
1.4.1. Promote a safe ERC community and monitor the safety and security of its premises;
1.4.2. Assist in the prevention, investigation and detection of crime;
1.4.3. Assist in the apprehension and prosecution of offenders, including the use of images as evidence in criminal proceedings;
1.4.4. Monitor equipment usages; and
1.4.5. Assist in the investigation of breaches of its codes of conduct and policies by members and where relevant and appropriate investigating complaints.
1.4.6. Allow members to view the conditions at the club remotely.
1.5. This policy will be reviewed annually by the Directors t oases compliance with clauses 1.1, 1.2, 1.3 and 1.4 and to determine if the used of the CCTV system remains justified.
2.1. This policy applies to CCTV systems operated by Exeter Rowing Club
2.2. This policy does not apply to any CCTV operated by other organisations at 62 Haven Road, or other locations associated with Exe Water Sports or ERC.
2.3. This policy applies to all ERC volunteers who operate the CCTV system.
3. Roles and Responsibilities
3.1. The Directors have overall responsibility for this policy, but have delegated day-to-day responsibility for the operation of the system to Management Committee
3.2. The Directors are responsible for ensuring that the CCTV system complies with the law and best practice.
4. System Description
4.1. The CCTV system is installed inside the boathouse
4.2. The cameras are set to record when motion is detected
4.3. CCTV cameras are not installed in areas in which individuals would have an expectation of privacy such as toilets, changing facilities etc.
4.4. CCTV Cameras are installed in such a way that they are not hidden from view. Signs are prominently displayed where relevant so that members and non-members are made aware they are entering an area captured by CCTV. The signs also contain contact details as well as a statement of purpose for which the CCTV is used.
4.5. The CCTV does not have a monitor attached and can only be viewed by logging in remotely to the system.
5. Covert Recording
5.1. The system is not designed for covert recording.
6. Operating Standards
6.1. The operation of the CCTV system will be conducted in accordance with this policy.
6.2. Processing of Recorded Images
6.2.1. CCTV images will be viewed or displayed only to persons authorised by the Directors to view them, or to other persons who otherwise have a right of access to them. Where authorised persons access or monitor CCTV images, they must ensure that images are not visible to unauthorised persons.
6.2.2. Users issued with access to the system must not share, or otherwise delegate access to the system to any other individual.
6.2.3. All access to the system is recorded against an individual user account. It is an individual’s responsibility that the use of the system, as identified by their account details, is compliant with this policy and legislation.
6.3. Quality of Recorded Images
6.3.1. Images produced by the recording equipment must be as clear as possible, so they are effective for the purpose for which they are intended. The standards to be met in line with the codes of practice referred to at clause 1 of the procedures are set out below:
- Recording features such as the location of the camera and/or date and time reference must be accurate and maintained;
- Cameras must only be situated so that they will capture images relevant to the purpose for which the system has been established;
- Consideration must be given to the physical conditions which the cameras are located.
- Cameras must be properly maintained to ensure that clear images are recorded; and
- As far as practical, cameras must be protected from vandalism or damage in order to ensure that they remain in working order.
6.4. Retention and Disposal
6.4.1. CCTV images are not to be retained for longer than necessary, taking into account the purposes for which they are being processed. Data storage is automatically managed by the CCTV digital records which overwrite historical data in chronological order
6.4.2. The exact length of retention varies as the cameras are motion-activated, and therefore when there is more activity at the club, more footage will be generated, increasing the need for data rotation and reducing the data retention period.
6.4.3. No data will be retained for greater than 12 months from the date of capture.
6.4.4. Provided that there is not a legitimate reason for retaining the CCTV images (such as for use in disciplinary and/or legal proceedings), the images will be erased following the expiration of the retention period.
7. Data Subject Rights
7.1. Recorded images, if sufficiently clear, are considered to be the personal data of the individuals (Data Subject) whose images have been recorded by the CCTV system.
7.2. Data subjects have the right of access to the personal data under the GDPR and DPA 2018. They also have other rights under the GDPR and DPA 2018 in certain limited circumstances, including the right to have their personal data erased, rectified, to restrict processing and to object to the processing of their personal data.
8. Third-Party Access
8.1. Third-party requests for access will usually only be considered in line with the GDPR and DPA 2018 in the following categories:
- Legal representative of the data subject
- Law enforcement agencies, including the police
- Disclosure required by law or made in connection with legal proceedings; and
- Officers of the club responsible for disciplinary and complaint investigations and related proceedings.
8.2. ERC will disclose recorded images to law enforcement agencies including the Police once in possession of a form certifying that the images are required for either: the prevention or detection of crime; in the apprehension or prosecution of offenders, and that the investigation would be prejudiced by failure to disclose the information. Where images are sought by other bodies/agencies with a statutory right to obtain information, evidence of that statutory authority will be sought before CCTV images are disclosed.
8.3. Every disclosure of CCTV images is recorded by the club. The following information should be recorded:
- The name of the relevant person/police officer receiving a copy of the recording
- Brief details of the images captured by the CCTV to be used in evidence or for the purposes permitted by this policy;
- The crime reference number, where relevant; and
- Date and time the images were provided to the third party.
9. Complaints Procedure
9.1. Any complaints relating to the CCTV system should be directed in writing to the Directors and within 7 days of the date of the incident giving rise to the complaint. The complaint will be dealt with in line with the club’s Complaints Policy.
9.2. Complaints in relation to the release of images should be addressed to the Directors as soon as possible and in any event no later than three months from the event giving rise to the complaint.