Elddis Transport (Consett) Limited – CCTV Policy

Elddis Transport (Consett) Limited – CCTV Policy

1. About this policy

1.1. Elddis Transport (Consett) Limited (“Elddis”, “we”, “us”) use closed-circuit television cameras and video surveillance to view and record individuals on and around our premises in order to maintain a safe environment for staff and visitors. We also use inward and outward facing dash cams, provided by Samsara Inc. (“Samsara”), in our fleet of vehicles to help prevent accidents and to protect our staff and the general public. Dash cam footage will also be used to help establish liability in the case of an accident. We refer to the closed circuit television, video surveillance and dash cam systems as “CCTV” in this policy.

1.2. We recognise that the images of individuals recorded by CCTV are personal data which must be processed in accordance with data protection legislation. As a controller, we have registered our use of CCTV with the Information Commissioner’s Office (“ICO”) and seek to comply with its best practice suggestions.

1.3. The purpose of this policy is to:

1.3.1. outline why and how we will use CCTV, and how we will process data recorded by CCTV cameras;

1.3.2. ensure that the legal rights of staff, relating to their personal data, are recognised and respected;

1.3.3. assist staff in complying with their own legal obligations when working with personal data. In certain circumstances, misuse of information generated by CCTV or other surveillance systems could constitute a criminal offence; and

1.3.4. explain how to make a subject access request in respect of personal data created by CCTV.

1.4. This policy does not form part of any contract of employment or other contract to provide services, and we may amend it at any time.

1.5. A breach of this policy may, in appropriate circumstances, be treated as a disciplinary matter. Following investigation, a breach of this policy may be regarded as misconduct leading to disciplinary action, up to and including dismissal.

2. Who does this policy apply to?

This policy applies to all employees, officers, consultants, self-employed contractors, casual workers, agency workers, volunteers and interns. It also applies to anyone visiting our premises or using our vehicles, and to members of the general public captured by outward facing dash cams.

3. Who is responsible for this policy?

3.1. The board of directors (“Board”) has overall responsibility for the effective operation of this policy. The Board has delegated responsibility for overseeing its implementation to Wayne White, Business Operations Manager. Suggestions for changes to this policy should be reported to Wayne White at wayne.white@elddis.net.

3.2. Any questions you may have about the day-to-day application of this policy should be referred to your line manager (if applicable) in the first instance, and then to Wayne White.

3.3. We will review the ongoing use of existing CCTV cameras in the workplace and in vehicles at least every twelve (12) months to ensure that their use remains necessary and appropriate, and that any surveillance system is continuing to address the needs that justified its introduction.

4. Definitions

For the purposes of this policy, the following terms have the following meanings:

“CCTV” means closed circuit television, video surveillance systems and dash cams designed to capture and record images of individuals and property.

“Controllers” are the people who, or organisations which, determine the manner in which any personal data is processed. They are responsible for establishing practices and policies to ensure compliance with the law. We are the controller of all personal data used in our business for our own commercial purposes.

“Data” is information which is stored electronically, or in certain paper-based filing systems. In respect of CCTV, this generally means video images. It may also include static pictures such as printed screen shots.

“Data subjects” means all living individuals about whom we hold personal information as a result of the operation of our CCTV (or other surveillance systems).

“Data users” are those of our employees whose work involves processing personal data. This will include those whose duties are to operate CCTV cameras and other surveillance systems to record, monitor, store, retrieve and delete images. Data users must protect the data they handle in accordance with this policy and our Data Protection Policy.

“Personal data” means data relating to a living individual who can be identified from that data (or other data in our possession). This will include video images of identifiable individuals.

“Processing” is any activity which involves the use of data. It includes obtaining, recording or holding data, or carrying out any operation on the data including organising, amending, retrieving, using, disclosing or destroying it. Processing also includes transferring personal data to third parties.

“Processors” are any person or organisation that is not a data user (or other employee of a controller) that processes data on our behalf and in accordance with our instructions (for example, a supplier which handles data on our behalf).

“Surveillance systems” means any devices or systems designed to monitor or record images of individuals or information relating to individuals. The term includes CCTV systems and dash cams, as well as any technology that may be introduced in the future such as automatic number plate recognition (ANPR), body worn cameras, unmanned aerial systems and any other systems that capture information of identifiable individuals or information relating to identifiable individuals.

5. Reasons for the use of CCTV

5.1. We currently use CCTV around our sites and warehouses, and in our fleet of vehicles as outlined below. We believe that such use is necessary for legitimate business purposes, including:

5.1.1. to prevent crime and protect buildings, warehouses and assets from damage, disruption, vandalism and other crime;

5.1.2. to monitor and track end customer’s assets stored and/or distributed by Elddis;

5.1.3. for the personal safety of staff, visitors and other members of the public and to act as a deterrent against crime;

5.1.4. to support law enforcement bodies in the prevention, detection and prosecution of crime;

5.1.5. to assist in day-to-day management, including ensuring the health and safety of staff and others;

5.1.6. to identify acts, omissions or negligent behaviour that might result in disciplinary proceedings, particularly regarding breaches of company policy or contracts of employment;

5.1.7. to assist in the effective resolution of disputes which arise in the course of disciplinary or grievance proceedings;

5.1.8. to establish liability in road traffic accidents involving our vehicles;

5.1.9. to allow real-time monitoring of driver fatigue and/or distraction and provide rapid responses to risks identified;

5.1.10. to investigate the circumstances surrounding insurance claims; and

5.1.11. to assist in the defence of any civil litigation, including employment tribunal proceedings;

This list is not exhaustive and other purposes may be or become relevant.

6. Monitoring

6.1. CCTV monitors:

6.1.1. our yards and the exterior of our buildings and both the main entrances and secondary exits of our buildings and warehouses 24 hours a day and this data is continuously recorded;

6.1.2. inside our warehouses, in particular (though not limited to) loading bays and areas in which forklifts, trailers and other mechanical handling equipment is in use, 24 hours a day and this data is continuously recorded; and

6.1.3. inward and outward facing cab cameras in our fleet of vehicles, which will be triggered when an ‘alert’ is raised by the cameras’ artificial intelligence technology (“AI”) which is able to recognise a harsh brake, harsh turn, harsh acceleration, mobile usage, inattentive driving, fatigue, close following distance from a vehicle ahead, crash and pre collision detection. When one of the triggers is detected a short 5-10 second clip will be available to key Elddis personnel on Samsara’s online portal. Where further requests for footage are made by key personnel, the length of the footage may be longer than the standard 5-10 second clip in order to establish the circumstances of the incident which triggered the recording.

6.2. Stationary camera locations are chosen to minimise viewing of spaces not relevant to the legitimate purpose of the monitoring. As far as practically possible, CCTV cameras will not focus on private homes, gardens or other areas of private property. Outward facing dash cams may from time to time capture footage of public and private spaces, but will for the most part capture public highways and roads for the purpose of road traffic accident prevention.

6.3. Surveillance systems will not be used to record sound.

6.4. Images are monitored by authorised personnel:

6.4.1. at our yards and building exteriors 24 hours a day, every day of the year;

6.4.2. inside our warehouses 24 hours a day, every day of the year; and

6.4.3. for dash cams via the Samsara online portal, usually during working hours but where an alert is raised on weekends or an incident requires immediate investigation, images can be accessed at any time.

6.5. Staff using surveillance systems will be given appropriate training to ensure they understand and observe the legal requirements related to the processing of relevant data.

7. How we will operate any CCTV

7.1. Where CCTV cameras are placed in the workplace, we will ensure that signs are displayed at the entrance of the surveillance zone to alert individuals that their image may be recorded. Where the surveillance system is within a vehicle we will ensure that stickers are used to indicate that this is the case. For Depot CCTV, the signs will contain details of the organisation operating the system, the purpose for using the surveillance system and who to contact for further information, where these things are not obvious to those being monitored. For vehicle CCTV, signs will inform drivers and passengers that CCTV recording is in operation. The purpose for the surveillance and details of the organisation operating the system and who to contact for more information will be communicated through email, on staff induction and reference to the data protection policy.

7.2. Live feeds from CCTV cameras will only be monitored where this is reasonably necessary, for example to protect health and safety.

7.3. In respect of the dash cams, footage will only be made available when an ‘alert’ is triggered (as detailed at paragraph 6.1.3 above). Requests for footage outside of those parameters will only be made when essential for further investigation of an incident. A request may be made for footage extending beyond 5-10 seconds where required in respect of an accident or incident.

7.4. We will ensure that live feeds from cameras and recorded images are only viewed by approved members of staff whose role requires them to have access to such data. This may include HR staff involved with disciplinary or grievance matters. Recorded images will only be viewed in designated, secure offices.

8. Use of data gathered by CCTV

8.1. In order to ensure that the rights of individuals recorded by the CCTV system are protected, we will ensure that data gathered from CCTV and dash cams is stored in a way that maintains its integrity and security. This may include encrypting the data, where it is possible to do so.

8.2. Given the large amount of data generated by surveillance systems, we may store video footage using a cloud computing system. We will take all reasonable steps to ensure that any cloud service provider maintains the security of our information, in accordance with industry standards.

8.3. We may engage data processors to process data on our behalf. We will ensure reasonable contractual safeguards are in place to protect the security and integrity of the data.

9. Retention and erasure of data gathered by CCTV

9.1. Data recorded by our CCTV systems will be stored on a local Network Video Recorder (“NVR”) hard drive located at each site. Where footage is retrieved and downloaded from the NVR will it be stored on Elddis Cloud storage systems managed by Microsoft. . Data from CCTV cameras will not be retained indefinitely but will be permanently deleted once there is no reason to retain the recorded information. Exactly how long images will be retained for will vary according to the purpose for which they are being recorded. For example, where images are being recorded for crime prevention purposes, data will be kept long enough only for incidents to come to light. In all other cases, recorded images will be kept for no longer than 104 days. We will maintain a comprehensive log of when data is deleted.

9.2. Depending on the image quality of video footage captured by our dash cams, between 40-60+ hours will be stored on each individual device. This footage will be continually overwritten once storage is full. Limited data will be uploaded to a secure, encrypted EU-based Amazon Web Services cloud instance (“Cloud Instance”) so that authorised personnel are able to review and manage video footage.

9.3. At the end of their useful life, all images stored in whatever format will be erased permanently and securely. Any physical matter such as tapes or discs will be disposed of as confidential waste. Any still photographs and hard copy prints will be disposed of as confidential waste.

10. Use of additional surveillance systems

10.1. Prior to introducing any new surveillance system, including placing a new CCTV camera in any workplace location, we will carefully consider if they are appropriate by carrying out a data protection impact assessment (“DPIA”) or by updating an existing DPIA.

10.2. A DPIA is intended to assist us in deciding whether new surveillance cameras are necessary and proportionate in the circumstances and whether they should be used at all or whether any limitations should be placed on their use.

10.3. Any DPIA will consider the nature of the problem that we are seeking to address at that time and whether the surveillance camera is likely to be an effective solution, or whether a better solution exists. In particular, we will consider the effect a surveillance camera will have on individuals and therefore whether its use is a proportionate response to the problem identified.

10.4. No surveillance cameras will be placed in areas where there is an expectation of privacy (for example, in changing rooms) unless, in very exceptional circumstances, it is judged by us to be necessary to deal with very serious concerns.

11. Requests for disclosure

11.1. We may share data with other group companies and other associated companies or organisations, for example shared services partners where we consider that this is reasonably necessary for any of the legitimate purposes set out above in paragraph 5.1. In exceptional circumstances, we may also share data with customers to evidence loading or delivery of goods has or hasn’t taken place. Where possible we will blur footage so that no personal data is contained.

11.2. No images from our CCTV cameras will be disclosed to any other third party, without express permission being given by the Board. Data will not normally be released unless satisfactory evidence that it is required for legal proceedings or under a court order has been produced.

11.3. In other appropriate circumstances, we may allow law enforcement agencies to view or remove CCTV footage where this is required in the detection or prosecution of crime.

11.4. We will maintain a record of all disclosures of CCTV footage, including the following:

11.4.1. date and time of disclosure;

11.4.2. name of person to whom the disclosure is made;

11.4.3. name of the person making the disclosure;

11.4.4. name of the Data subject the Personal data belongs to;

11.4.5. reason for disclosure; and

11.4.6. date and time the CCTV footage was returned.

11.5. No images from CCTV will ever be posted online or disclosed to the media.

12. Subject access requests

12.1. Data subjects may make a request for disclosure of their personal information and this may include CCTV images (“data subject access request”) orally or in writing. A data subject access request is subject to the statutory conditions from time to time.

12.2. In order for us to locate relevant footage, any requests for copies of recorded CCTV images must include the date and time of the recording, the location where the footage was captured and, if necessary, information identifying the individual.

12.3. We reserve the right to:

12.3.1. obscure images of third parties when disclosing CCTV data as part of a subject access request, where we consider it necessary to do so; and

12.3.2. supply stills of incidents taken from the CCTV images rather than the CCTV footage itself where either we consider it necessary in order to protect the rights of third parties included within the footage or where it is otherwise reasonable and proportionate to do so.

12.4. If we are unable to comply with the data subject access request, the requestor will be notified of the reason in writing.

13. Complaints

13.1. If any member of staff has any concerns about our use of CCTV, they should speak to the HR Department in the first instance.

13.2. Where this is not appropriate, or matters cannot be resolved informally, employees should use our formal grievance procedure.

13.3. If you have any issues with our processing of your personal information and would like to make a complaint, you may contact the Information Commissioner’s Office at ico.org.uk/concerns/ or telephone: 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AFC.

14. Requests to prevent processing

We recognise that, in rare circumstances, individuals may have a legal right to request erasure of personal data concerning them or to restrict the processing of their personal data. Any member of staff who considers that these rights apply to them in relation to our use of CCTV should speak to the HR Department in the first instance.