CCTV Policy:
This Policy will be made freely available for both staff and visitors to The Hunt Museum. A copy is available in Reception, on our website and in our Employee Handbook.
The Hunt Museum, as the data controller, has a registered address at Custom House, Rutland Street, Limerick, V94 8EVA. We are a not for profit organisation, registered in Ireland under Charity No. 10808. Telephone number: 016312833. If you have a question or concern regarding the impact on your privacy due to the use of CCTV, please contact Head of Operations info@huntmuseum.com or at the above address.
Purpose
CCTV is used by the organisation as part of the operational system for security. We wish to create a safe working environment and place of public assembly. We also wish to protect and safeguard our activities, assets and our building and CCTV is a vital and integral part of our security and safety procedures.
The intended effect is to capture clear images, capable of identifying individuals, which will only be used for the stated purposes. The benefits include providing a safe, monitored environment for all who engage with the building.
Legal Basis for Processing
The legal basis for processing is public interest. Creating a safe and secure environment for the public, members and staff of Outhouse.
Responsibility & Restricted Access
Overall responsibility for the organisation’s CCTV system lies with our Head of Operations Manager. Access rights to CCTV footage has been assigned to a restricted number of personnel who have been appropriately trained to view, playback and download footage. Otherwise, there is no access to the CCTV system and recorded material by The Hunt Museum staff.
The restricted number of staff with responsibility for processing CCTV images must only do so in line with established procedures and must always ensure the security of the data . Any employee who uses the CCTV system or CCTV images in an unauthorised manner may be subject to disciplinary action up to and including dismissal. All employees have a responsibility to adhere to this policy.
Retention
Recorded images are retained 31 days from the date of recording. However, the organisation reserves the right to retain images for a longer period where there are objective reasons for doing so such as a written request from An Garda Siochana or we have received a Subject Access Request to view footage.
15.5 Subject Access Request
All individuals have the right to access images containing their personal data. This applies equally to staff and members of the public. We would request that all requests to view footage are made in writing and addressed to the Head of Operations (details above). Careful consideration must be given to requests for access that would involve disclosing images of other individuals. Individuals requesting access to images must supply the organisation with the following:
– adequate information for the images to be located
– sufficient information/justification to verify a legitimate right to request access
– proof of identification, if necessary.
Individuals should specify whether they would be satisfied with merely viewing the images rather than requiring a copy. A request in relation to what personal data is stored will be responded to within 15 days explaining whether such data is kept and, if so, giving a description of the data and the purpose of keeping it. A copy of the personal data of the individual will be supplied within 30 days of the request.
Due to the anonymity we offer visitors and our strong privacy culture, there will be occasions that a request will be denied. On these occasions, we will log the request, purpose of request and reason for refusal. Then inform the individual of the reason. The data subject has the right to dispute this decision with the Irish Data Protection Commission.
Unauthorised Processing
Unauthorised use is any processing incompatible with the data’s original purpose including, but not limited to:
– disclosure of images containing personal data to an unauthorised third party, including other employees
– unauthorised processing of personal data in the form of copying the images on to a disk, website or print format
– circulation of images containing personal data by email or posting of images containing personal data on the internet
Access to and disclosure of images to third parties
Access to and disclosure of images recorded by the CCTV system is carefully restricted with limited access. Some circumstances for disclosure may include:-
– prevent, and investigate offence
– prevent injury or damage to property
– meet legal requirements
– obtain legal advice, or for the purpose of legal proceedings
– meet a request from, or with the consent of, the data subject, or a person acting on his or her behalf
Requests from An Garda Siochana must always be followed up by a written request on Garda headed paper confirming that An Garda Siochana are investigating a criminal matter. Gardaí are permitted to view footage on the premises. The organisation also reserves the right to disclose personal information to specific third parties where there are objective business reasons for doing so. Such third parties may include: insurance providers or medical practitioners.
Location & Signage
The organisation operates 6 external and 36 internal cameras. These operate on a 24-hour basis, seven days a week. Adequate signage is placed in the vicinity of each CCTV camera to indicate that CCTV is in operation.
Notification & Dispute
A copy of this CCTV Policy is available to all staff and Board members through the employee handbook and in the reception for members and visitors to The Hunt Museum.
We will only process your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however, you wish to raise a complaint regarding the processing of your personal data, please communicate in the first instance with our Head of Operations. If you are unsatisfied with how we have handled your information, you have the right to lodge a complaint with the Supervisory Authority (Irish Data Protection Commission) if you believe that we have not complied with this CCTV Policy and the GDPR regulations with regard to your personal data.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, D02 RD28, Ireland.