Policy Approval Date: 25/09/2014 Guidance Document: CCTV Policy Title: Guidance Document: CCTV Policy Doc No: Issue: 1 Date: August 2014 1. Introduction 1.1 This policy explains the purpose, use, and management of the CCTV installations at the University of Westminster. 1.2 The purposes of the CCTV installations are: the protection of staff, students, visitors, and the assets of the University; the prevention, investigation and detection of crime and disciplinary offences in accordance with the University disciplinary procedures; the apprehension and prosecution of offenders (including the use of images/data as evidence in criminal / civil proceedings); the monitoring of the security of premises. 1.3 The principles of the policy are: that individuals' rights are respected and protected; that the installations are operated fairly and within the law; that the CCTV system is operated for the purposes for which it was set up; that the recorded material/data stored is fairly and lawfully processed; that recorded material/data is adequate, relevant and not excessive for the purposes; that recorded material/data is accurate, securely stored, and not kept for longer than is necessary. 1.4 This policy and its operations will be subject to regular reviews and audits, no less than every two years. 1.5 This policy is supported by the CCTV Operational procedures (see appendix C). 2. CCTV System overview and definitions 2.1 The CCTV system includes approximately 480 cameras over 13 buildings. 2.2 The systems will be operated 24 hours per day, 365 days of the year. Page 1 of 12
Policy Approval Date: 25/09/2014 2.3 The CCTV installations comprise all fixed cameras, printer monitors, signs, recording and playing equipment, information, material, data, and any ancillary equipment required for the operation of the installations (e.g. cabling, printers, power supplies). 2.4 Recorded material/data means any material recorded by the installations, either in digital or analogue form on video cassette tape, PC computer system tape, hard copy print, or any document copy. The recorded material/data are the property of the University of Westminster. 2.5 The systems will be maintained on behalf of the University by NT Security and Link CCTV Systems and ensure compliance with the Data Protection Act 1998. 2.6 The security contractor, CIS Security, has authority to operate the CCTV equipment and will ensure compliance with this policy and the Data Protection Act 1998. 3. CCTV Owners 3.1 The CCTV surveillance system is owned by the University of Westminster. 3.2 The Director of Estates & Facilities is the responsible person for the management and operation of the system, with nominated individuals given authority to manage the day-to-day operations and ensure strict compliance with this policy. 3.3 The University s Information Compliance team have ensured this policy complies with the Data Protection Act 1988. For any Data Protection queries please email: DPA@westminster.ac.uk. 4. Data Protection Act 1998 4.1 The University's CCTV installations will be registered under the Data Protection Act 1998 and all release of information will be in accordance with the registration. 4.2 An exemption to the provisions of the Data Protection Act 1998 covers the disclosure of information for the purposes of: Preventing or detecting crime Apprehending or prosecuting offenders Assessing or collecting any tax or duty This exemption applies only where non-disclosure would be likely to prejudice one of these purposes. 4.3 For the purpose of the Data Protection Act 1998 the University of Westminster is the data controller. 5. Access to images 5.1 The ability to review recorded and live images is limited to authorised staff personnel only: namely: Site Security Manager Deputy Site Security Manager Front of House Manager Page 2 of 12
Policy Approval Date: 25/09/2014 Front of House Supervisor Residential Manager (Halls of Residence only) Department Manager Sports Ground Manager (Chiswick only) 6. Applications to review images 6.1 University staff, students and other individuals using the University premises (e.g. visitors, contractors etc) may apply to have CCTV footage reviewed. 6.2 The request must be made in writing using the Application Form within Appendix A and detail: The date, time and location The reason for the request (which must comply with the purposes as laid out in 1.1 of this policy) 6.3 All requests should be made within 10 working days of the recording to ensure footage is not erased. 7. Retention and disposal 7.1 Unless required for evidential purposes or the investigation of a crime or otherwise required by law, recorded images will be retained for no longer than 30 days from the date of recording. 7.2 At the end of their useful life all images on discs will be erased and securely disposed of. 8. Complaints Procedure and Enquiry Service 8.1 For any complaints regarding CCTV the usual complaints procedure applies. Complaints by students should go through the standard student complaint procedure whilst non-students should use the form featured in Appendix B. 8.2 For general enquiries in relation to CCTV and this policy please email: CCTV@westminster.ac.uk. 9. Relevant documents Complaint Form (appendix B) CCTV procedures (appendix C) Page 3 of 12
Policy Approval Date: 25/09/2014 Appendix A REQUEST TO REVIEW CCTV FOOTAGE This form should be used for routine requests for access to view CCTV images by individuals whose images have been captured and/or uniformed police in response to incident which occurred on the same day e.g. to assist in a specific criminal enquiry, identify a victim, witness or perpetrator in relation to a criminal incident. This form should not be used where the police or other law enforcement agencies request a copy of CCTV images. A Section 29 request should be made under the Data Protection Act 1998 for this type of access. Please refer to the Information Compliance team email: dpa@westminster.ac.uk This form should not be used by an individual whose images has been recorded requests a copy of CCTV images relating to themselves. A subject access request under the Data Protection Act 1998 is required for this type of access. Please refer to the Information Compliance team at the address above. To be completed by the Applicant Name: Staff/Student number: Email address: Date of CCTV footage to be viewed: Time of CCTV footage to be viewed: Location of CCTV footage to be viewed: Reason for request: This form must be sent to: cctv@westminster.ac.uk Page 4 of 12
Policy Approval Date: 25/09/2014 To be completed by an authorised member of the Estates & Facilities staff. This document forms part of the CCTV footage viewing log. CCTV reviewed on: CCTV reviewed by (name and position): Camera number viewed: Time period of footage viewed: Action taken/findings: Signature: Page 5 of 12
Policy Approval Date: 25/09/2014 Appendix B FORMAL COMPLAINTS FORM This form should be used by non-students who wish to complain about the University facilities/service received. Students wishing to raise a formal complaint should do so at: http://www.westminster.ac.uk/study/current-students/your-studies/forms-and-procedures/complaints Your details Full name Address for correspondence* (include postcode) Daytime number*: Email address*: * You must provide one method of contact Your complaint Please summarise the details of your complaint: Who did you approach to resolve your complaint Page 6 of 12
Policy Approval date: 25/09/2015 informally and what action was taken? How do you propose that your complaint could be resolved to your satisfaction? Signed: Print name: Dated: Completed forms should be returned to: Sarah Thomas Department Manager Estates & Facilities University of Westminster 101 New Cavendish Street London W1W 6XH Email: estatesadmin@westminster.ac.uk Page 7 of 12
Operational Processes Approval date: 25/01/2016 Appendix C Guidance Document CCTV Operational Processes Title: CCTV Operational Processes Doc No: Issue: 2 Date: 25 January 2016 1. Introduction 1.1 These procedures sit alongside the University s CCTV Policy. 1.2 These processes explain the operational management of the University s CCTV system. 1.3 These processes will be subject to regular reviews and audits, no less than every two years and will be reviewed in conjunction with the CCTV policy. 2. Installation of cameras 2.1 CCTV systems will not be installed or operated on University property other than for the purposes detailed in Section One of the CCTV policy. 2.2 The location of CCTV cameras will be determined by the Estates & Facilities department, with advice from the Safety, Health and Well-being team as appropriate. In addition periodic security specialist audits will be carried out to determine appropriate coverage. 2.3 No CCTV cameras are allowed to be installed without agreement with the Estates & Facilities department. Should a member of staff, department etc believe they require additional CCTV coverage they should complete the Request for Additional CCTV form located at the end of these procedures. 2.4 Each area of the University building/premises monitored by CCTV systems will be identified by a sign/notice in the approved format. 3. CCTV Equipment 3.1 The CCTV equipment installations shall be fit for the purposes detailed in section 1 of the CCTV policy. 3.2 The Equipment will perform properly and provide clear images/data. 3.3 The equipment which records material/data and features location of the camera and/or date and time references will be accurate. A minimum of a weekly check on date/time references to be undertaken by appropriate Security personnel. Page 8 of 12
Operational Processes Approval date: 25/01/2016 3.4 The CCTV recorded images will be recorded continuously in time-lapse mode, capturing images/data every few seconds or at times when movement occurs within the frame. 3.5 A daily log (Faulty CCTV Camera Log) will be kept and maintained by the Security Contractor highlighting any faulty cameras or where images/data recorded is inaccurate. This log must be passed to the Estates & Facilities helpdesk for action. 3.6 The CCTV installations will be maintained in compliance with manufacturers' recommendations by a specialist company under contract to the University. Any selected contractor must demonstrate its company procedures are in full compliance with the Data Protection Act 1998. 3.7 These maintenance checks will in particular provide an assessment that the equipment is functioning at its optimum performance and that its location time/data referencing information (where this facility is provided) is accurate. 4. Recording equipment and material 4.1 Recording equipment will be located in a secure room where access is limited to: Authorised Estates & Facilities staff The Systems Operating Company staff - NT Security and Link CCTV Systems The Security Contractor CIS Security Specialist editing company staff, as required 4.2 When data is being viewed, access by other personnel will be refused. 4.3 Access to the CCTV recording equipment by these and any other persons will be documented and such records kept for a twelve (12) month period. 4.4 Digital Video Recorders (DVRs) record continuously and are overwritten after a minimum of 28 days. Any CCTV footage request (see below) must be isolated and separately stored electronically for the purpose of any investigation. 5. Access To and Review and Viewing of CCTV Recorded Material 5.1 The viewing and initial reviewing of CCTV recorded material is restricted to only authorised University employees and security contractors and will only be for the purposes outlined in the CCTV policy. 5.2 Authorised staff can, after review, securely transfer copies of requested images to the leader of an internal investigation, for use only in that investigation, 5.3 Or transfer copies of requested images externally to an agency involved in the investigation or prevention of a crime or taxation matter or to a legal representative in a criminal or civil proceedings. For example to the police or similar agencies or to solicitors involved in a legal proceeding. External requests of this nature should be reported and agreed with the Information Compliance Team at dpa@westminster.ac.uk 5.4 The leader of an internal University investigation can request that CCTV footage be reviewed by sending the details of their investigation and request to cctv@westminster.ac.uk 5.4 An authorised member of staff will then review relevant footage and advise the leader of the investigation and manage the transfer of any relevant images as above. 5.5 All CCTV viewings, reviews, image copying and transfers should be logged and recorded in Page 9 of 12
Operational Processes Approval date: 25/01/2016 local CCTV management logs. 5.6 Any requests by any individual to have access to or copies of images of themselves captured in CCTV images should be managed as a potential DPA Subject Access Request. Such requests should be considered and managed in consultation with the information compliance team by contacting dpa@westminster.ac.uk 5.7 When considering transferring CCTV images to support an internal investigation, an external request or a Subject Access Request, it may be necessary to 'mask out' identifiable individuals captured in images who are not related to the investigation or request, and who have a right to continued privacy. Specialist technical intervention should be undertaken under the direction of authorised University employees or their security contractors to ensure that no unintentional disclosure of personal information of this kind occurs in the transfer of any CCTV copy images to an internal investigation, external requestor or individual as part of a DPA Subject Access Request. 6. Access To and Review and Viewing of CCTV Recorded Material Female Prayer Rooms 6.1 In addition to section 5 above, the viewing and initial reviewing of CCTV recorded material from Female Prayer rooms is restricted to ONLY authorised and designated FEMALE University employees and FEMALE security contractors, and again will be only for the purposes outlined in the CCTV policy. 6.2 Access to images and authorisation to view or review images MUST first be agreed with one of the following University senior staff, in order of availability: A) Registrar B) Director of Communications Recruitment & External Affairs C) Head of Information Security and Compliance 7. Training 7.1 The University will provide appropriate training for all staff to cover awareness of data protection and information security matters and specific training for all authorised CCTV managers, CCTV operators and security staff in the correct application of agreed CCTV policy and operational procedures. Page 10 of 12
Operational Processes Approval date: 25/01/2016 REQUEST FOR ADDITIONAL CCTV INSTALLATION Name of requestor: Faculty/Department: Date of request: Area identified for additional camera(s): Reason(s) for additional camera(s): For Estates & Facilities use Approximate cost of installation (including equipment): Reason for approval/rejection (delete as appropriate): Name: Date: Page 11 of 12
Operational Processes Approval date: 25/01/2016 FAULTY CCTV CAMERA LOG Campus location Faulty camera number Faulty camera position Type of defect (i.e. unclear image; inaccurate date and time etc) Date defect reported Name of Security Officer noting defect Date rectified Page 12 of 12