CCTV and other surveillance systems installed on these premises have a legitimate role to play in helping to maintain a safe and secure environment for all our staff and visitors. However, we recognise that images recorded by surveillance systems are personal data which must be processed in accordance with data protection laws, raising concerns about the effect on individuals and their privacy. We are committed to complying with our legal obligations and ensuring that the legal rights of staff, relating to their personal data, are recognised and respected and this policy is intended to address such concerns.
This policy is also intended to assist staff in complying with their own legal obligations when working with personal data. In certain circumstances, misuse of information generated by CCTV or other surveillance systems could constitute a criminal offence.
For the purposes of this policy all capitalised terms shall have the meaning attributed to them by the Data Protection Act (Chapter 586 of the Laws of Malta). The Data Controller of all personal data gathered through the use of CCTV within these premises is GVZH Advocates, a civil partnership regulated by Maltese law, having its place of business at 192, Old Bakery Street, Valletta VLT 1455 (hereinafter “GVZH”).
About this Policy
We currently use CCTV cameras to view and record individuals on and around our premises. GVZH operates in 192, Old Bakery Street, Valletta (hereinafter the “Premises”). This policy outlines why we use CCTV, how we will use recorded CCTV footage and how we will process data recorded by CCTV cameras in order to ensure that we are compliant with data protection law and best practice at all times. This policy also explains the procedure to be followed for the submission of a data subject access request in respect of personal data captured by the CCTV surveillance systems operated by GVZH.
The policy applies to all GVZH Advocates staff and employees as well as on all other persons who may, from time to time, and for whatever purpose, enter the Premises for any reason whatsoever. The legal basis for our CCTV surveillance systems is the safeguarding of the legitimate interests of GVZH, its personnel and its property, and may be shared between GVZH Advocates GVZH Services and GVZH Trustees Limited.
Reasons for the use of CCTV
The key objectives of our CCTV surveillance systems are:
- To detect, prevent and reduce the incidence of crime or unwanted behavior on our premises;
- To reduce and/or intercept incidences of vandalism and damage to the Premises or personal property;
- To enhance the feeling of personal safety and security; and
- To enable the identification and subsequent apprehension and prosecution of offenders in relation to any crimes actually committed within the proximity of our premises.
It is the responsibility of GVZH:
- To ensure compliance with this Policy.
- To ensure that the operating procedures for all cameras are complied with at all times.
- To ensure that the purposes and objectives of all schemes are fulfilled.
- To coordinate the installation of the necessary signage to indicate that the Premises are under CCTV surveillance and that a CCTV scheme is in operation.
- To facilitate formal subject access requests of any images captured under the terms of the GDPR and Data Protection Act and other relevant legislation.
- To provide copies of this Policy when required to do so.
CCTV monitors are operated 24 hours a day and this data is continuously recorded. Camera locations are chosen to minimise viewing of spaces not relevant to the legitimate purpose of the monitoring.
We ensure that signs are displayed prominently at all times in each surveillance zone within the Premises to alert individuals that their image may be recorded. Such signs will contain details of the Data Controller, the purpose for using the surveillance system and who to contact for further information, where these things are not obvious to those being monitored.
We ensure that live feeds from cameras and recorded images are only viewed by approved members of staff whose role requires them to have access to such data. This may include Partners of the firm, the reception desk, management and HR staff involved with disciplinary or grievance matters. Recorded images will only be viewed in designated, secure offices.
Data Subject Access Requests
Data subjects may make a subject access request for CCTV images/recordings/information by applying in writing to the Data Protection Officer at email@example.com and must provide the following information:
- The date and time of the incident or their visit to the premises, along with details relating to the specific location on such Premises; and
- Proof of identity (containing a photograph).
GVZH will aim to provide access to CCTV images as soon as possible but will ensure it is provided within one month from receiving the written request. GVZH will provide the information in a clear format that is easily understood and suitable for the requester’s needs. GVZH may request further details to clarify the exact requirements prior to the start of the one-month period.
GVZH has the right to refuse a request for a copy of the data particularly where such access could prejudice the prevention or detection of crime or the apprehension or prosecution of offenders. If it is decided that a data subject access request is to be refused, the reasons will be fully documented, and the data subject informed in writing, stating the reasons within one month of the receipt of the request.
CCTV footage will be accessible by a restricted number of GVZH staff identified for this purpose. CCTV footage will not be disclosed to any third party other than law enforcement authorities should this be required. No other third parties should have access to such data, unless with the express permission of the Data Protection Officer.
Use of CCTV systems for any reason other than that authorised in accordance with this policy is not permissible at any time or circumstance due to Data Protection purposes.
Furthermore, a data subject has the right to request GVZH to erase personal data or restrict processing, object to processing and the right to data portability by applying in writing to the GVZH Data Protection Officer at firstname.lastname@example.org.
Retention of CCTV Footage
CCTV footage shall be retained for 7 days. In certain circumstances it may be considered appropriate to retain data for a longer period, a full risk assessment must be taken before making a decision for a longer retention period.
Grievances and complaints regarding the operation of the GVZH CCTV system must be made in writing and addressed to the Data Protection Officer at email@example.com.
Furthermore, a data subject has the right to complain to the Data Protection Commissioner about our processing activities, using the following contact details:
Office of the Information and Data Protection Commissioner
Sliema SLM 1549
Phone: (+356) 2328 7100
Ongoing Review of CCTV Use
We will ensure that the ongoing use of existing CCTV cameras in the workplace is reviewed periodically to ensure that their use remains necessary and appropriate, and whether or not such surveillance systems continue to address the needs that justified their introduction.