CCTV and Body Worn Camera privacy notice

Why are we collecting your information?

We have CCTV systems in some of our premises used by members of the public, for the purposes of public and staff safety and crime prevention and detection. CCTV is also installed on the outside of some of our buildings for the purpose of monitoring building security and crime prevention and detection. Our staff also wear Body Worn cameras which are turned on when a potential incident is taking place.

Who do we collect your information from?

Directly from CCTV systems on premises and any recording done on body worn devices.

Who are we?

York Teaching Hospital Facilities Management Limited Liability Partnership (LLP) is a ‘Data Controller’, this means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation.

The LLP has appointed Rebecca Bradley (Head of Information Governance at York and Scarborough Teaching Hospitals NHS Foundation Trust) to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the Trust is compliant with Data Protection legislation and to oversee data protection procedures.

The DPO contact details are

York and Scarborough Teaching Hospital NHS Foundation Trust
York Hospital
Wigginton Road
York
North Yorkshire
YO31 8HE
yhs-tr.Information.Governance@nhs.net

What Information are we collecting?

Visual images via CCTV monitoring and body worn camera images and sound recording associated with body worn devices.

Some CCTV cameras also collect thermal imagery, which detects changes in infra-red and triggers a pre-recorded audio message upon the detection of a cigarette approaching a person’s mouth, to deter smoking on Trust premises.

What is our lawful basis for processing your information?

Body Worn Cameras:

Article 6 (1)(e) processing is necessary for the performance of a task carried out in the public interest: As part of the NHS constitution staff should be able to work in a safe environment and members of the public are expected to treat staff with respect. Where this is breached the recordings safeguard staff, patients, and the public during violent and aggressive or anti-social behaviour incidents and provide evidence where required.

CCTV:

Article 6(1)(f) Legitimate interest: The overall purpose of CCTV is to help in crime prevention, investigation of crime, to protect Trust staff and visitors, and to protect Trust premises from criminal activities. A full legitimate interests assessment is available on request.

How long do we keep your information for?

Recordings are kept for 31 days on an encrypted Network Video Recorder, allowing adequate time for data requests to be processed if relevant. After the 31 days the data is automatically deleted.

If a viable data request has been processed for Body Worn Video evidence a copy of the data is kept physically on a DVD disc for 7 years in a secure restricted access cabinet.

Who do we share your information with?

• York and Scarborough Teaching Hospital NHS Foundation Trust
• Law enforcement agencies including the Police and the Serious Organised Crime Agency
• Local authorities
• Regulatory bodies, e.g. NMC, GMC

Do we transfer your information outside the UK?

This is not standard practice, and it would only be shared if necessary for legal purposes or if your consent has been given.

What rights do you have over your data?

Under GDPR data subjects have the following rights in relation to the processing of their personal data:

• to be informed about how we process your personal data. This notice fulfils this obligation
• to request access to your personal data that we hold, and be provided with a copy of it
• to request that your personal data is amended if inaccurate or incomplete
• to request that your personal data is erased where there is no compelling reason for its continued processing
• to request that the processing of your personal data is restricted
• to object to your personal data being processed

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO at the address provided above. To put in a Subject Access Request please contact: yhs-tr.cctv@nhs.net.

If we cannot resolve your concerns, you may also contact the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the Trust has handled your personal data. You can do so by contacting:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
casework@ico.org.uk // 0303 123 1113