We have installed a CCTV system in our surgery. Here’s some more information about it.

Introduction

Closed circuit television (CCTV) is installed at the practice premises for the purposes of staff, patient and premises security. Cameras are located at various places on the premises, and images from the cameras are recorded. The use of CCTV falls within the scope of the Data Protection Act 2018. This code of practice follows the recommendations issued by the Data Protection Commissioner in accordance with powers under Section 51 (3)(b) of the 1998 Act.

Why We Have Installed CCTV

• Ensure the safety of patients, personnel and property.
• Reduce costs of vandalism and tipping around the surgery.
• Reduce costs of theft or damage to expensive medical equipment and other valuable assets.
• Protect staff and patients by deterring and resolving disruptive and violent behaviour in waiting rooms and other public access zones.

In order to comply with the requirements of the act, data must be:

• Fairly and lawfully processed.
• Processed for limited purposes and not in any manner incompatible with those purposes.
• Adequate, relevant and not excessive.
• Accurate.
• Not kept for longer than is necessary.
• Processed in accordance with individuals’ rights.
• Secure.

The Practice’s CCTV Policy

CCTV is in place in the front and side entrance/ corridor, reception and the staff car park/ally way leading to the disable surgery entrance.

CCTV has been installed solely for the safety and security of our patients and staff.

Images are recorded 24 hours a day, seven days a week and stored on the hard drives of the recording devices. The recording devices are situated in reception and only the manager and partners of the practice have access to the recordings. The manager regularly checks that the CCTV devices are working as intended.

All CCTV recordings are stored on our recording devices/ hard-drives for 30 days before being deleted.

Retention Of Images

Images from cameras are recorded on the computer system (“the recordings”). Where recordings are retained for the purposes of security of staff, patient and premises, these will be held in secure storage, and access controlled. Recordings which are not required for the purposes of security of staff, patient and premises, will not be retained for longer than is necessary and no longer than 12 weeks.

Access To Images

It is important that access to, and disclosure of, images recorded by CCTV and similar surveillance equipment is restricted and carefully controlled, not only to ensure that the rights of individuals are preserved, but also to ensure that the chain of evidence remains intact should the images be required for evidential purposes.

Access To Images By Practice Staff

Access to recorded images is restricted to the Data Controllers, who will decide whether to allow requests for access by Data Subjects and/or third parties (see below).

Viewing of images must be documented.

• The name of the person removing from secure storage, or otherwise accessing, the recordings.
• The date and time of removal of the recordings.
• The name(s) of the person(s) viewing the images (including the names and organisations of any third parties).
• The reason for the viewing.
•  The outcome, if any, of the viewing.
• The date and time of replacement of the recordings.

Removal Of Images For Use In Legal Proceedings

In cases where recordings are removed from secure storage for use in legal proceedings, the following must be documented:

• The name of the person removing from secure storage, or otherwise accessing, the recordings.
• The date and time of removal of the recordings.
• The reason for removal.
• Any crime incident number to which the images may be relevant.
• The place to which the recordings will be taken.
• The signature of the collecting police officer, where appropriate.
• The date and time of replacement into secure storage of the recordings.

Access To Images By Third Parties

Requests for access to images will be made using the ‘Application to access to CCTV images’ form

The Data Controllers will assess applications and decide whether the requested access will be permitted. Disclosure of recorded images to third parties will only be made in limited and prescribed circumstances. For example, in cases of the prevention and detection of crime, disclosure to third parties will be limited to the following:

• Law enforcement agencies where the images recorded would assist in a specific criminal enquiry.
• Prosecution agencies.
• Relevant legal representatives.
• The press/media, where it is decided that the public’s assistance is needed in order to assist in the identification of victim, witness or perpetrator in relation to a criminal incident. As part of that decision, the wishes of the victim of an incident should be taken into account.
• People whose images have been recorded and retained (unless disclosure to the individual would prejudice criminal enquiries or criminal proceedings).

All requests for access or for disclosure should be recorded. If access or disclosure is denied, the reason should be documented as above. The practice reserves the right to levy a £10 maximum charge for the provision of CCTV images.

Disclosures Of Images To The Media

If it is decided that images will be disclosed to the media (other than in the circumstances outlined above), the images of other individuals must be disguised or blurred so that they are not readily identifiable.

If the CCTV system does not have the facilities to carry out that type of editing, an editing company may need to be used to carry it out.

If an editing company is used, then the Data Controllers must ensure that there is a contractual relationship between them and the editing company, and:

• That the editing company has given appropriate guarantees regarding the security measures they take in relation to the images.
• The written contract makes it explicit that the editing company can only use the images in accordance with the instructions of the Data Controllers.
• The written contract makes the security guarantees provided by the editing company explicit.

Access By Data Subjects

This is a right of access, which is provided by section 7 of the 1998 Act. Requests for access to images will be made using the ‘Application to access to CCTV images’, accompanied by a £10 fee (non-refundable if the request is declined).

Individuals should also be provided with the practice CCTV Policy which describes the type of images which are recorded and retained, the purposes for which those images are recorded and retained, and information about the disclosure policy in relation to those images.

Procedures For Dealing With An Access Request

All requests for access by Data Subjects will be dealt with by the practice manager. The Data Controllers will locate the images requested. The Data Controllers will determine whether disclosure to the Data Subject would entail disclosing images of third parties.

The Data Controllers will need to determine whether the images of third parties are held under a duty of confidence. In all circumstances the practice’s indemnity insurers will be asked to advise on the desirability of releasing any information.

If third party images are not to be disclosed, the Data Controllers will arrange for the third party images to be disguised or blurred. If the CCTV system does not have the facilities to carry out that type of editing, an editing company may need to be used to carry it out. If an editing company is used, then the Data Controllers must ensure that there is a contractual relationship between them and the editing company, and:

• That the editing company has given appropriate guarantees regarding the security measures they take in relation to the images
• The written contract makes it explicit that the editing company can only use the images in accordance with the instructions of the Data Controllers
• The written contract makes the security guarantees provided by the editing company explicit

The practice manager will provide a written response to the Data Subject within 21 days of receiving the request setting out the Data Controllers’ decision on the request.

A copy of the request and response should be retained.

Complaints

Complaints must be in writing, and addressed to the practice manager. Where the complainant is a third party, and the complaint or enquiry relates to someone else, the written consent of the patient or Data Subject is required.

All complaints will be acknowledged within 7 days, and a written response issued within 21 days.

Enquiries

All enquiries regarding this policy should be made to the practice manager.