CCTV and Body Worn Camera Policy

1.1 The principal purpose of the University’s CCTV system and body worn cameras is as follows:

• for the prevention, reduction, detection and investigation of crime and other incidents 
• to ensure the safety of staff, students and visitors
• to assist in the investigation of suspected breaches of University regulations by staff or students
• the monitoring and enforcement of traffic related matters. 

1.2 The CCTV system will be used to observe the University’s campuses and areas under surveillance to identify incidents requiring a response. Any response should be proportionate to the incident being witnessed.

1.3 The University seeks to operate its CCTV system in a manner that is consistent with respect for the individual’s privacy.

1.4 University of Staffordshire “the University”, has in place a CCTV system across its College Road, Leek Road and Blackheath Lane campuses. This policy details the purpose, use and management of the CCTV system at the University and details the procedures to be followed to ensure that the University complies with relevant legislation and the current Information Commissioner’s Office Code of Practice.

1.5 The University will have due regard to the Data Protection Act 2018, the General Data Protection Regulation (GDPR) and any subsequent data protection legislation; and to the Freedom of Information Act 2000, the Protection of Freedoms Act 2012, the Regulation of Investigatory Powers Act 2000, Private Security Industry Act 2001 and the Human Rights Act 1998.  This policy also assists the University to comply with its Duty of Care and legislative requirements of the Health and Safety at Work etc. Act 1974.

1.6 Effective use of CCTV will also facilitate effective implementation of the University’s other policies and lead to the resolution of complaints, disciplinary procedures and prosecutions more quickly.

2.1 This policy applies to the CCTV system and body worn cameras managed by the Campus Safety and Security Team only.

2.2 The CCTV system and body worn cameras that capture images of identifiable individuals, is operated for the purposes of promoting security on campus and to identify criminal activity when occurring, anticipated or perceived, in order to enhance the safety and wellbeing of staff, students and visitors.  It also applies to information relating to individuals for the purposes of monitoring activities on University premises, car parks and other public areas.

2.3 The use of conventional cameras, surveillance cameras and CCTV for other purposes including artistic, administrative, educational or research purposes, is not covered by this policy.

3.1 The University shall be responsible for the CCTV system and body worn cameras operated by the Campus Safety and Security Team and shall be the Data Controller for the requirements of the Data Protection Act 2018, ensuring that all obligations are met.

3.2 The Estates and Commercial Services department is responsible for the operation and management of the University CCTV system sitting within the Campus Safety and Security Department.

3.3 The University shall ensure that its notification to the Data Protection Register and Information Commissioner’s Office includes the use of CCTV.

3.4 All operators of the CCTV system and body worn cameras shall be appropriately trained and have a valid SIA CCTV license. All new staff will be licensed within 6 months of their employment start date and in the interim, access to the management of these systems will be limited appropriately.

3.5 CCTV recordings are kept for no longer than 30 days unless they form part of a legal or internal investigatory process. This will be handled in line with GDPR and other aforementioned regulatory requirements.

3.6 CCTV cameras shall not be used to record conversations under any circumstances, however body-worn cameras will record both video and audio.

3.7 The University shall not undertake covert surveillance without express authorisation from the Vice Chancellor or their appointee and approval of the Data Protection Officer. It shall ensure that any such surveillance is compliant with relevant legislation as referred to in 1.2 above.

3.8 The University shall deploy appropriate equipment which enables the capture of images adequate for the purpose for which they are being collected.

3.9 Camera siting shall be appropriate for purpose and signage displayed appropriately.

3.10 The CCTV system is operational and capable of being monitored 24 hours per day, 365 days per year.

3.11 Body worn cameras will be worn during security patrols and Campus Safety and Security officers dealing with a specific incident will ensure their cameras are set to record. They will disclose, when approaching persons, that they are being video and audio recorded.

3.12 The downloading of recordings from body-worn cameras will take place automatically once the cameras are docked, and this will automatically cleanse the cameras of data. Data from the body-worn cameras is subject to the same controls as CCTV data. All cameras are sealed units with no removable data/memory to ensure GDPR compliance.

Applications by individual data subjects

4.1 For requests by individual data subjects for images relating to themselves, a “Subject Access Request” should be submitted in writing to the University’s Data Protection Office with proof of identification.

4.2 In order to locate the images on the University’s system, sufficient detail must be provided by the data subject to allow the relevant images to be located and the data subject to be identified.

4.3 Where the University is unable to comply with a Subject Access Request without disclosing the personal data of another individual who is identified or identifiable from that information, it is not obliged to comply with the request unless satisfied that the individual has provided their express consent to the disclosure, or if it is reasonable, having regard to the circumstances, to comply without the consent of the individual.

Access to and disclosure of images to third parties

4.4 A request for images made by a third party should generally be made in writing to the Data Protection Office. It is recognized that it may not always be possible or appropriate for the third party to use this procedure. For example, urgent access to images may be required by the police for the prevention or detection of crime or by other emergency services for the protection of the vital interests of an individual. In such cases the Head of Campus Security (or the most senior member of staff on duty at the time urgent access is required) may authorize disclosure of the required images to the police or other emergency service and make a report to the Data Protection Office as soon as practicable of the request and the disclosure made.

4.5 In limited circumstances it may be appropriate to disclose images to a third party, such as when a disclosure is required by law, in relation to the prevention or detection of crime or in other circumstances where an exemption applies under relevant legislation. Such disclosures will be made at the discretion of the Data Protection Officer with reference to relevant legislation and where necessary, following advice from the University’s Legal Services Team.

4.6 Where a suspicion of staff misconduct arises, and at the formal request of the Investigating Officer or HR Manager/Advisor, the Director of Human Resources and Organisational Development is required to provide authorisation for access to CCTV images or body-worn camera footage for use in staff disciplinary cases. The supplied footage will remain confidential at all times, will not be further copied, and will be used exclusively for the purpose of furthering the investigation. Upon completion of the investigation, it will be destroyed.  

4.7 Where a suspicion of student misconduct arises, and at the formal request of the relevant investigatory body/appointed investigator, the Dean of Student Services is required to provide authorisation for access to CCTV images or body-worn camera footage for use in student disciplinary cases. The supplied footage will remain confidential at all times, will not be further copied, and will be used exclusively for the purpose of furthering the investigation. Upon completion of the investigation, it will be destroyed.

1. Complaints and Appeals Procedure
2. Student Privacy Statement
3. Staff Privacy Statement
4. General Data Protection Regulation (GDPR)
5. Retention of Records Policy
6. Subject Access Request procedure
7. Disciplinary Procedure

Term:  Body worn camera

Definition:  A wearable body worn audio, video and photographic device, worn by security personnel. Usually worn on the torso. Used to record potential incidents or for the protection of officers where an incident might escalate.

Term:  CCTV

Definition:  Closed Circuit Television. Fixed cameras transmitting video to a central control room. CCTV is used for monitoring and security purposes, for the safety of individuals and the prevention and detection of crime.

a. Executive/Management

1)    Approve privacy policy
2)    Enforce sanctions

b. Corporate Compliance Officer

1)    Assists in development and execution of the Policy and promulgation of operating procedures
2)    Assists and supports the Policy originator
3)    Provides support for policy compliance activities

c. Director

1)    Develops and implements training program as described in Section 8 of this policy
2)    Documents the delivery of training to all work force members

d. Employee responsibilities

1)    Understand and comply with organisation’s policies and procedures
2)    Undertake training as required by the organisation.

a. Security Staff and management will be Security Industry Authority (SIA) CCTV Trained and Licensed.

1)    New staff member training:  New staff will undertake SIA CCTV License training within 6 months of being in post. Until this time, access to CCTV systems will be restricted

2)    Recurrent training:  License expires every 3 years and is to be renewed immediately. Any changes in legislation or license requirements will result in additional training

b. All staff will have up-to-date GDPR training

a. Staff breaches of this policy will be dealt with through the organisation’s existing complaints and disciplinary procedures