DOLLAR ACADEMY CCTV DATA PROTECTION POLICY

This policy is required in accordance with the 1998 Data Protection Act.

Purpose
The purpose of CCTV equipment installed in Dollar Academy is the prevention and detection of criminal activity and the protection of Academy staff, pupils and property.

Registration
All CCTV systems in the Academy are registered with the Data Protection Officer (Dr Hendry).  The system is under the control of the Governors of Dollar Academy Trust, and registered with the Information Commissioner.

Signs
Signs at all entrances to the Academy grounds will state that the area is covered by CCTV cameras.

Recording Management
All images are recorded digitally onto a hard drive and are overwritten every 7 days.

Images are only viewable by:
Rector/Deputy Rector
Bursar
Data Protection Officer
Building and Works Controller
Houseparents
Head Janitor
Assistant Janitor

Access is on a need-to-know basis, in an area secure from casual/accidental viewing by unauthorised persons.  Access is further protected by password. No unauthorised person should be allowed to view images at any time.  All authorised users must be made aware of the details of this policy and be trained in their responsibilities under the Data Protection Act, and receive a copy of the Information Commissioner’s Code of Practice.

Measures are taken to prevent unauthorised/unlawful processing of data or accidental loss.

Images are only retained for an adequate period for the purpose for which they are being made.

Maintenance
The Building and Works Controller is charged with ensuring that the system is adequately maintained, that the operation of the equipment is checked regularly and any faults rectified as soon as possible.

Data Subject Access Rights
Anyone whose image is or might be recorded on CCTV media (a data subject) has a right to have a copy of any images in which they are included, but has no right to view images of people other than themselves.  No data subject will be given access to CCTV footage unless they make a formal “Data Subject Access Request”.  They should do this by expressing their wish to access information under the terms of the Data Protection Act (1998) IN WRITING.  This request MUST be referred to the Data Protection Officer, whose responsibility it is to ensure legal compliance with processing the data.