1. Introduction

This policy sets out the actions and procedures which must be followed to comply with the Data Protection Act in respect of the use of closed-circuit television (CCTV) surveillance system managed by the Study Inn Group of Companies.

The Data Protection Act covers the processing of images of individuals caught by CCTV cameras. The legislation means that legally enforceable standards apply to the collection and processing of images relating to individuals.

2. Policy

This policy will cover all staff, residents and visitors of the company’s premises and other persons whose image may be captured by the system.

The purpose of the CCTV system is for the:

• Prevention and detection of crime or disorder.
• Apprehension and prosecution of offenders.
• Provision of evidence in criminal proceedings.
• Interest of public, guest, and employee safety.
• Protection of property and assets.
• Investigation of suspected breaches of the Residential License Agreement.
• Investigation of suspected staff misconduct.

3. Equipment and Installation

Before any installation the location of the equipment will be carefully considered. The Company will ensure that the installation complies with the Data Protection Act and CCTV Code of Practice.

• All cameras will be located in prominent positions.
• All surveillance will be automatically recorded.
• Covert recording is not permitted.
• Sound recording is not permitted.

Signs will be erected on all entrance points to the premises and throughout the site to ensure that staff and visitors are aware they are entering an area that is covered by CCTV surveillance equipment.

The signs will include company contact details and the purpose for the surveillance.

Recording equipment will be installed in secure locations with restricted access.

The equipment, and placement of the cameras will be regularly reviewed to ensure that the system remains compatible with the purpose of the CCTV system.

4. Management and Maintenance

The CCTV systems will be managed and maintained by the IT and Maintenance Departments under the direction of the IT Manager and the Technical Services Manager.

5. Access to Live Images

Onsite staff including Centre Managers, Assistant Centre Managers and Night Concierges have access at the reception desk to view live images from a range of cameras from certain areas of the building for the purposes of building security including:

• Exterior perimeter
• Entrances, fire escapes and reception
• Lift lobbies, lifts and shared corridors
• Communal areas. Gyms and Car Parks
• Store rooms, plant rooms and staff areas

A publicly visible screen will be located in reception displaying live images of the reception area to highlight the CCTV system to visitors.

Live viewing of apartment corridors and kitchens, the staff room and other sensitive areas is not permitted.

6. Recorded Images

The images produced must be as effective as possible for the purpose for which they are intended.

Images, which are not required for the purpose for which the equipment is being used, will not be retained for longer than is necessary.

All recorded images will be stored securely within the systems hard drives, for up to 60 days when they are then automatically erased unless the images are required for evidential purposes in legal or Company disciplinary proceedings. Evidential recordings will be stored securely until completion of the proceedings.

7. Access to Recordings

Viewing of recorded images will be controlled by the Data Protection Lead, Operations Director, and Operations Manager. Only authorised persons may access CCTV recordings as part of a documented investigation in accordance with the purposes for which the recordings were captured.

8. Access to Recorded Images by Third Parties (Excluding Subject Access Request)

To protect the rights of individuals, disclosure of recorded images will be controlled by the Data Protection Lead. Images can only be disclosed in accordance with the purposes for which they were originally collected and in accordance with the UK GDPR and Data Protection Act.

If requested copies of the recordings may be shared with the police, other law enforcement agencies or insurance companies on receipt of a signed request approved by the Data Protection Lead. In this case the recording will be copied onto a DVD marked with the date, time and location of the incident along with the crime/reference number and handed directly to a representative of the third party. Or, uploaded directly to their online evidence portal.

Requests should be submitted to [email protected].

9. Access to Recorded Images by Individuals (Subject Access Request)

The Data Protection Act gives any individual the right to request access to CCTV images. The Company Data Protection Lead will deal with access request under the Company Data Protection Policy. In the first instance a Subject Access Request should be submitted to [email protected].

Only images of the individual making the request can be released. Where images also show other individuals, these cannot be released as it would be in breach of their privacy rights.

10. Legal Compliance

The company’s CCTV installations will be operated in accordance with applicable data protection legislation (defined as the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (UK GDPR).

For the purposes of data protection legislation, the Data Controller will depend on the site installation as detailed in the following list:

• Site                                                     Data Controller
• Marlborough House, Bristol                Study Inn (Marlborough St) Ltd
• Lemyngton Street, Loughborough      Study Inn (Lemyngton St) Ltd
• Talbot Street, Nottingham                   Study Inn (Talbot St) Ltd
• Walnut Gardens, Exeter                     Study Inn (St David’s Hill) Ltd
• Brotherton House, Leeds                   Study Inn (Grace St) Ltd
• Reynard House, Leicester                  Study Inn (Welford Road) Ltd
• Triumph House, Nottingham               Study Inn (Triumph Road) Ltd

The Company’s Data Protection Lead can be contacted at [email protected].

11. Implementation of the Policy

Overall responsibility for policy implementation and review rests with the Company senior management. However, all employees are required to adhere to and support the implementation of the policy. The Company will inform all existing employees about this policy and their role in the implementation of the policy. They will also give all new employees notice of the policy on induction to the Company.

This policy will be implemented through the development and maintenance of procedures for appraisals and one-to-one meetings, using template forms, and guidance given to both managers and employees on the process.

This Policy shall be deemed effective as of 10^th April 2024. No part of this Policy shall have retroactive effect and shall thus apply only to matters occurring on or after this date.