Event Control Privacy Notice (CCTV)

We're committed to protecting your personal data and ensuring that it is processed fairly and lawfully. Information you provide to us will be processed in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and subsequent legislation.

The CCTV system has been installed for the purposes of public safety and crime prevention covering the event area and the event perimeter.

The CCTV system encompasses entrance queues, perimeter fences, bars, main stage auditoriums and other areas where large crowds are likely to gather. Images from the cameras are transmitted to the Event Control Room, where the monitoring, control and recording of the cameras is undertaken.

The location of each CCTV camera is logged and only authorised for use if it fulfils the requirements set out during the design phase as described in the CCTV Operational Requirements document. The CCTV system as a whole will be subject to a Data Protection Impact Assessment.

Information we collect

The data that we process is footage showing employees, event attendees and members of the public which is captured by our CCTV cameras and stored on our systems.

Some more sensitive information, known as special category data, may also be processed passively if the footage collected reveals an individual’s ethnic or racial origin, or data concerning their health (for instance, if they have a visible disability).

Processing personal data

The information collected will be only be processed for one or more of the following purposes:

• protecting the health and safety of employees and event attendees
• preventing and detecting crime or criminal activity, and protecting buildings and assets from damage, disruption, vandalism or other criminal activity
• creating a safer environment and providing reassurance to employees, event attendees and the general public
• countering terrorism

It will not be processed for any other purpose.

The legal basis for processing is:
GDPR article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Where special category data is processed, the legal basis is:
article 9(2)(g): processing is necessary for reasons of substantial public interest. The relevant basis in UK law is set out in section 10(3) of the DPA 2018. This means that we're required to meet one of the 23 specific substantial public interest conditions set out in Schedule 1. The substantial public interest condition is one or more of the following:
Sch 1 para 7: Administration of justice
Sch 1 para 10: Preventing or detecting unlawful acts
Sch 1 para 11: Protecting the public

Where personal data relating to criminal allegations or offences is processed, this will be carried out only where authorised under UK law in compliance with GDPR Article 10 and will meet one or more of the following conditions set out Schedule 1, Part 3 of the Data Protection Act 2018:
Sch 1 para 33: Legal Claims
Sch 1 para 36: Substantial Public Interest
Sch 1 para 37: Insurance Claims

Access to data

There is no planned regular or scheduled sharing of CCTV footage with any external organisation. However, in the event of a security incident or suspected security incident, footage may be shared with third party organisations such as the Event Organiser, police, insurance companies.
Footage may be shared with an individual in response to a subject access request. Where a subject access request is made, efforts will be made to seek the consent to disclosure of images of any other individuals captured in the footage, and where this is not possible, consideration will be given as to whether or not it is reasonable to share the information without their consent.
The information provided will not be used for marketing purposes, unless you have agreed to this, or to take any automated decisions.

Data security

Images captured on camera are transmitted to and recorded on hardware within the Event Control Room and as a result will be subject to appropriate security protocols. Access to the control room is restricted to authorised personnel only.

We're committed to protecting personal data and have policies and procedures on information security in place to ensure that it is safeguarded.

Data retention

The CCTV information collected will be retained for 14 days. After 14 days unless a request has been received from the Event Organiser or the police the CCTV information will be destroyed. Should a request be made from the above organisations or an individual has made a subject access request the information will be retained until the request has been satisfied.

Subject Access Requests

Individuals have the right to request access to CCTV footage relating to themselves under the GDPR and the DPA.

1. All requests should be made in writing to the Data Protection Officer. Individuals submitting requests for access will be asked to provide sufficient information to enable the footage relating to them to be identified. For example; date, time and location.
2. Event Control will respond to a request within one calendar month of receiving a valid request.
3. Where a Subject Access Request includes footage of another individual not included in the request, efforts will be made to seek the consent to disclosure of images of the other individuals and where this is not possible, consideration will be given as to whether or not it is reasonable to share the information without their consent.
4. Event Control reserves the right to refuse access to CCTV footage where this would prejudice the legal rights of other individuals or jeopardise an ongoing investigation.
5. Wherever possible, Event Control will notify the requester if an exemption or limitation to their request applies, such as, but not limited to:
   1. A claim to legal professional privilege in legal proceedings
   2. The request will infringe on a third party’s rights and freedoms
   3. Any other exemption to the right of access as stated in the GDPR and DPA.
6. In order to confirm the identity of the person making the request two forms of official identification documentation will need to be provided.
   1. One of which must show your name, date of birth & current address along with your full face photo.
   2. The second can be a utility bill stating your name and address.
7. We are collecting this data to enable us to correctly identify the subject and provide you with CCTV footage of yourself as requested under a Subject Access Request.
8. We will hold this information until you have been provided with the requested footage or notified the footage is not available, this should be no longer than 30 days after making the request as set out by the surveillance cameras commissioners code of practice. After this, your information will be deleted. We will use this information to confirm your identification.

Your rights

Should you wish to raise any concerns about how we have processed your personal data you can contact the data protection officer, please email dataprotectionofficer@lyonsindustries.co.uk or write to:
Data Protection Officer
Lyons Industries Limited
Drovers Way
Ugford
Wilton
SP2 0EB

You also have the right to contact the Information Commissioner.