CCTV Privacy Notice - Brompton Hall School

This privacy notice has been written to inform members of the public, parents, pupils and staff of Brompton Hall School, about how and why we process their personal data in relation to CCTV.

Who are we?

Brompton Hall School is a ‘Data Controller’ as defined by Article 4 (7) of GDPR. This means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation.

The school has appointed Veritau Ltd to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the school is compliant with GDPR and to oversee data protection procedures. Veritau’s contact details are:

What information do we collect and why do we collect it?

By using CCTV systems the school collects, stores, and uses static or moving images of individuals located in the surveillance area.

The school may be able to identify those individuals by using other existing information.

The school operates CCTV for the following purposes:

for safeguarding children,

Our lawful basis for processing your personal data is Article 6(1)(e) and 6(1)(f) respectively:

6(1)(e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller – Safeguarding children.
6(1)(f) - Processing is necessary for the purposes of legitimate interests - prevention and detection of crime.

Who has access to your personal data?

Your information will only be made available to school employees where there is a need to investigate the recording. Only employees authorised by school management may have access to this footage.

Who do we share your personal data with?

We will only share CCTV footage with other agencies where there is a lawful reason to do so - for example to share with the police for the purposes of crime prevention or to assist in locating an absconding pupil.

How long do we keep your personal data for?

The school will retain this data for one month

Do you transfer my data outside of the UK?

Generally the information that the school holds is all held within the UK. However, some information may be held on computer servers which are held outside of the UK. We will take all reasonable steps to ensure your data is not processed in a country that is not seen as ‘safe’ by the UK government.

What rights do you have over your data?

Under GDPR, individuals have the following rights in relation to the processing of their personal data:

to be informed about how we process your personal data. This notice fulfils this obligation,
to request access to your personal data that we hold, and be provided with a copy of it,
to request that your personal data is erased where there is no compelling reason for its continued processing.

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO on the address provided above.

If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the school has handled your personal data. You can do so by contacting:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow Cheshire
SK9 5AF

casework@ico.org.uk // 0303 123 1113