This includes Closed-Circuit Television (CCTV), Body Worn Cameras (BWC), and Automatic Number Plate Recognition (ANPR) devices. It should be read in conjunction with the Trust Privacy Notice.
Image capture is not used for any purpose other than as set out in this Schedule.
Closed Circuit Television (CCTV)
The Trust has a system of CCTV cameras operating at various locations around its network, including but not limited to museums and attraction sites; offices; locks and towpaths; and operational assets (e.g., bridges and reservoirs).
The location and positioning of these cameras are not intended to be intrusive. They provide a general overview of the location, rather than identification of individuals. However, identification may be possible and at times will be necessary (e.g., where there are health and safety concerns or matters of a criminal nature arise). Notices will be in place whenever CCTV cameras are present.
Some of these cameras will be triggered by motion, only recording when motion is detected. Some are accessible via a smartphone application available only to authorised Trust staff for legitimate Trust purposes.
Body Worn Cameras (BWC)
Some Trust staff record interactions via BWCs while carrying out official Trust business, particularly in respect of boat licensing and customer support activities. This includes but is not limited to inspections and boat data collection; delivery of documents; enforcement activities; boat removals; and movement around on the towpath.
The cameras constantly record on a short loop, meaning the footage is overwritten every thirty seconds. No data is physically saved unless the operator activates recording, at which time the previous thirty seconds will be saved along with any subsequent footage until recording is stopped. Cameras will only be activated where, in the opinion of the operator, it is necessary to do so, for example where an incident is occurring.
Automatic Number Plate Recognition Cameras (ANPR)
On certain properties, the Trust operates ANPR cameras. Although the purpose of these cameras is to capture vehicle number plates, images of complete vehicle and/or vehicle occupants may be captured incidentally.
These cameras are not monitored live and will be triggered to record images by the presence of vehicles. Notices will be in place whenever ANPR cameras are present. These notices will also confirm whether the Trust manages the system, or another organisation on its behalf.
For some purposes, the Trust uses image of number plates to refer to the police, the Driver, and Vehicle Licensing Agency (DVLA) and insurance companies and do not collect personal information about the vehicle owner from those agencies in return (except where the police include information in reports). For other purposes (for example where ANPR is designed to enforce parking charges), personal information may be obtained from the DVLA.
Other image capture devices
At times we receive information from other individuals who are present at incidents, for the purpose of evidencing events, or recording interactions between Trust staff or volunteers and our customers or members of the public.
Controller of your information
We are the controller of your personal information. Where we legitimately share your information outside the Trust, the recipient organisation may either be the processor or joint controller, depending on the circumstances and subject to appropriate safeguards and controls.
Where we get your information from
Your information may be collected in a variety of ways.
Information you provide
- We do not collect information directly from you.
Information we obtain from other sources
- From the police, DVLA or insurance companies, depending on the circumstances and the purpose the processing is required.
Information we create
- Through CCTV cameras, BWCs and ANPR cameras.
Information we collect about you
Depending on the circumstances, we may hold and process some, or all, of the information contained in Annex 1 – Schedule of personal information processed.
Special category information
We do not collect your special category information.
Criminal convictions and offences information
We do not collect your criminal convictions and offences information. However, please note that should you be captured on our devices committing a criminal offence, it may be used as evidence and disclosed to the appropriate authorities accordingly.
Why we process your information
Your personal information will be processed for the purposes set out in Annex 1 – Schedule of personal information processed and will not be processed for any other purpose.
Lawful basis
Your personal information will be processed under the lawful basis set out in Annex 1 – Schedule of personal information processed.
Where your information will be stored
Your information will be stored in a range of different places, including within the cameras/devices (on a hard drive or a removable and portable memory card).
Our CCTVs are mostly operated and controlled by the Trust, but on occasion will be hosted by a third-party CCTV service provider. Our ANPR cameras are mostly hosted by a third party. Where there is third-party involvement, information may be stored on their servers and/or on a secure cloud server.
Information may be stored elsewhere on secure Trust devices or its servers for legitimate business or evidential purposes, for example where there has been an incident which needs investigating.
How long we keep your information for
We keep your information for up to thirty calendar days, after which it will be deleted. Some devices will delete or overwrite images automatically after this time, others (in exceptional circumstances) will be a manual deletion, backed up by robust processes to ensure consistency. At times we will be required to keep the information beyond this time, for example for official evidential purposes following an incident, allegation, or complaint.
Who we share your information with
Your personal information may be shared internally within the Trust with individuals who are required and authorised to receive it for legitimate business purposes according to their role, and in accordance with Annex 1 – Schedule of personal information processed.
Your information may be shared externally according to Annex 2 – Schedule of personal information shared.
Information will only be shared when requested, or where we are otherwise required to share it by law or pursuant to a legitimate Trust business aim. In any event, it will only be shared where there is a lawful basis to do so, or there is an exemption under the Data Protection Act 2018.
International transfers
We do not currently share any of your information internationally.
Other information capture
On occasion the Trust may authorise the monitoring of premises temporarily, via third party use of CCTV. For example, where construction or repair work is being undertaken by a contractor. In these instances, the capture and processing of information will be covered by the third-party privacy notices.
The Trust operates several permanent ‘towpath counters’. These monitor towpath usage to determine the number of users. The data is anonymised at the point of collection, so no personal information is held either in, or via, these devices. The statistical data is stored and transferred by Tracsis and is only used for analysis purposes.
Other relevant privacy documents
Internal
- Privacy Notice
- Privacy Schedule for employees
- Privacy Schedule for volunteers
- Privacy Schedule for governance stakeholders
- Privacy Schedule for boating and mooring customers
- Privacy Schedule for research participants
- Privacy Schedule for other visitors and non-boating customers
- Privacy Schedule for photographs, videos and written and audio stories
- Privacy Schedule for job applicants
- Privacy Schedule for visitor wifi usage
External
Changes to this Schedule
We may change this Schedule from time to time without notice to you. This is to ensure it reflects current legislation. In that case, the ‘latest version’ date in Annex 3 will also change. Any changes to this Schedule will apply to you and your data immediately.
If these changes significantly affect how your personal data is processed, we will take reasonable steps to let you know.
Latest version
This Privacy Schedule is reviewed periodically when changes are required, and in any event every three years. If the version you are viewing is older than three years, please ensure that you have the up-to-date version by contacting [email protected].
