Privacy Notice for the use of CCTV

This Privacy Notice explains who we are, how and why we collect and use personal information about you if you appear on a University CCTV device, what personal data is collected and held about you, our purposes and lawful bases for processing, details of who we share your personal data with, relevant retention periods, and how you can exercise your data subject rights.

Please do read this notice to understand our practices and if you have any questions please contact us using the contact details provided below.

Who we are and how we capture personal data

Throughout this notice, “University”, “we”, “our” and “us” refer to the Manchester Metropolitan University, an exempt charity under Schedule 2 to the Charities Act 1993 (amended by the Charities Act 2011). The University is the Controller in respect of the personal data held about you as an external examiner. 

The University is registered as a Controller with the Information Commissioner’s Office (ICO). We manage personal data in accordance with the General Data Protection Regulation (GDPR) and the University’s Data Protection Policy.

Our CCTV monitors various locations across the campus 24 hours a day, every day of the year. These locations are carefully selected to fulfil the purposes of the processing, whilst still having due regard to the privacy of the data subjects. The CCTV images are monitored and reviewed by authorized University staff where it is reasonably necessary to fulfil the purposes outlined in this notice and within the University’s CCTV policy .

Cameras are not placed in areas that have an expectation of privacy (such as in changing rooms) except in exceptional circumstances, where a thorough assessment has been conducted and the University has very serious concerns.

CCTV will not normally be used for routine workforce monitoring or for covert monitoring; however, the University reserves the right to use CCTV for overt and/or covert monitoring in exceptional circumstances, as part of a specific investigation (such as to prevent or detect criminal activity or equivalent malpractice), with approval from the Director of Services and the Legal Department.

The University conduct the following types of recording:

• Fixed camera CCTV around the Manchester Metropolitan campus

• Use of body worn cameras by designated security staff

• Automatic Number Plate Recognition in certain parking facilities

Body worn cameras may be used by University Security staff. Security staff members will activate cameras where there is a recognised requirement to record footage, and will declare to individuals captured that video and audio recording will take place. 

The personal data we process

We collect and process recorded images through the use of our CCTV system. We do not collect audio data except through use of the body worn cameras. Images including vehicles and individuals are captured at a level of definition considered to be necessary for the intended purpose i.e. for reasons identification, health and safety or traffic management.

Camera sites and locations are determined appropriately and, in order to respect privacy, wherever practicable cameras are restricted to monitor only those areas which are intended to be monitored, excluding views of areas that are not of interest. Cameras are not sited to focus on private residential areas. Where cameras unavoidably overlook residential areas, privacy screens will be fitted.

The CCTV system captures images of people and their activity, which may include special categories of personal data, as defined by the General Data Protection Regulation. This may include personal data pertaining to an individual’s racial or ethnic origin, data concerning health or data concerning sex life or sexual orientation of an individual. The information may also include details relating to the commission of offences.

The purposes of the processing 

The recipients or categories of recipients of the personal data

We may disclose personal data about you to the following third parties:

• Law enforcement agencies for the purposes of the prevention and detection of crime.

• Other relevant organisations such as health care agencies or the emergency services for safeguarding or public protection reasons.

The University conducts relevant assessments to ensure lawfulness, necessity and proportionality prior to sharing any information captured by the CCTV system with external organisations.

Data retention

Your personal data will only be retained for as long as it is necessary in accordance with the University’s Retention and Disposal Schedule. Specifically, we will retain CCTV images as follows:

Occasionally, images may be retained for longer to meet the purposes for which the images were taken, e.g., for investigating a crime or disciplinary matter.

Your rights in respect of the processing

The GDPR provides data subjects with the following data subject rights:

• The right to be informed – this privacy notice assists with fulfilling these obligations.

• The right of access.

• The right to rectification.

• The right to erasure.

• The right to restrict processing

• The right to data portability

The right to object

Please note, that these rights apply in certain circumstances, for example according to the lawful basis utilised by the University. The right of access to personal information held about you exists in order to be aware of, and verify, the lawfulness of the processing. Please use the contact information below to exercise these rights.

Contacting us

For questions or concerns about this Privacy Notice, or our use of your personal information, please contact the security control room on 0161 247 6656 or email securitydutymanager@mmu.ac.uk in the first instance.

Our Data Protection Officer can also be contacted using dataprotection@mmu.ac.uk, by calling 0161 247 3884 or in writing to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please contact: casework@ico.org.uk or telephone: 0303 123 1113. For any further contact information please see: https://ico.org.uk/global/contact-us/.

Updates to this privacy notice

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.