cctv policy
Scope
Charlotte Tilbury Beauty Limited (“Charlotte Tilbury”) has in place a CCTV surveillance system (the “CCTV System”) across its UK shop locations. This policy details the purpose, use and management of the CCTV System at Charlotte Tilbury, and details the procedures to be followed in order to ensure that the organisation complies with relevant legislation and the current Information Commissioner’s Office CCTV Code of Practice (“ICO Guidance”).
The use of the CCTV System will comply with the General Data Protection Regulation (“GDPR”), and other applicable legislation. Although not a relevant authority, Charlotte Tilbury will also have due regard to the Surveillance Camera Code of Practice, issued under the Protection of Freedoms Act 2012 and in particular the 12 guiding principles contained therein.
This policy is based on the ICO Guidance.
This policy and procedures apply to all of Charlotte Tilbury’s CCTV Systems that capture images of identifiable individuals for the purpose of viewing and or recording the activities of such individuals. CCTV images are monitored and recorded in strict accordance with this policy.
Responsibility
The Head of Workplace Technology and Infrastructure is responsible for the overall management and operation of the CCTV System, including activities relating to installations, recording, reviewing, monitoring and ensuring compliance with this policy.
Additionally, the Head of Workplace Technology and Infrastructure is responsible for ensuring that adequate signage is displayed in compliance with the ICO Guidance.
Charlotte Tilbury’s usage of CCTV and the contents of this policy will be reviewed annually by the Head of Workplace Technology and Infrastructure with reference to the relevant legislation or guidance in effect at the time. Further reviews will take place as required.
All staff involved in the operation of Charlotte Tilbury’s CCTV System will be made aware of this policy and will only be authorised to use the CCTV System in a way that is consistent with these purposes and procedures.
All Charlotte Tilbury staff with responsibility for accessing, recording, disclosing or otherwise processing CCTV images will be required to undertake training in data protection and the correct operation of the CCTV System.
It is the responsibility of all Charlotte Tilbury employees to comply with this policy. Failure to comply with this policy could result in potential enforcement action from regulators, claims from data subjects and reputational damage, in addition to increased costs of storage and the increased workload from handling data subject individual rights requests. Non-compliance with this policy may lead to disciplinary action.
Policy
1. Charlotte Tilbury is the data controller for the images produced by the CCTV System. Charlotte Tilbury is registered with the Information Commissioner’s Office and the registration number is ZA222382. The CCTV System operates in a manner that meets the requirements of the GDPR and the ICO’s Guidance, and in a manner that is consistent with respect for the individual’s privacy.
2. Charlotte Tilbury makes use of a CCTV System, as follows:
‘General purpose’ CCTV
i. For the prevention, reduction, detection and investigation of crime and other incidents
ii. To ensure the safety of staff, visitors and customers
iii. To assist in the investigation of suspected breaches of Charlotte Tilbury regulations by staff, visitors or customers
3. The CCTV System is operational and is capable of being monitored for 24 hours a day, every day of the year.
4. All CCTV installations are subject to a Data Protection Impact Assessment.
5. For ‘general purpose’ CCTV usage, the cameras are monitored in a restricted area in shop locations, which are accessible only to staff. Images are recorded on systems stored in this location, and access to historical images is only granted to shop managers and Retail Operations staff.
6. The cameras installed provide images that are of suitable quality for the specified purposes for which they are installed, and all cameras are checked daily to ensure that the images remain fit for purpose and that the date and time stamp recorded on the images is accurate. All images recorded by the CCTV System remain the property and copyright of Charlotte Tilbury.
7. All cameras are sited in a way that they will only capture images of individuals entering into Charlotte Tilbury retail locations, strictly for the purposes as specified in Point ii.
8. Appropriate signage will be in place in all locations where CCTV Systems are deployed, to inform individuals of their presence. Signage will be clearly visible and readable, state the purpose for using the system and provide contact details for the party responsible for operating the system.
9. The CCTV System does not compare images against a reference database for matching purposes.
10. Appropriate security measures are applied to ensure that the CCTV Systems and images produced by it are protected against unauthorised access and use.
11. Requests by individuals for images relating to themselves should be submitted to legal@charlottetilbury.com, or by post to General Counsel, Charlotte Tilbury Beauty Limited, 8 Surrey Street, London, United Kingdom WC2R 2ND, together with proof of identification. Further details of this process are detailed in the Charlotte Tilbury Individual Rights (Subject Access Request) Policy. In order to locate the images on the CCTV System, sufficient detail must be provided by the individual in order to allow the relevant images to be located and the data subject to be identified. For example, date and approximate time of day when images may have been captured, and location, would allow us to more easily identify all images.
12. Where Charlotte Tilbury is unable to comply with a Subject Access Request without disclosing the personal data of another individual who is identified or identifiable from that information, it is not obliged to comply with the request unless satisfied that the other individual has provided their express consent to the disclosure, or if it is reasonable, having regard to the circumstances, to comply without the consent of the individual.
13. A request for images made by a third party should be made in writing to legal@charlottetilbury.com or by post to General Counsel, Charlotte Tilbury Beauty Limited, 8 Surrey Street, London, United Kingdom WC2R 2ND. In limited circumstances it may be appropriate to disclose images to a third party, such as when a disclosure is required by law, in relation to the prevention or detection of crime or in other circumstances where an exemption applies under relevant legislation.
14. Where a suspicion of misconduct arises and at the formal request of the People Team, the Head of Workplace Technology and Infrastructure may provide access to CCTV images for use in staff disciplinary cases.
15. A record of any disclosure made under this policy will be maintained by Charlotte Tilbury, itemising the date, time, camera, requesting party, authorising party and reason for the disclosure.
16. Unless required for evidential purposes, the investigation of an offence or as required by law, CCTV images will be retained for no longer than the period stated in the Charlotte Tilbury Data Retention Policy. Images will be automatically overwritten after this point. Where an image is required to be held in excess of this retention period, the Head of Workplace Technology and Infrastructure will be responsible for authorising such a request. Images held in excess of their retention period will be reviewed on a three monthly basis and any not required for evidential purposes will be deleted.
17. Complaints concerning Charlotte Tilbury’s use of its CCTV System or the disclosure of CCTV images should be made in writing to legal@charlottetilbury.com or by post to General Counsel, Charlotte Tilbury Beauty Limited, 8 Surrey Street, London, United Kingdom WC2R 2ND.