Police Building CCTV Self Assessment
Name of organisation
Essex Police
Scope of surveillance camera system
The use of surveillance camera technology should prevent crime and disorder on police premises as well as capture high quality evidence in the event of crime and disorder on police premises and protect the material and non material assets of Essex Police.
Senior Responsible Officer
Patrick Duffy
Position within organisation
Head of Estate Services
Signature
Patrick Duffy
Date of sign off
01/08/2022
Principle 1
Use of a surveillance camera system must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need.
1. What is the problem you face and have you defined a purpose in trying to solve it? Have you set objectives in a written statement of need?
Police stations generally have a high level of exposure to members of the public as they are a predominant point of contact with the police. There is a threat of vandalism, criminal damage and assault on police staff arising from this. At police stations with limited or no public interaction, there is an equal risk of general crime through isolation or the belief that they are vacant / empty.
Assets to be protected -
The safety and security of police personnel (officers and staff), members of the public on police premises.
Equipment belonging to the police service including (but not limited to) police vehicles, IT equipment, communications equipment and furniture/furnishings.
Evidence in the form of physical property and digital evidence.
Police intelligence through the prevention of unauthorised access to police premises.
The reputation of the force, internally and externally through the prevention of unauthorised access to police premises.
2. What is the lawful basis for your use of surveillance?
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Only on occasions it will be used for vital interests.
3. What is your justification for surveillance being necessary and proportionate?
The high-level benefits are the prevention and detection of crime and disorder and the enhanced safety of police personnel, police property, the public and detainees. High quality evidence will also be captured in the event of crime and disorder on police premises. The alternative of physical guarding has been disregarded as too resource-intensive.
4. Is the system being used for any other purpose other than those specified? If so please explain.
No
5. Have you identified any areas where action is required to conform more fully with the requirements of Principle 1?
.
Action Plan
Not Applicable
Principle 2
The use of a surveillance camera system must take into account its effect on individuals and their privacy, with regular reviews to ensure its use remains justified.
1. Has your organisation paid a registration fee to the Information Commissioner’s Office and informed them of the appointment of a Data Protection Officer (DPO) who reports to the highest management level within the organisation?
Yes
2. Are you able to document that any use of automatic facial recognition software or any other biometric characteristic recognition systems is necessary and proportionate in meeting your stated purpose?
purpose?
Yes
3. Have you carried out a data protection impact assessment, and were you and your DPO able to sign off that privacy risks had been mitigated adequately?
Yes
Before May 2018 the requirement was to complete a privacy impact assessment; this has been replaced by a data protection impact assessment. There is a surveillance camera specific template on the Surveillance Camera Commissioner’s website:
https://www.gov.uk/government/publications/privacy-impact-assessments-for-surveillance-cameras
4. Do you update your data protection impact assessment regularly and whenever fundamental changes are made to your system?
Yes
5. How have you documented any decision that a data protection impact assessment is not necessary for your surveillance activities together with the supporting rationale?
N/A
6. Have you identified any areas where action is required to conform more fully with the requirements of Principle 2?
No
Action Plan
Not Applicable
Principle 3
There must be as much transparency in the use of a surveillance camera system as possible, including a published contact point for access to information and complaints.
7. Has there been proportionate consultation and engagement with the public and partners to assess whether there is a legitimate aim and a pressing need for the system?
No
8. Does your Privacy Notice signage highlight the use of a surveillance camera system and the purpose for which it captures images?
Yes
9. Does your signage state who operates the system and include a point of contact for further information?
Yes
10. If your surveillance camera systems use body worn cameras, do you inform those present that images and sound are being recorded whenever such a camera is activated?
.
11. What are your procedures for handling any concerns or complaints?
Should any person visiting Essex Police have any questions concerning the operation of the CCTV systems or their rights with respect to any images of them recorded by the systems, they should contact the Information Rights Team, Essex Police HQ, PO Box 2, Chelmsford. CM2 6DA.
12. Have you identified any areas where action is required to conform more fully with the requirements of Principle 3?
No
Action Plan
Not Applicable
Principle 4
There must be clear responsibility and accountability for all surveillance camera system activities including images and information collected, held and used.
13. What governance arrangements are in place?
Authorised members of police staff will be able to review the data, provided there is a valid policing purpose, the relevant authority has been given and there is an audit log created for the download (where data is downloaded only). Only a vetted contractor upon receipt of a direct order via a force process may obtain a download.
Recorded images will be kept for 31 days and recorded over on the 32nd day.
If required for evidential purposes, once data has been downloaded into a suitable format, it will be subject to legislation regarding the use and handling of police evidence.
14. Do your governance arrangements include a senior responsible officer?
Yes
15. Have you appointed a single point of contact within your governance arrangements, and what steps have you taken to publicise the role and contact details?
Yes
Guidance on single point of contact.
Data Protection Officer
Essex Police
HQ
PO Box 2
Chelmsford
CM2 6DA
Email: [email protected]
16. Are all staff aware of the roles and responsibilities relating to the surveillance camera system, including their own?
Yes
17. How do you ensure the lines of responsibility are always followed?
As above, only authorised members of police staff will be able to review the data, provided there is a valid policing purpose, the relevant authority has been given and there is an audit log created for the download (where data is downloaded only). Only a vetted contractor upon receipt of a direct order via a force process may obtain a download.
18. If the surveillance camera system is jointly owned or jointly operated, is it clear what each partner organisation is responsible for and what the individual obligations are?
.
19. Have you identified any areas where action is required to conform more fully with the requirements of Principle 4?
Yes
Action Plan
Appoint a SPOC within the applicable governance arrangements.
Principle 5
Clear rules, policies and procedures must be in place before a surveillance camera system is used, and these must be communicated to all who need to comply with them.
20. Do you have clear policies and procedures in place to support the lawful operation of your surveillance camera system? If so, please specify.
No
21. Are the rules, policies and procedures part of an induction process for all staff?
No
22. How do you ensure continued competence of system users especially relating to relevant operational, technical, privacy considerations, policies and procedures?
The system will be reviewed annually to ensure it is still fit for purpose and to address any change in geography surrounding the police premises. Essex police have a preventative maintenance contract for CCTV which will ensure all systems are fit for purpose and meeting their objectives. If any alterations take place to the police building the camera surveillance would be addressed at the time of the development.
23. Have you considered occupational standards relevant to the role of the system users, such as National Occupational Standard for CCTV operations or other similar?
No
24. If so, how many of your system users have undertaken any occupational standards to date?
Not Applicable
25. Do you and your system users require Security Industry Authority (SIA) licences?
No
26. If your system users do not need an SIA licence, how do you ensure they have the necessary skills and knowledge to use or manage the surveillance system?
Only trained authorised members of police staff will be able to review the data.
27. If you deploy body worn cameras, what are your written instructions as to when it is appropriate to activate BWV recording and when not?
Not Applicable - Refer to Body Worn Video Assessment
28. If you deploy surveillance cameras using drones, have you obtained either Standard Permission or Non-Standard Permission from the Civil Aviation Authority and what is your CAA SUA Operator ID Number?
Not Applicable - Refer to UAV Assessment
29. Have you identified any areas where action is required to conform more fully with the requirements of Principle 5?
No
Action Plan
Not Applicable
Principle 6
No more images and information should be stored than that which is strictly required for the stated purpose of a surveillance camera system, and such images and information should be deleted once their purposes have been discharged.
30. How long is the period for which you routinely retain images and information, and please explain why this period is proportionate to the purpose for which they were captured?
Information captured will be stored on a recorder located in the premises, and stored for 31 days before being overwritten on the 32nd day. This period is proportionate to allow for any evidence captured to be viewed/downloaded in the event of crime or disorder on police premises.
31. What arrangements are in place for the automated deletion of images?
Recorded images will be kept for 31 days and recorded over on the 32nd day.
32. When it is necessary to retain images for longer than your routine retention period, are those images then subject to regular review?
No
33. Are there any time constraints in the event of a law enforcement agency not taking advantage of the opportunity to view the retained images?
No
34. Do you quarantine all relevant information and images relating to a reported incident until such time as the incident is resolved and/or all the information and images have been passed on to the enforcement agencies?
No
35. Have you identified any areas where action is required to conform more fully with the requirements of Principle 6?
No
Action Plan
Not Applicable
Principle 7
Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.
36. How do you decide who has access to the images and information retained by your surveillance camera system?
Only authorised members of police staff will be able to review the data, provided there is a valid policing purpose, the relevant authority has been given and there is an audit log created for the download (where data is downloaded only). Only a vetted contractor upon receipt of a direct order via a force process may obtain a download.
37. Do you have a written policy on the disclosure of information to any third party?
Yes
38. How do your procedures for disclosure of information guard against cyber security risks?
All systems are stand alone with no access to external network / internet connection. No additional security features installed.
39. What are your procedures for Subject Access Requests where a data subject asks for copies of any images in which they appear?
Essex police have policies in place to deal with data access requests.
40. Do your procedures include publication of information about how to make a Subject Access Request, and include privacy masking capability in the event that any third party is recognisable in the images which are released to your data subject?
Yes
41. What procedures do you have to document decisions about the sharing of information with a third party and what checks do you have in place to ensure that the disclosure policy is followed?
If required for evidential purposes, once data has been downloaded into a suitable format, it will be subject to legislation regarding the use and handling of police evidence.
42. Have you identified any areas where action is required to conform more fully with the requirements of Principle 7?
No
Action Plan
Not Applicable
Principle 8
Surveillance camera system operators should consider any approved operational, technical and competency standards relevant to a system and its purpose and work to meet and maintain those standards.
(There are lists of relevant standards on the Surveillance Camera Commissioner’s website.)
43. What approved operational, technical and competency standards relevant to a surveillance system and its purpose does your system meet?
Not Applicable
44. How do you ensure that these standards are met from the moment of commissioning your system and maintained appropriately?
Not Applicable
45. Have you gained independent third-party certification against the approved standards?
No
46. Have you identified any areas where action is required to conform more fully with the requirements of Principle 8?
No
Action Plan
Not Applicable
Principle 9
Surveillance camera system images and information should be subject to appropriate security measures to safeguard against unauthorised access and use.
47. What security safeguards exist to ensure the integrity of images and information?
Only authorised members of police staff will be able to review the data, provided there is a valid policing purpose, the relevant authority has been given and there is an audit log created for the download (where data is downloaded only). Only a vetted contractor upon receipt of a direct order via a force process may obtain a download. If required for evidential purposes, once data has been downloaded into a suitable format, it will be subject to legislation regarding the use and handling of police evidence.
48. If the system is connected across an organisational network or intranet, do sufficient controls and safeguards exist?
.
49. How do your security systems guard against cyber security threats?
In relation to cyber security risks, technical measures are in place to safeguard the information we hold. Most systems are stand alone with no access to local or external networks. Where a CCTV system is connected to the corporate network additional security safeguards are put in place. They are also subject to regular internal vulnerability scans using in-house tooling and are included in our annual IT health check (ITHC) carried out by a CHECK NCSC approved penetration test company.
Specific measures are unable to be released or documented in the public domain.
50. What documented procedures, instructions and/or guidelines are in place regarding the storage, use and access of surveillance camera system images and information?
U5000 - Policy CCTV
U5001 - Procedure - Estate CCTV Download Request
51. In the event of a drone mounted camera being lost from sight, what capability does the pilot have to reformat the memory storage or protect against cyber attack by remote activation?
Not Applicable
52. In the event of a body worn camera being lost or stolen, what capability exists to ensure data cannot be viewed or exported by unauthorised persons?
Not Applicable
53. In reviewing your responses to Principle 9, have you identified any areas where action is required to conform more fully with the requirements? If so, please list them below.
No
Action Plan
Not Applicable
Principle 10
There should be effective review and audit mechanisms to ensure legal requirements, policies and standards are complied with in practice, and regular reports should be published.
54. How do you review your system to ensure it remains necessary and proportionate in meeting its stated purpose?
The system will be reviewed annually to ensure it is still fit for purpose and to address any change in geography surrounding the police premises. Essex police have a preventative maintenance contract for CCTV which will ensure all systems are fit for purpose and meeting their objectives. If any alterations take place to the police building the camera surveillance would be addressed at the time of the development.
55. Have you identified any camera locations or integrated surveillance technologies that do not remain justified in meeting the stated purpose(s)?
No
56. Have you conducted an evaluation in order to compare alternative interventions to surveillance cameras? (If so please provide brief details)
No
The alternative option of physical guarding has been disregarded as too resource-intensive
57. How do your system maintenance arrangements ensure that it remains effective in meeting its stated purpose?
Essex police have a preventative maintenance contract for CCTV which will ensure all systems are fit for purpose and meeting their objectives.
58. Have you identified any areas where action is required to conform more fully with the requirements of Principle 10?
No
Action Plan
Not Applicable
Principle 11
When the use of a surveillance camera system is in pursuit of a legitimate aim, and there is a pressing need for its use, it should then be used in the most effective way to support public safety and law enforcement with the aim of processing images and information of evidential value.
59. Are the images and information produced by your system of a suitable quality to meet requirements for use as evidence?
Yes
60. During the production of the operational requirement for your system, what stakeholder engagement was carried out or guidance followed to ensure exported data would meet the quality requirements for evidential purposes?
ICO / SCO guidance was reviewed when operational requirements were created.
61. Do you have safeguards in place to ensure the forensic integrity of the images and information, including a complete audit trail?
Yes
62. Is the information in a format that is easily exportable?
Yes
63. Does the storage ensure the integrity and quality of the original recording and of the meta-data?
Yes
64. Have you identified any areas where action is required to conform more fully with the requirements of Principle 11?
No
Action Plan
Not Applicable
Principle 12
Any information used to support a surveillance camera system which compares against a reference database for matching purposes should be accurate and kept up to date.
65. What use do you make of integrated surveillance technology such as automatic number plate recognition or automatic facial recognition software?
Not Applicable
66. How do you decide when and whether a vehicle or individual should be included in a reference database?
Not Applicable
67. Do you have a policy in place to ensure that the information contained on your database is accurate and up to date?
.
68. What policies are in place to determine how long information remains in the reference database?
Not Applicable
69. Are all staff aware of when surveillance becomes covert surveillance under the Regulation of Investigatory Powers Act (RIPA) 2000?
.
70. Have you identified any areas where action is required to conform more fully with the requirements of Principle 12?
No
Action Plan
Not Applicable