Share

This CCTV & ANPR Code covers the use of closed circuit television (CCTV) in Q-Park facilities, both for security purposes and for automatic number plate recognition (ANPR). While the code sets out the company’s policies and understanding of international good practice, different countries may have particular regulatory provisions that Q-Park operators need to take into account in developing their operating procedures.

The code incorporates a company-wide set of standards the objective of which is to ensure that good practice standards are adopted throughout Q-Park, that customers are confident that Q-Park operates within the law and to high standards, and that the business derives maximum benefit from available technology.

All Q-Park operators are required to comply with this code.

Because CCTV can record the activities of individuals, its use is regulated by the EU Data Protection Directive, as transposed into law in all EU countries. There are some differences in how the law applies in different countries. In all cases, however, the rights of the people recorded (the data subjects) must be respected.

Principles of data protection

The person or organisation that is legally responsible for the data captured by CCTV is the data controller.

The data controller determines exactly what is to be recorded and at what level of detail, how the images may be used, and the circumstances in which they may be disclosed.

Q-Park data controllers are responsible for ensuring that the following principles of data protection (as enshrined in the EU Directive) are upheld.

• Notice: People should be told that their data is being collected.

• Purpose: Data should be used only for its specified purpose, and not for any other purposes.

• Consent: A person's data should not be disclosed without their consent.

• Security: Data that is captured or collected should be securely stored.

• Disclosure: People should be told who is collecting their data.

• Access: People should be allowed to access their data and make corrections to any inaccurate data.

• Accountability: People should be able to hold collectors accountable for following these principles.

Installing and operating

In relation to the installation and operation of CCTV, Q-Park takes the following guidelines into account.

Identification of specific and legitimate purpose

The CCTV system is designed to satisfy a specific and legitimate purpose – such as recording the entry and leaving time of vehicles. In designing our systems, we take into account how the images will be processed – for example, it may be necessary to include wider details of the car or driver.

Use of suitable and proportionate technology

The technology we use – cameras, servers, software and so on – is adequate for the purposes for which we intend to use it, and it is configured in such a way that it gathers only the data we need, and at a resolution or quality that is adequate. We ensure that cameras are located so that they do not capture images that are not relevant to our purposes.

Provision of clear signage

Where we install cameras, we make it clear to people that they or their cars are on camera. We place the signs in places where they are most likely to be seen – for example, at car park entrances – and the signs are large enough to be readable from the arriving driver’s position. The signs clearly state the purpose of the CCTV recording and include details of who is responsible for managing the system and how they may be contacted. There may, however, be circumstances in which we install CCTV cameras to gather evidence of specific activities that we intend to bring to the attention of the police – in this case we do not need to provide signage. However, we do not use any other data captured by such a camera for any other purpose.

Registration with data protection authorities

Images of people and their identifiable property captured by CCTV are personal data, and acting as a data controller involves serious legal responsibilities. In some countries, individuals or organisations that capture CCTV data are required to register with their national data protection authority. Q-Park operators liaise with their local regulatory authorities to ensure compliance with regulatory obligations.

Managing captured data

Once Q-Park has captured data via CCTV, we have legal responsibilities to ensure its confidentiality and safe custody. We also have responsibilities for making the data available in particular circumstances.

Clear policies and procedures

Our installation of CCTV systems is underpinned by strong governance arrangements that ensure accountability, transparency and secure custody of the private data we are capturing. To achieve this we have clearly documented policies and procedures, and we ensure that all staff are trained to meet their responsibilities and obligations. Our policies and procedures in this respect apply both to those who manage the cameras and other equipment and to those responsible for any image processing – for example, in relation to billing.

Retention of images for only as long as needed

As well as capturing only the data that we need for our specified purposes and keeping it secure, we also ensure that we do not keep data for any longer than required to meet those purposes. However, we do not delete data that is the subject of an access request from the police or other legal authorities, or from someone seeking access to their own data.

Restricting access to captured data

Data captured from CCTV is stored securely and in such a way that the integrity of images is maintained. Access to data is restricted to authorised people and in clearly defined circumstances. The data controller in each Q-Park facility is responsible for granting access to data to third parties, including the police.

Clear procedures relating to disclosure

Data is disclosed only in very particular circumstances (usually to the police) and this is done in a secure manner that ensures that only the intended recipient can view the images. There may be circumstances where disclosure of images to a third party is warranted – for example, someone making an insurance claim may request footage of their car being damaged in a Q-Park facility. In such cases, we must be satisfied that no uninvolved person is included in the images; and if there is, we edit the images before releasing them.

Automatic number plate recognition (ANPR)

ANPR is a technique that may be used to record the entrance and exit of cars. In facilities where Q-Park uses ANPR, we acknowledge that this involves capturing private data, and for that reason we do so in a way that is reasonable, consistent and transparent, and we comply rigorously with the data protection principles outlined in this CCTV and ANPR code.

In cases where Q-Park uses ANPR for billing, we take good care to ensure that the reference data we use to connect number plates to car owners is accurate and up to date.