Our Contact Details
Any queries regarding our use of your information should be sent to the Data Protection Officer at:
data.protection@senedd.wales 0300 200 6565
How your information will be used
Closed-circuit Television (CCTV) cameras capture visual images in real time across the estate. Cameras are in operation inside and outside of our buildings in Cardiff Bay: the Senedd building; Tŷ Hywel; and, the Pierhead building, car parks and public areas (and may extend to areas outside of the Welsh Parliament Estate).
The Senedd Commission has an office in North Wales located in the Welsh Government building in Sarn Mynach, Conwy. The CCTV cameras in operation in and around this building are owned and operated by the Welsh Government. For further information regarding their use, please refer to the Welsh Government’s privacy information which can be found on their website.
Automated Number Plate Recognition (ANPR) cameras are in operation on Britannia Quay Road and capture images of vehicles which travel via this road or that enter the Senedd Estate. The ANPR system does not link to or run against any preexisting databases.
The Senedd Commission is the data controller of the information captured and will ensure that information is protected and processed in line with data protection legislation.
Signage is in place both inside and outside our buildings to make individuals aware that cameras are in operation.
What information are we collecting?
Static and moving images of individuals, vehicles and licence plates linked to individuals.
Recorded footage may reveal personal characteristics and identifiable features, including special category personal data such as an individual’s racial or ethnic origin or data concerning an individual’s health.
Where certain activities or incidents occur, cameras may also capture criminal offence data such as criminal activity.
Why are we collecting it?
Information will be processed for one or more of the following purposes:
- It is essential that we ensure the health and safety of employees, service users and visitors to the Senedd estate;
- To act in the interest of the general public to ensure your safety and wellbeing while visiting;
- To detect, prevent or reduce the possibility of crimes;
- To prevent and respond effectively to all forms of harassment and disorder;
- To reduce the fear of crime;
- To create a safer environment;
- To provide support to emergency services;
- To assist with health and safety and other serious occurrences, including employment issues, for example, disciplinary investigations, where appropriate to do so;
- For the defence of the Welsh Parliament regarding any potential legal issues that could arise or furthermore any possible civil matters that may arise;
- To train and further develop our staff;
- To protect and secure Welsh Parliament buildings and the property of the Welsh Parliament;
- For the purposes of supporting counter-terrorism activities; and,
- Additionally, the data captured may be used as evidence regarding possible criminal offences or other matters related to security measures in operation.
Who will have access to the information?
Images will be accessible by Security staff members who work within the Senedd Commission’s control room. Security Officers with access will have received appropriate training and are authorised to operate the CCTV system in a responsible and legal manner.
Images may be shared internally with other departments (in relation to the purposes listed). Internal processes are in place to ensure there is a legitimate and lawful reason for the required access and any internal sharing will be undertaken in accordance with data protection legislation.
we may be required to disclose or retain footage in order to: comply with requests for information (such as those made under data protection legislation); to meet a legal obligations; or, to meet another legitimate or public interest.
Will the information be shared with any third parties, or publicised?
We may need to share your data with third parties. We will only do this if it necessary or we are required to do so by law.
We may be required to provide footage to the Police or other Government agencies to aid with ongoing investigations. We may also be asked to provide footage to third parties (such as insurance companies or solicitors) where there is an appropriate claim or legal activity which requires its disclosure, or to the Senedd Commissioner for Standards during the course of an investigation relating to a Member of the Senedd.
Supervised and controlled access will be given to specialist maintenance contractors to conduct repairs and general maintenance work when required.
However, there is no planned, regular, or scheduled sharing of CCTV data in place with any external organisations. Should this situation change, this privacy notice will be updated and reissued, to ensure that individuals are fully aware with how the Commission processes personal data at the Senedd.
Where will the information be stored?
Images captured by the CCTV and ANPR equipment are kept on the secure CCTV system which resides within the Security control room. Access to this room and equipment is limited to necessary individuals with relevant security clearance.
Any footage that is exported from the secure CCTV system for retention beyond 31 days is stored on encrypted and security graded hard drives that are kept securely in a locked evidence locker.
How long will the information be retained?
Images captured by the CCTV and ANPR equipment are kept on the secure system for 31 days.
However, there may be instances where we need to retain footage beyond this period. This may be, for example, if captured images are required for any legitimate investigation or needs to be retained in preparation for a prospective request.
In most cases, this footage would be kept for up to a 6-month period initially and then the Senedd’s Senior Security Officers will make the decision if the exported footage needs to be deleted or retained for another 6-month period up to a maximum of 6 years.
How will the information be disposed of?
The footage captured by the secure CCTV system is automatically deleted after 31 days by the Video Management Software which is also installed, in line with our retention schedule.
Any footage that is exported from the secure CCTV system will be securely deleted when the reason for the export has been met.
Our legal bases for collecting, holding and using your personal information
Data protection law sets out various legal bases which allow us to collect, hold and use your personal information. For the purpose of processing the personal data captured by CCTV equipment and ANPR technology, we will usually rely on the processing being necessary for the performance of a task carried out in the public interest (Article 6(1)(e) UK GDPR). This is because the Senedd Commission has certain public functions set out in law and the processing is necessary for us to meet our ‘public task’.
The Senedd Commission has a statutory function in the Government of Wales Act 2006 (“GOWA”) to provide the Senedd with the staff, services and property required for its purposes. As per GOWA, the Senedd Commission may do anything which appears to it necessary or appropriate for the purpose of, or in connection with, the discharge of its functions.
This includes meeting the security needs of the Senedd estate, for example to ensure the safety of those who work on and visit the estate, and to protect the Senedd’s physical infrastructure. This includes using technology to enhance our security capabilities.
As per the above, we are also required to provide staff to enable the Senedd to discharge its functions. This means that certain legal requirements relating to staffing have to be met, such as ensuring the health and wellbeing of staff and reviewing incidents involving staff. On occasion, this may involve referring to CCTV footage for this purpose.
However, there may be instances where we need to rely on another legal basis. This may include as follows:
The processing is necessary for the performance of a contract (Article 6(1)(b) UK GDPR): for example, the Senedd Commission enters into employment contracts with its staff. In administering and meeting obligations under those contracts, there may be instances where the Senedd Commission needs to refer to CCTV footage.
This could include during disciplinary proceedings or where an incident has occurred and CCTV footage needs to be reviewed as part of a ‘lessons learned’ exercise to ensure the health and safety of its staff.
The processing is necessary for compliance with a legal obligation (Article 6(1)(c) UK GDPR): for example, if we are required by law to process CCTV footage in a certain way in order to comply with a court order or a request for information exercised by a third party via a statutory power.
The processing is necessary for a legitimate interest (Article 6(1)(f) UK GDPR): there will be circumstances where it is necessary to process personal data in a certain way that falls outside of the Senedd Commission’s public functions but are necessary for the purposes of meeting a legitimate interest. For example, there may be instances where we need to share CCTV footage with a third party that fall outside of our ‘public task’, such as for journalistic purposes, or where we have wellbeing or safeguarding concerns for an individual and, in the absence of a legal obligation, need to share footage with a third party or retain it beyond our usual 31 days retention period.
Special category personal data
Data protection law affords certain types of personal data a higher degree of protection due to their sensitivity and places additional legal requirements in relation to the processing of that personal data. This is known as special categories of personal data. This includes, amongst others, any personal data revealing racial or ethnic origin, religious or philosophical beliefs, sexual orientation and data concerning health.
As our cameras capture footage in real time, they will capture personal data that fall within these categories.
Data protection law requires that where we process special categories of personal data, we must identify a separate condition for processing under Article 9 of the UK GDPR, in addition to our legal basis (or bases) under Article 6 of the UK GDPR.
Where any special category data is processed by our CCTV equipment and ANPR technology, we will usually rely on the processing being necessary for reasons of substantial public interest (Article 9(2)(g) UK GDPR) for the reasons set out above in relation to our ‘public task’.
Where we process personal data because it is necessary for reasons of substantial public interest, we are also required to meet an additional condition in Schedule 1 to the Data Protection Act 2018 (“DPA”). The additional conditions we may rely on are as follows:
- Paragraph 6 of Schedule 1: Statutory etc and government purposes;
- Paragraph 10 of Schedule 1: Preventing or detecting unlawful acts;
- Paragraph 12 of Schedule 1: Regulatory requirements relating to unlawful acts and dishonesty etc;
- Paragraph 13 of Schedule 1: Journalism etc in connection with unlawful acts and dishonesty etc;
- Paragraph 18 of Schedule 1: Safeguarding of children and individuals at risk;
- Paragraph 20 of Schedule 1: Insurance.
However, there may be instances where we need to rely on another legal basis, other than or in conjunction with the substantial public interest. This may include as follows:
The processing is necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment (Article 9(2)(b) UK GDPR), read in conjunction with paragraph 1 of Schedule 1 DPA: this would include, for example, where we need to process CCTV footage containing personal data in order to ensure the health, safety and welfare of our staff, perhaps in order to review CCTV footage to assess a health and safety risk.
The processing is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) UK GDPR): this would include, for example, where processing CCTV footage containing personal data is necessary in relation to actual or prospective court proceedings or where we need to establish, exercise or defend our legal rights, or where we need to share CCTV footage with external legal advisers in order to obtain legal advice in relation to a current or prospective claim.
Criminal offence data
Data protection legislation gives extra protection to “personal data relating to
criminal convictions and offences or related security measures”. This is referred to as criminal offence data. In relation to CCTV footage and ANPR technology, this would include where cameras record criminal activity or footage needs to be shared with a third party to aid a criminal investigation.
In accordance with section 10 DPA, when we process criminal offence data, we are required to meet an additional condition under Schedule 1 DPA, in addition to our legal basis under Article 6 UK GDPR (and Article 9 UK GDPR when processing special category data). As well as the Schedule 1 conditions referred to above (in the “special
category personal data” section), we may also rely on the following when processing criminal offence data:
- Paragraph 33 of Schedule 1: Legal claims;
- Paragraph 36 of Schedule 1: Extension of conditions referring to substantial public interest;
- Paragraph 3 of Schedule 1: Extension of insurance
Your rights
As a data subject, you have a number of rights. The rights which apply depend on the legal bases we are relying on to use your personal information. Those rights will not apply in all instances, and the Commission will confirm whether or not that is the case when you make a request.
The rights include the right to request access to your own personal information, sometimes called a ‘subject access request’.
Additionally, you have the right to request from us:
- that any inaccurate information we hold about you is corrected (please note that you are required to keep us up to date with any changes to your personal information);
- that information about you is deleted (in certain circumstances);
- that we stop using your personal information for certain purposes or in certain circumstances; and
- that your information is provided to you or a third party in a portable format (again, in certain circumstances).
If you would like to engage any of the rights that you have under data protection legislation, ask a question or make a complaint about how your information is used; please contact the Data Protection Officer using one of the methods set out at the above.
Requests for information made to the Commission
In the event of a request for information being made under access to information legislation, it may be necessary to disclose all or part of the information that has been captured. We will only do this if we are required to do so by law.
How to complain
You can complain to the Data Protection Officer if you are unhappy with how we have used your data. Contact details can be found above.
If, following a complaint, you remain dissatisfied with our response, you can also complain to the Information Commissioner’s Office (ICO).
The ICO’s address is:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113