GDPR – CCTV Policy

1.3. This system consists of 16 fixed cameras.

1.4. The CCTV system is owned and operated by TRIPLAST, its implementation being determined by the Organization’s management.

1.5. The CCTV system is monitored centrally by the following people: Zsolt-Levente Török, István Zsolt Csepán

1.6. All authorized operators and employees who have access to images have been made aware of the procedures to be followed when accessing recorded images. All employees have become aware of the restrictions on access to recorded images, as well as their disclosure.

1.7. The use of the CCTV system will be carried out in a professional, ethical and legal manner and any misappropriation of CCTV security technologies for other purposes is prohibited by this policy. For example, the CCTV system will not be used to monitor employee performance.

JUSTIFICATION FOR THE USE OF CCTV 2.1. The purpose of recording images using a video surveillance system (CCTV) includes protecting premises, preventing incidents, mitigating the impact or facilitating the investigation of possible incidents, catching perpetrators in the act, preventing illegal acts, protecting human life, physical integrity and personal freedom, protecting trade and of securities, property protection, as well as legal investigation of consumer complaints. The operation of a closed circuit television (CCTV) system contributes decisively to the achievement of the above objectives, since a significant part of the incidents can be prevented if potential criminals know that their actions will be captured by a camera, and a most incidents, violations and complaints can be investigated by viewing recorded images.

2.2. For each camera installed, TRIPLAST assessed the necessity of data processing taking into account the above purposes.

2.3. Although less intrusive methods were sought, none were found. Currently, there is no other technology or solution that allows the reconstruction of past events in connection with a complaint, accident or crime without recording images, and therefore the achievement of these goals cannot be ensured by using less intrusive means. From the point of view of property protection, it is possible to use only an alarm system, but this would not allow the investigation of accidents or complaints, the detection of crimes and the identification of perpetrators. The possible anonymization of the recordings and the blurring of the faces of the data subjects would also make it impossible to identify the data subjects in the recordings and therefore their fundamental purpose (protection) could not be achieved. In addition, without storage for a certain period of time, the records could not be used as evidence or as a means of carrying out checks.

2.4. Given that the previously discussed aspects, CCTV monitoring by TRIPLAST it’s necessary.

DATA PROTECTION IMPACT ASSESSMENT (DPIA) 3.1. When installing new CCTV systems or cameras, TRIPLAST will carry out a full data protection impact assessment, identifying the risks caused by their installation and ensuring full compliance with data protection legislation. This may involve the need for staff consultation.

3.2. Where there are CCTV systems operating prior to May 2018, TRIPLAST will endeavor to carry out a full data protection impact assessment on the occasion of any system upgrades or replacements or within 3 years of the GDPR implementation date, whichever occurs first.

ROOM LOCATION 4.1. Cameras will be located to capture images relevant to the purposes for which they are installed and steps will be taken to ensure that reasonable expectations of privacy are not violated.

4.2. TRIPLAST shall ensure that the location of the equipment is determined with rules depicted above.

5.3. Appropriate signage will also be prominently displayed at the entrance. The signage will include the name and contact details of the data controller, as well as the specific purposes for which the CCTV camera is placed at each location and indications of where more information can be obtained (eg: link and/or QR code to the notice of on the site).

STORAGE AND STORAGE 6.1. Recordings and monitoring equipment will be stored in a secure manner in a restricted access area. Unauthorized access to that area will not be permitted under any circumstances. The area will be locked when not occupied by authorized personnel. A record of access to records will be kept. Access to the CCTV system and stored images will only be allowed to authorized personnel. At the time of accessing the images, two members of the authorized staff must be present. A written access report will be drawn up. These reports will be kept.

6.2. A record will be kept of the date of any disclosure, together with details of the person to whom that information was provided (the name of that person and the business they represent), the reason for the request, and the manner in which the request was resolved, where an appeal.

6.3. Data will be provided in response to authorized requests in a permanent format where possible. If this is not possible, the data subject will be given the opportunity to view the recording.

6.4. In relevant circumstances, CCTV recordings may be accessed by the police or provided to courts or other public authorities when required by law.

REQUESTS OF THE PERSON CONCERNED (CPV) 7.1. Individuals are granted the right to access CCTV footage of themselves under the GDPR.

7.2. Individuals submitting such requests will be required to provide sufficient information to ensure identification of the record with respect to them. For example, date, time and location.

7.3. The organization will respond to these requests within 30 calendar days of receiving the request, in accordance with the policy on the facilitation of rights under the GDPR.

7.4. The organization reserves the right to refuse access to CCTV recordings where this would infringe on the legal rights of individuals or could prejudice an ongoing investigation.

7.5. A record will be kept of the date the disclosure took place, together with the details of the person to whom this information was provided (the name of the person and the business they represent) and the reasons for this request.

7.6. In the course of providing a person with a copy of their data, the Organization will make available to them a photograph/series of photographs, a tape or a magnetic disk with the relevant images. However, other people’s images will be hidden before this data is handed to them.

7.7. When the recording contains images related to unveiled body parts, the Organization will take the necessary steps to mask and protect the identity of those individuals.