This policy serves to outline the manner in which CCTV systems are used by Chemist Warehouse Ireland (CWIRE). It also outlines the rights of data subjects with regard to the processing of their personal data in this manner.
CWIRE, shall at all times retain the role and associated responsibilities of data controller in respect of the CCTV systems in use across the organisation's portfolio. This CCTV policy shall apply to all CCTV systems at existing company properties and any subsequent systems which may be added to the network as the portfolio grows.
This policy applies only to camera systems owned, operated and controlled by Chemist Warehouse Ireland.
This policy takes account of all applicable legislation including:
This policy will be available at stores and across all associated websites. Access to this policy will be provided to all interested parties upon request, as is the right of data subjects under Art.15 of the EU GDPR. In order to facilitate the timely provision of access, the policy will be held in hard copy at all company properties.
Where access has been provided to a hard copy document, a log recording this access will be maintained by store management for records management purposes.
Respective store managers will have day to day responsibility for the day-to-day implementation of this policy and the management and oversight of the CCTV systems to which it relates on behalf of the data controller. This oversight shall be supported at all times by the data protection officer and other relevant employees.
Administration and documentation standards connected with effective CCTV management will be regularly audited by the business, and improvements made where necessary.
CCTV data processed by CWIRE shall be collected for specified, explicit and legitimate purposes and not further processed in a manner which is incompatible with these purposes as set out under Art. 5 (1) (b) of the EU GDPR.
The business shall utilise CCTV across the organisation's store portfolio in accordance with the following legal bases:
All camera installations have been completed in a manner designed to suit the purposes for which they are in use. Cameras are located in prominent positions where they are clearly visible to all visitors to the properties in question.
Cameras have been installed in a manner designed to minimise the coverage of public areas around the property at which they are located.
No cameras are in use in areas where individuals are likely to have an increased expectation of privacy.
This policy will be communicated to all employees.. Furthermore, a hard copy of this policy will be retained at all stores and may be examined upon request by any individual.
Clear and informative signage will be placed in all entrance points and at any other prominent access points to buildings. These will be placed so that they are clearly visible. The contact details for our data protection officer will be included in all signage as required under the EU GDPR.
Before any additions or alterations are made to existing camera systems such as the installation of additional cameras, all steps will be taken to assess the potential impact these actions may have on the rights of individuals. Where necessary a full data protection impact assessment will be conducted and documented prior to the cameras going live.
Chemist Warehouse Ireland’s priority during all installations is to adopt a privacy by design and default approach. The aim is to avoid collecting, processing or storing any more data than is necessary at all times.
Nominated members of the team at each store shall have day to day responsibility for the operation and oversight of the CCTV system at their property. Viewing and downloading of footage shall be assigned to nominated team members. These individuals shall be Data Protection Responsible Persons (DPRPs) for the property at which they are employed. A register of Data Protection Responsible Persons shall be maintained by the data protection officer.
DPRPs will receive training on the compliant management of CCTV evidence. No other individual with the exception of the nominated individuals shall be permitted to view, share or download CCTV evidence unless doing so under the terms set out within this document for sharing data.
CCTV systems shall be checked by the nominated staff members at least twice per day. DPRPs shall ensure that their system is fully operational and that the time and date settings are accurate. Any issues with CCTV systems should be shared in writing with the loss prevention officer and the data protection officer as soon as they are noticed.
A log of access to CCTV evidence including details of the data in question will be maintained by the DPRP for each store. These logs will be shared with the data protection officer at the end of each month for records maintenance purposes.
Images recorded by CWIRE operated systems will typically be stored for a period of sixty days only.
A retention period of sixty days is both necessary and within the legitimate interests of our business as a result of the business’s claims history. Furthermore, we regularly receive requests for access to our street facing cameras from An Garda Siochana outside of the standard thirty day window. As such an extended retention period is also necessary for the purposes of assisting with crime prevention and detection efforts in the areas in which our stores are located.
In certain circumstances, where data is required to be retained for a longer period, this footage shall be downloaded and stored securely. Such downloads shall be completed in line with the principle of data minimisation. Data shall not be retained for any longer than is necessary.
Chemist Warehouse Ireland, as data controller, will ensure that appropriate technical and organisational measures are implemented across the organisation's portfolio to prevent the unlawful disclosure of data. Measures will include but not be limited to the following:
Any individual captured by CCTV cameras is a data subject for the purposes of data protection legislation. Data subjects are afforded several rights under the legislation. One of these rights is to be provided with a copy of any personal data held about them.
An individual making such a request will be deemed to have submitted a data subject access request under Art.15 of the EU GDPR. Whilst such requests do not need to be made in writing, data subjects will be encouraged to submit their request by email to [email protected]. This will enable the business as a data controller to respond to requests in a timely manner.
Data requests will be required to be accompanied by proof of identification for verification and records purposes. All requests will be responded to within the timelines set out under the EU GDPR.
In order to protect the rights of unrelated parties, footage will be anonymised as necessary before being provided as part of an access request.
In certain circumstances, the business may be required to share data with investigating members of An Garda Siochana. Data will only be shared upon receipt of a valid Section 41 (b) request form. A record of all data shared with An Garda Siochana will be maintained by our data protection officer.
In certain circumstances, the business may be required to share data with third parties such as insurance companies, legal representatives or service providers. All such requests will be completed in a fully compliant manner with the rights of individuals as a priority at all times. All necessary steps as outlined above will be taken to protect the privacy of individuals.
This and all other data protection policies shall be reviewed on an ongoing basis to ensure they remain sufficient and accurate in light of any changes to Chemist Warehouse Ireland’s processing activities or to any legislative changes which may come into force. Reviews will be conducted every six months at a minimum.
Where any breach of this policy or a data breach of any manner occurs, it will be investigated by our data protection officer with the assistance of relevant employees as soon as the organisation becomes aware of the breach.
In situations where a breach is deemed significant to warrant the supervisory authority and / or data subjects being notified, these communications will be made at the earliest opportunity. Communication shall always be made no later than 72 hours after the breach has been identified.
Any queries or complaints regarding the use of CCTV by Chemist Warehouse Ireland, or any other data protection related issues should be directed to the data protection officer at:
Individuals who, having raised a concern or complaint with CWIRE, yet remain unsatisfied with the response, retain the right to raise their issues with the office of the DPC.
The following details should be used for this purpose:
Office Of The Data Protection Commissioner
21 Fitzwilliam Square South
Dublin 2
