It is recommended that where CCTV systems are not already installed in school/ETB grounds, and an actual need for CCTV monitoring has been identified, the CCTV system should only be introduced following consultation by the board of management/ETB with staff, students and parents and following a privacy impact assessment being carried out (see the template Privacy Impact Assessment at appendix 2 of the CCTV Policy Template. Where CCTV systems are already in place, their use will be reviewed periodically, in consultation by the board of management with staff, students, and parents.
Where CCTV is in operation, the School should have a CCTV Policy in place.
Template CCTV policy for Schools: Download CCTV Policy Template. For assistance in developing a CCTV policy, and operating a CCTV system in compliance with data protection.
The principal rationale for the installation of such systems can primarily be for security purposes.
PRE-GDPR advice from the Data Protection Commissioner:
The Data Protection Commissioner recognises that CCTV recording may be justified for securing the perimeter of school property. However it may not be justifiable for day-to-day monitoring of staff and students. The Data Protection Commissioner advises that CCTV cameras should not enter the classroom itself. The Commissioner also advises that it would be difficult to justify the use of CCTV in offices. Indeed, any use beyond monitoring the perimeter of the school/ETB premises would need to be fully justifiable and evidence-based, with a very high threshold for such evidence. For example, it may not be justified or proportionate to continually monitor staff and students through the CCTV system, and such monitoring could be highly intrusive and in breach of the Data Protection Acts. In addition, if the CCTV recording is being used to tackle and prevent criminal/anti-social behaviour/ theft/vandalism in known trouble-spots, the school/ETB may have to demonstrate that monitoring/ patrolling the area periodically by staff was not working and that the criminal/anti-social behaviour was continuing or the cost of monitoring was prohibitive. In order to justify the erecting of CCTV cameras in an area, the school/ETB may have to show that the location was a proven trouble-spot which had generated significant problems in the past (including a risk to security, and/or to the health and safety of staff and students) and therefore constituted a security/safety concern which the CCTV monitoring was designed to address. For example, see the Data Protection Commissioner’s case study 8 of 2010, in which it is stated that using CCTV for a non-security related matter (i.e.to address a work performance issue) could be in breach of the data protection acts. The school/ETB will therefore have to ensure that the CCTV recording is justified, necessary, reasonable and proportionate in all the circumstances.
It is important to note that the location of the CCTV cameras should be chosen with great care and should not be erected in places where individuals would have a reasonable expectation of privacy (such as changing rooms and bathrooms). In general, CCTV cameras on school/ETB premises will be erected in a fixed place and should not be rotated/ trained on certain individuals or events. Schools/ETBs should ensure to the greatest extent possible that there is no (or only minimal) recording of passers-by or another person’s private property. See in particular, the Data Protection Commissioner’s case study 8 of 2005 (“CCTV Cameras on the Luas Line”).
Schools/ETBs should be aware that the images captured on CCTV may have to be handed over to An Gardai Síochána as part of inquiries into criminal activity (see “What if a school is asked by a law enforcement authority for access to the recordings?” set out below). The images may also have to be handed over to the individuals captured on the CCTV, who will each be considered a “data subject” and has the right to make a data access request.
The school/ETB will have to ensure that it can provide data subjects with copies of that subject’s images captured by the CCTV system, pursuant to a data access request. In the access request, the data subject should provide the date, time and location of the recording to assist the school/ETB in locating images relating to that particular person. In giving the person a copy of their data, the school/ETB may provide a still/series of still pictures, a tape or disk with relevant images. However the images of any other person appearing on the data should be obscured before the data is released to the applicant.
The CCTV system should only be accessible by the principal or other school employees who need to have access to the data (such as the deputy principal in the principal’s absence). An access log should be maintained by the school/ETB, stating who accessed the recordings/images, on what dates and times and for what purposes.
It is important that the recordings are securely stored in a locked location and that the images are safely deleted at regular intervals. The school will need to develop a retention period that can be justified. Pre-GDPR, the Data Protection Commission Office commented that, “it would be difficult to justify retention beyond a month, except where the images identify an issue – such as a break-in or theft - and is retained specifically in the context of an investigation of that issue”.
Schools are advised that the retention period for CCTV images/recordings should be a maximum of 28 days, unless where the CCTV images/recordings capture issues (such as criminal behaviour or a risk to health and safety) and the CCTV images/recordings are retained to investigate that issue.
A notice informing people that CCTV is in operation should be displayed in a prominent position in areas where CCTV recordings are being made and also at the entrance to the school/ETB property. The sign should be clear and legible. The Data Protection Commissioner sets out requirements for these notices and the school’s notice could state:
Warning: CCTV in operation Images are being monitored and recorded for the purposes of crime prevention, the prevention of anti-social behaviour, for the safety of our staff and students and for the protection of school/ETB property. The system will be in operation 24 hours a day, every day. These images may be passed to An Garda Síochána. This system is controlled by [insert name of school/ETB]. For more information, call [insert telephone number of school/ETB].”
Where the CCTV is operated or controlled by a third party (such as a commercial security company), the school/ETB must put a written data processing agreement in place with that security company. For further advice and guidance, see also Content of Service Agreements.