Policy Document

Gibraltar Public CCTV Scheme Code of Practice

The Royal Gibraltar (RGP) controls and operates the Gibraltar Government’s Public CCTV Scheme which includes CCTV cameras located at various points throughout Gibraltar. The RGP also operates a CCTV system at New Mole House and other police buildings. These CCTV systems operate with fixed and Pan, Tilt and Zoom (PTZ) cameras. This Code of Practice is intended to ensure the evidential integrity and effective management of all CCTV systems operated by the RGP

These CCTV systems have been notified to the Data Protection Commissioner (DPC) and a copy of the Code of Practice has been made available to the DPC.

Definitions System Controller = Headquarters System Manager = Command and Dispatch Sergeant or Custody Sergeant

The RGP is responsible for managing the control, monitoring, and recording of the cameras whilst operating under this Code of Practice.

The CCTV systems are password protected permanently. The Chief Headquarters and the Inspector of Professional Standards Department (PSD) will act as custodians of the password. In each instance when there is a change of personnel in these two posts the new incumbent will change the password.

Code of Practice The Public CCTV systems shall be operated with respect for all individuals and in such a way as to avoid infringement of individual privacy. The RGP recognises that it is their responsibility to ensure that the CCTV systems must always comply with all relevant legislation, to ensure its legality and legitimacy.

1 The external Public CCTV systems will only be used in so far as it is necessary for public safety, the prevention and detection of crime or public disorder.

The Code of Practice shall ensure that evidence is secured, retained and made available as required so that there is absolute respect for everyone’s right to a fair trial.

Objectives of the Public CCTV System The objectives of all RGP CCTV systems and the basis for the processing of data are:-

 Enhance community safety  Reduce the fear of crime  Deter and detect crime  Deter and detect acts of anti-social behaviour

In addition to these general objectives, the data controller may draw up specific key objectives (which will be reviewed annually) based on local concerns through consultation.

General Principles of Operation The RGP CCTV systems will be operated in accordance with the Data Protection Act 2004. It will be operated fairly and in accordance with the purposes for which they were installed within this Code.

The RGP CCTV systems will be operated with due regard to a general right to an individual’s private and family life and their home. The public interest in the operation of the RGP CCTV systems will be safeguarded by ensuring the security and integrity of operational procedures.

Throughout this Code of Practice it is intended, as far as reasonably possible, to balance the objectives of the RGP CCTV systems with the need to safeguard the individual’s rights. Every effort has been made throughout the Code to indicate that a formal structure has been put in place, including a complaint procedure.

Copyright Copyright and ownership of all material (data) recorded by any of the RGP CCTV systems will remain with the .

Cameras and Area Coverage This section of the Code of Practice refers exclusively to those areas covered by CCTV. All cameras will be positioned within an area suitably signed to alert the general public of their presence. The CCTV system has a “privacy mask” feature which allows for all windows and private areas to be masked out. This privacy mask setting will be applied to black out private areas which are not intended to be viewed or recorded. The CCTV system will therefore only view and record images of public areas which fall within its field of view.

Monitoring and Recording Facilities All images captured by the RGP CCTV systems are recorded throughout every 24 hour period.

2 Visitors Unsupervised visitors will not have access to view the CCTV system screens.

Processing and Handling of Recorded Material Recorded material whether digital, analogue or as a print will only be made available in accordance with this Code of Practice.

Operators Instructions The RGP will produce its own procedures, which shall comply with this Code of Practice and the Data Protection Act 2004.

Professional Standards Department & Audits PSD will be responsible for the effective management of the CCTV systems, ensuring the integrity and probity of the operating system for evidential purposes. PSD will conduct audits on the operation of the RGP CCTV systems and compliance with this Code of Practice. Audits will include examination of the monitoring room records and the content of recorded material.

Public Concern All personal data obtained by the RGP CCTV systems shall be processed in accordance with the objectives of the RGP CCTV systems. In processing personal data a person’s right to respect for his or her private and family life will be respected. The processing, storage and security of the data will be strictly in accordance with the requirements of the Data Protection Act 2004.

Data Protection Legislation The operation of the RGP CCTV systems has been notified to the Gibraltar Data Protection Commissioner in accordance with the Data Protection Act 2004. The ‘data controller’ for all RGP CCTV systems is the Royal Gibraltar Police. The legislation in summarised form:

 All personal data will be processed fairly and lawfully.  Data will be obtained only for the purposes specified.  Data held will be adequate, relevant and not excessive in relation to the purpose for which the data is processed.  Personal data will be held for no longer than is necessary.  Access to data will be done in accordance with individual’s rights  Procedures will be implemented to ensure security measures to prevent unauthorized or accidental access to, alteration, disclosure, or loss and destruction of, information.  Information shall not be transferred outside the European Economic area unless the rights of individuals are protected.

Complaints A member of the public wishing to register a complaint with regard to any aspect of the RGP CCTV systems may do so in accordance with the Data Protection Act 2004. Any performance issues identified will be considered under the disciplinary procedures to which all police CCTV operators are subject.

3 Evaluation The RGP CCTV systems will, periodically, be evaluated to establish whether the purposes of the RGP CCTV system are being complied with and whether objectives are being achieved.

Public Information - Code of Practice A copy of this Code of Practice shall be made available on the Gibraltar Government Website.

- Signs Signs will be placed in the locality of the cameras and at main entrance points to the relevant areas. The signs will indicate:

 The presence of CCTV monitoring;  The cameras are controlled by the Royal Gibraltar Police  The telephone number for the Royal Gibraltar Police

System Manager and Monitoring The System Managers will accept day to day responsibility for the monitoring and operation of the RGP CCTV systems and the implementation of this Code of Practice. The System Managers shall also be responsible for maintaining full management information as to any incidents dealt with in the Command and Dispatch Unit or whilst a person is in custody at NMH. Notwithstanding the System Manager’s responsibilities, the Duty Officer will equally ensure the correct operation and management of the CCTV systems.

Command and Dispatch Unit CCTV operators will not operate any of the CCTV cameras or system until they have received suitable training and are familiar with the Code of Practice. Everyone involved in the management and operation of the RGP and Public CCTV systems will be issued with a copy of the Code of Practice. They will be fully conversant with the contents of the Code and appropriate procedures, which may be updated from time to time, and with which they will be expected to comply.

Viewing Platform Viewing of live images from external CCTV cameras will be restricted to secure areas at:

 Command and Dispatch Unit  Gold Command

The data controller will list those persons who are authorised to view live images and amend the list accordingly.

Discipline Every officer with any responsibility under the terms of this Code of Practice and who has any involvement with the RGP CCTV systems will be subject to the RGP's disciplinary regulations. Any breach of this Code of Practice or of any aspect of confidentiality will be dealt with in accordance with the relevant disciplinary procedure

4 or DPA 2004. The System Manager will ensure that there is no breach of security and that the Code of Practice is complied with.

Guiding Principles Any officer operating the CCTV cameras will act with utmost probity at all times. CCTV cameras operators will be mindful of exercising prejudices, which may lead to complaints of the RGP CCTV systems being used for purposes other than those for which it is intended. The operators may be required to justify their interest in, or recording of, any particular individual, group of individuals or property at any time on inspection by PSD.

For the purposes of this Code 'recorded material' means any material recorded by any of the RGP CCTV systems, but specifically includes images recorded digitally, or on videotape or by way of video copying, including prints. Every digital recording obtained from the RGP CCTV systems has the potential of containing material that may need to be admitted in evidence at some point during the period of its retention.

Images recorded about a person’s ordinary every day activities by the RGP CCTV systems in accordance with the Data Protection Act 2004, will be treated with due regard to the individual’s right to respect for their private and family life. It is therefore of the utmost importance that irrespective of the means or format of the images obtained from any of the RGP CCTV systems, they are treated strictly in accordance with this Code of Practice from the moment they are received by the Command and Dispatch Unit until final destruction. Access to and the use of recorded material will be strictly for the purposes defined in this Code of Practice only.

It is expected that such recorded material will generally only be used or released for the purposes of crime detection, investigation and prevention. It may also be used on occasions for the purposes of traffic management, including monitoring of traffic flow and prevention of road traffic accidents.

Recorded material will not be copied or otherwise released for any use incompatible with this Code of Practice.

Maintenance of the System The Public CCTV systems will be maintained to ensure compliance with the Data Protection Act 2004 and that all images recorded continue to be of appropriate evidential quality. Monitoring Security Arrangements Access to the Command and Dispatch Unit Command and Dispatch Unit is restricted and only authorised personnel will be allowed inside. Only trained and authorised officers will operate any of the equipment located within the RGP Command and Dispatch Unit, (equipment associated with the CCTV systems).

Public access and visits Visitors to the Command and Dispatch Unit will be authorized and supervised.

Recorded Data – Retention Unless the data is required for evidential purposes, recorded data will be retained for a period of one calendar month. Digital recording will be set to overwrite automatically. 5

Recording of material for evidential purposes Material extracted for evidential purposes will be handled in accordance with the RGP ‘Evidential Digital Imaging Policy’.

Release of recorded material If recorded material is released in accordance with this code, a record must be kept by PSD, which identifies the basis for that release, and to whom. Records will be retained for at least three years. Recorded material may be used for bona fide training purposes.

Prints of recorded material Prints, subject to Data Protection, will be treated in the same way as other recorded information identified above. They will not be released except as permitted by this code, and any release will be recorded. Where prints, which contain personal data, are taken, the print should not be kept for longer than can be reasonably justified. Prints that are no longer required should be securely destroyed.

 System Controller - Superintendent Headquarters Responsibilities:  Ensure the provision and maintenance of all equipment forming part of the RGP CCTV systems.  Maintain close working liaison with the System Managers.  Ensure the interests of the Royal Gibraltar Police are up held with the terms of this Code of Practice.

 Operational Management – Command and Dispatch (CAD) Sergeant or in his absence the Custody Sergeant Responsibilities:  The CAD Sergeant or, in his absence, the Custody Sergeant is the ‘system manager’  To maintain day to day management of the CCTV systems and operator(s);  To accept overall responsibility for the System and for ensuring that this Code of Practice is complied with; Location and Ownership of Cam Request to View Data Requests to view data generated by any of the external RGP CCTV systems will be done in accordance with the Data Protection Act 2004.

 Process of Disclosure:  Verify the accuracy of the request.  Replay or supply data to the Courts, Crown Counsels or Defence counsels  Any viewing of images at NMH will be conducted under the responsibility of PSD and not in the Command and Dispatch Unit.  Only data, which is specific to the request will be shown, copied or disclosed.  The data controller or his representative will approve the release of any image(s) to the media where an appeal for witnesses is made for a specific incident in order to identify a suspect or missing person(s).

6 Request for information Any request from an individual for the disclosure of personal data which s/he believes is recorded by any of the RGP CCTV systems will be in accordance with the Data Protection Act 2004. The principles of the Data Protection Act 2004 shall be followed in respect of every request. Individuals whose image is captured on RGP CCTV systems are entitled to make an access request. If the request cannot be complied with without identifying another individual, permission from that individual must be obtained unless it is reasonable in all the circumstances to comply with the request without the consent of that individual.

Applicants will have to provide sufficient information, depending on the circumstances of the request, for the RGP to be able to provide such data. Information that may be required would include photographic images of the applicant, specific date, time and location when s/he was captured on a camera.

>>

DIX 1 – Locations of Public CCTV Cameras

 Casemates Square

 Top of Casemates Hill

 East of Casemates covering the Landport Tunnel South exit/entrance

 Market Place Bus Terminus

 Waterport Road

 Cornwall’s Parade also covering Bell Lane and Engineers Lane

 Castle Steps

 Irish Town – outside Central

 Governor’s Street – at Junction with Hospital Hill

 New Mole House external perimeter

 Request Form

7